Skip to main content
Darkfield

Operator dossier

Rancoz is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 6 public victims claimed by this operator between May 5, 2023 and September 3, 2023. Rancoz is a relatively obscure ransomware group that emerged in May 2023, operating with apparent financial motivations and maintaining a low profile compared to major ransomware families. The group's origin and affiliations remain largely undetermined due to limited public documentation from major cybersecurity agencies and research organizations, with no confirmed information regarding their country of origin or whether they operate as a Ransomware-as-a-Service model. Based on available targeting data, Rancoz appears to focus primarily on manufacturing sector organizations within the United States, though their specific attack methodology, initial access vectors, and technical capabilities have not been extensively documented in public threat intelligence reports from established sources such as CISA, FBI, or major cybersecurity firms. With only six known victims documented since their emergence, the group has not conducted any widely-publicized major campaigns or attracted significant law enforcement attention that has been made public. Current intelligence suggests the group remains active as of recent observations, though their limited victim count and low public profile indicate they operate as a relatively minor threat actor within the broader ransomware ecosystem.

Most-targeted sectors

Most-affected countries

Recent disclosures by Rancoz

All 6 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Rancoz →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Rancoz

6 victims indexed · first seen 3 years ago · last activity 3 years ago

6
Victims indexed
#238 of 364 tracked operators
4m
Active period
May 2023 → Sep 2023
1
Countries hit
top United States · 1

At a glance

Status
inactive
First seen
3 years ago
Last activity
3 years ago
Onion sites
1 known endpoint
Primary sector
Manufacturing · 1 hits

About

Rancoz is a relatively obscure ransomware group that emerged in May 2023, operating with apparent financial motivations and maintaining a low profile compared to major ransomware families. The group's origin and affiliations remain largely undetermined due to limited public documentation from major cybersecurity agencies and research organizations, with no confirmed information regarding their country of origin or whether they operate as a Ransomware-as-a-Service model. Based on available targeting data, Rancoz appears to focus primarily on manufacturing sector organizations within the United States, though their specific attack methodology, initial access vectors, and technical capabilities have not been extensively documented in public threat intelligence reports from established sources such as CISA, FBI, or major cybersecurity firms. With only six known victims documented since their emergence, the group has not conducted any widely-publicized major campaigns or attracted significant law enforcement attention that has been made public. Current intelligence suggests the group remains active as of recent observations, though their limited victim count and low public profile indicate they operate as a relatively minor threat actor within the broader ransomware ecosystem.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

4 months
2023-05-01T00:00:00+00:00 · 22023-06-01T00:00:00+00:00 · 12023-07-01T00:00:00+00:00 · 12023-09-01T00:00:00+00:00 · 2
2023-05-01T00:00:00+00:002023-09-01T00:00:00+00:00

Top countries

🇺🇸 United States
1
United States dossier →

Top sectors

Manufacturing
1
Manufacturing dossier →

MITRE ATT&CK

5 techniques · 3 tactics

Tactics

Initial AccessExecutionImpact

Techniques

  • T1566Phishing
  • T1190Exploit Public-Facing Application
  • T1204User Execution
  • T1059Command and Scripting Interpreter
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

1 known
  • http://ze677xuzard4lx4iul2yzf5ks4gqqzoulgj5u4n5n4bbbsxjbfr7eayd.onion

Source

Updated 3 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Rancoz posts a victim.

Add Rancoz to your watchlist — Pro pings you within 5 minutes of any new Rancoz leak-site post, Telegram callout, or affiliate-rebrand inference.