Skip to main content
Darkfield

Operator dossier

Redalert (also tracked as Red Alert) is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 6 public victims claimed by this operator between July 14, 2022 and September 22, 2022. Redalert is a relatively obscure ransomware group that emerged in July 2022 with primarily financial motivations, operating on a smaller scale compared to major ransomware families. The group's origin and potential affiliations remain largely undocumented in public threat intelligence reporting, with limited information available from major security organizations regarding their operational structure or whether they operate as a Ransomware-as-a-Service model. Based on available data, Redalert has demonstrated a geographic focus on Western European targets, particularly concentrating their operations against entities in the United Kingdom and France, though their specific attack methodologies, initial access vectors, and technical capabilities have not been extensively documented in public security research. With only six known victims since their emergence, the group represents a minor player in the ransomware ecosystem, and their limited operational footprint suggests they may lack the sophistication and resources of more prominent ransomware operations. Current intelligence indicates minimal ongoing activity from this group, though definitive information about their operational status, potential disruption, or dissolution is not available in public reporting from major cybersecurity organizations.

Most-affected countries

Recent disclosures by Redalert

All 6 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Redalert →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Redalert

aka Red Alert · 6 victims indexed · first seen 4 years ago · last activity 4 years ago

6
Victims indexed
#238 of 364 tracked operators
2m
Active period
Jul 2022 → Sep 2022
2
Countries hit
top United Kingdom · 1

At a glance

Status
inactive
Aliases
Red Alert
First seen
4 years ago
Last activity
4 years ago
Onion sites
1 known endpoint

About

Redalert is a relatively obscure ransomware group that emerged in July 2022 with primarily financial motivations, operating on a smaller scale compared to major ransomware families. The group's origin and potential affiliations remain largely undocumented in public threat intelligence reporting, with limited information available from major security organizations regarding their operational structure or whether they operate as a Ransomware-as-a-Service model. Based on available data, Redalert has demonstrated a geographic focus on Western European targets, particularly concentrating their operations against entities in the United Kingdom and France, though their specific attack methodologies, initial access vectors, and technical capabilities have not been extensively documented in public security research. With only six known victims since their emergence, the group represents a minor player in the ransomware ecosystem, and their limited operational footprint suggests they may lack the sophistication and resources of more prominent ransomware operations. Current intelligence indicates minimal ongoing activity from this group, though definitive information about their operational status, potential disruption, or dissolution is not available in public reporting from major cybersecurity organizations.

References

2 links

External sources curated by the MISP threat-intel community.

Timeline

2 months
2022-07-01T00:00:00+00:00 · 42022-09-01T00:00:00+00:00 · 2
2022-07-01T00:00:00+00:002022-09-01T00:00:00+00:00

Top countries

🇬🇧 United Kingdom
1
🇫🇷 France
1
United Kingdom dossier →France dossier →

MITRE ATT&CK

4 techniques · 4 tactics

Tactics

Initial AccessExecutionDefense EvasionImpact

Techniques

  • T1566Phishing
  • T1059Command and Scripting Interpreter
  • T1027Obfuscated Files or Information
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

1 known
  • http://blog2hkbm6gogpv2b3uytzi3bj5d5zmc4asbybumjkhuqhas355janyd.onion

Source

Updated 4 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Redalert posts a victim.

Add Redalert to your watchlist — Pro pings you within 5 minutes of any new Redalert leak-site post, Telegram callout, or affiliate-rebrand inference.