Operator dossier

radiant is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 8 public victims claimed by this operator between October 12, 2025 and October 29, 2025. Based on publicly available information, Radiant is an emerging ransomware group that was first observed in October 2025, representing one of the newer threats in the ransomware landscape with a relatively small footprint of eight documented victims to date. The group appears to be financially motivated, following the typical ransomware business model of encrypting victim data and demanding payment for decryption keys. Limited intelligence suggests the group operates independently rather than as a ransomware-as-a-service operation, though insufficient data exists to definitively establish their country of origin or potential affiliations with other cybercriminal organizations. Due to the group's recent emergence and limited victim count, specific details regarding their attack methodology, initial access vectors, and technical capabilities remain largely undocumented by major security research organizations. Their targeting pattern shows a geographic focus on Western nations including the United States, Netherlands, Germany, United Kingdom, and Finland, with victim organizations spanning healthcare, transportation and logistics, agriculture and food production, and consumer services sectors. Given the group's recent emergence in late 2025, there are no documented major campaigns, high-profile attacks, or law enforcement actions against Radiant at this time. The group appears to remain active as of current reporting, though their limited operational history and small victim count suggest they are either in early operational phases or operating at a relatively small scale compared to established ransomware enterprises.

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

radiant

8 victims indexed · first seen 9 months ago · last activity 9 months ago

Victims indexed

#221 of 364 tracked operators

<1m

Active period

Oct 2025 → Oct 2025

Countries hit

top US · 2

At a glance

Status: inactive
First seen: 9 months ago
Last activity: 9 months ago
Onion sites: 1 known endpoint
Primary sector: Not Found · 3 hits

About

Based on publicly available information, Radiant is an emerging ransomware group that was first observed in October 2025, representing one of the newer threats in the ransomware landscape with a relatively small footprint of eight documented victims to date. The group appears to be financially motivated, following the typical ransomware business model of encrypting victim data and demanding payment for decryption keys. Limited intelligence suggests the group operates independently rather than as a ransomware-as-a-service operation, though insufficient data exists to definitively establish their country of origin or potential affiliations with other cybercriminal organizations. Due to the group's recent emergence and limited victim count, specific details regarding their attack methodology, initial access vectors, and technical capabilities remain largely undocumented by major security research organizations. Their targeting pattern shows a geographic focus on Western nations including the United States, Netherlands, Germany, United Kingdom, and Finland, with victim organizations spanning healthcare, transportation and logistics, agriculture and food production, and consumer services sectors. Given the group's recent emergence in late 2025, there are no documented major campaigns, high-profile attacks, or law enforcement actions against Radiant at this time. The group appears to remain active as of current reporting, though their limited operational history and small victim count suggest they are either in early operational phases or operating at a relatively small scale compared to established ransomware enterprises.

Timeline

1 months

2025-10-01T00:00:00+00:002025-10-01T00:00:00+00:00

Top countries

🇺🇸 United States

🇳🇱 Netherlands

🇩🇪 Germany

🇬🇧 United Kingdom

🇫🇮 Finland

United States dossier →Netherlands dossier →Germany dossier →United Kingdom dossier →

Top sectors

Healthcare

Transportation/Logistics

Agriculture and Food Production

Consumer Services

Education

Healthcare dossier →Transportation/Logistics dossier →Agriculture and Food Production dossier →Consumer Services dossier →

MITRE ATT&CK

4 techniques · 3 tactics

Tactics

Initial AccessExecutionImpact

Techniques

T1566Phishing
T1190Exploit Public-Facing Application
T1204User Execution
T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

1 known

http://trfqksm6peaeyz4q6egxbij5n2ih6zrg65of4kwasrejc7hnw2jtxryd.onion

Source

Updated 9 months ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time radiant posts a victim.

Add radiant to your watchlist — Pro pings you within 5 minutes of any new radiant leak-site post, Telegram callout, or affiliate-rebrand inference.