Skip to main content
Darkfield

Operator dossier

ranstreet is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 1 public victims claimed by this operator between December 21, 2023. Ranstreet is an obscure ransomware group that emerged in December 2023 with limited observed activity and appears to be financially motivated based on typical ransomware operational patterns. The group's origin and affiliations remain unknown, with no publicly documented information from major threat intelligence sources regarding their country of origin, connections to other cybercriminal organizations, or operational structure. Their attack methodology, tools, and specific techniques have not been detailed in public reporting from established security research organizations, likely due to their minimal observed activity and limited victim base. The group has been linked to only one documented victim, with their targeting focused on Portugal, though the specific organization and impact details have not been disclosed in major threat intelligence reports. Ranstreet's current operational status remains unclear given the lack of substantial public documentation and their limited attack footprint since their recent emergence.

Most-affected countries

Recent disclosures by ranstreet

All 1 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for ranstreet →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

ranstreet

1 victims indexed · first seen 3 years ago · last activity 3 years ago

1
Victims indexed
#318 of 364 tracked operators
<1m
Active period
Dec 2023 → Dec 2023
1
Countries hit
top PT · 1

At a glance

Status
inactive
First seen
3 years ago
Last activity
3 years ago

About

Ranstreet is an obscure ransomware group that emerged in December 2023 with limited observed activity and appears to be financially motivated based on typical ransomware operational patterns. The group's origin and affiliations remain unknown, with no publicly documented information from major threat intelligence sources regarding their country of origin, connections to other cybercriminal organizations, or operational structure. Their attack methodology, tools, and specific techniques have not been detailed in public reporting from established security research organizations, likely due to their minimal observed activity and limited victim base. The group has been linked to only one documented victim, with their targeting focused on Portugal, though the specific organization and impact details have not been disclosed in major threat intelligence reports. Ranstreet's current operational status remains unclear given the lack of substantial public documentation and their limited attack footprint since their recent emergence.

Timeline

1 months
2023-12-01T00:00:00+00:00 · 1
2023-12-01T00:00:00+00:002023-12-01T00:00:00+00:00

Top countries

🇵🇹 Portugal
1
Portugal dossier →

MITRE ATT&CK

3 techniques · 3 tactics

Tactics

Initial AccessExecutionImpact

Techniques

  • T1566Phishing
  • T1059Command and Scripting Interpreter
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Source

Updated 3 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time ranstreet posts a victim.

Add ranstreet to your watchlist — Pro pings you within 5 minutes of any new ranstreet leak-site post, Telegram callout, or affiliate-rebrand inference.