Skip to main content
Darkfield

Operator dossier

Ransomcortex is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 4 public victims claimed by this operator between July 12, 2024. Ransomcortex is an emerging ransomware group that first appeared in July 2024, operating with apparent financial motivation based on their targeting patterns and ransom demands. Given the group's recent emergence and limited public documentation, details about their country of origin and organizational structure remain unclear, though their primary focus on Brazilian targets suggests potential regional connections or familiarity with local business environments. The group has demonstrated a preference for targeting critical infrastructure and service sectors, specifically healthcare, manufacturing, and hospitality organizations, though specific details about their initial access methods, encryption techniques, and whether they employ data exfiltration tactics have not been extensively documented by major security firms. With only four confirmed victims since their emergence six months ago, Ransomcortex appears to operate on a smaller scale compared to established ransomware families, and no major high-profile attacks or significant law enforcement actions have been publicly reported against this group. As of early 2024, the group appears to remain active but maintains a relatively low profile in the ransomware landscape.

Most-targeted sectors

Most-affected countries

Recent disclosures by Ransomcortex

All 4 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Ransomcortex →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Ransomcortex

4 victims indexed · first seen 2 years ago · last activity 2 years ago

4
Victims indexed
#267 of 364 tracked operators
<1m
Active period
Jul 2024 → Jul 2024
1
Countries hit
top Brazil · 2

At a glance

Status
inactive
First seen
2 years ago
Last activity
2 years ago
Onion sites
1 known endpoint
Primary sector
Healthcare · 2 hits

About

Ransomcortex is an emerging ransomware group that first appeared in July 2024, operating with apparent financial motivation based on their targeting patterns and ransom demands. Given the group's recent emergence and limited public documentation, details about their country of origin and organizational structure remain unclear, though their primary focus on Brazilian targets suggests potential regional connections or familiarity with local business environments. The group has demonstrated a preference for targeting critical infrastructure and service sectors, specifically healthcare, manufacturing, and hospitality organizations, though specific details about their initial access methods, encryption techniques, and whether they employ data exfiltration tactics have not been extensively documented by major security firms. With only four confirmed victims since their emergence six months ago, Ransomcortex appears to operate on a smaller scale compared to established ransomware families, and no major high-profile attacks or significant law enforcement actions have been publicly reported against this group. As of early 2024, the group appears to remain active but maintains a relatively low profile in the ransomware landscape.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

1 months
2024-07-01T00:00:00+00:00 · 4
2024-07-01T00:00:00+00:002024-07-01T00:00:00+00:00

Top countries

🇧🇷 Brazil
2
Brazil dossier →

Top sectors

Healthcare
2
Manufacturing
1
Hospitality and Tourism
1
Healthcare dossier →Manufacturing dossier →Hospitality and Tourism dossier →

MITRE ATT&CK

4 techniques · 4 tactics

Tactics

Initial AccessExecutionDefense EvasionImpact

Techniques

  • T1566Phishing
  • T1059Command and Scripting Interpreter
  • T1027Obfuscated Files or Information
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

1 known
  • http://gg6owuhu72muoelkt2msjrp2llwr2on5634sk5v2xefzmobvryywbhid.onion

Source

Updated 2 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Ransomcortex posts a victim.

Add Ransomcortex to your watchlist — Pro pings you within 5 minutes of any new Ransomcortex leak-site post, Telegram callout, or affiliate-rebrand inference.