Skip to main content
Darkfield

Operator dossier

Redransomware (also tracked as red ransomware) is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 16 public victims claimed by this operator between March 28, 2024 and June 12, 2024. Redransomware is a relatively new ransomware operation that emerged in March 2024, operating with apparent financial motivations and demonstrating a geographically diverse targeting approach across multiple continents. Due to the group's recent emergence and limited public documentation from established threat intelligence sources, specific details about their country of origin, organizational structure, and potential affiliations remain largely unconfirmed by major security agencies. The group has targeted at least 16 known victims across a varied sector portfolio including technology companies, business services, manufacturing firms, hospitality and tourism organizations, and healthcare entities, with attacks concentrated primarily in the United States while also extending to international targets in Mexico, Denmark, Singapore, and Antigua and Barbuda. Given the nascent nature of this threat actor and the limited timeframe since their first observed activity, comprehensive details about their specific attack methodologies, tools, encryption techniques, and operational tactics have not yet been extensively documented in public threat intelligence reports from established sources such as CISA, FBI, or major cybersecurity firms. As of available reporting, Redransomware appears to remain an active threat, though the group's relatively small victim count and recent emergence suggest they may still be in early operational phases or represent a smaller-scale ransomware operation compared to more established and widely-documented threat groups.

Most-targeted sectors

Most-affected countries

Recent disclosures by Redransomware

All 16 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Redransomware →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Redransomware

aka red ransomware · 16 victims indexed · first seen 2 years ago · last activity 2 years ago

16
Victims indexed
#174 of 364 tracked operators
3m
Active period
Mar 2024 → Jun 2024
9
Countries hit
top United States · 7

At a glance

Status
inactive
Aliases
red ransomware
First seen
2 years ago
Last activity
2 years ago
Onion sites
1 known endpoint
Primary sector
Technology · 5 hits

About

Redransomware is a relatively new ransomware operation that emerged in March 2024, operating with apparent financial motivations and demonstrating a geographically diverse targeting approach across multiple continents. Due to the group's recent emergence and limited public documentation from established threat intelligence sources, specific details about their country of origin, organizational structure, and potential affiliations remain largely unconfirmed by major security agencies. The group has targeted at least 16 known victims across a varied sector portfolio including technology companies, business services, manufacturing firms, hospitality and tourism organizations, and healthcare entities, with attacks concentrated primarily in the United States while also extending to international targets in Mexico, Denmark, Singapore, and Antigua and Barbuda. Given the nascent nature of this threat actor and the limited timeframe since their first observed activity, comprehensive details about their specific attack methodologies, tools, encryption techniques, and operational tactics have not yet been extensively documented in public threat intelligence reports from established sources such as CISA, FBI, or major cybersecurity firms. As of available reporting, Redransomware appears to remain an active threat, though the group's relatively small victim count and recent emergence suggest they may still be in early operational phases or represent a smaller-scale ransomware operation compared to more established and widely-documented threat groups.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

4 months
2024-03-01T00:00:00+00:00 · 122024-04-01T00:00:00+00:00 · 12024-05-01T00:00:00+00:00 · 22024-06-01T00:00:00+00:00 · 1
2024-03-01T00:00:00+00:002024-06-01T00:00:00+00:00

Top countries

🇺🇸 United States
7
🇲🇽 Mexico
2
🇩🇰 Denmark
1
🇸🇬 Singapore
1
Antigua & Barbuda
1
🇪🇸 Spain
1
🇧🇪 Belgium
1
🇹🇷 Turkey
1
United States dossier →Mexico dossier →Denmark dossier →Singapore dossier →

Top sectors

Technology
5
Business Services
4
Manufacturing
3
Hospitality and Tourism
1
Healthcare
1
Financial
1
Technology dossier →Business Services dossier →Manufacturing dossier →Hospitality and Tourism dossier →

MITRE ATT&CK

5 techniques · 4 tactics

Tactics

Initial AccessExecutionDefense EvasionImpact

Techniques

  • T1566Phishing
  • T1190Exploit Public-Facing Application
  • T1059Command and Scripting Interpreter
  • T1027Obfuscated Files or Information
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

1 known
  • http://33zo6hifw4usofzdnz74fm2zmhd3zsknog5jboqdgblcbwrmpcqzzbid.onion

Source

Updated 2 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Redransomware posts a victim.

Add Redransomware to your watchlist — Pro pings you within 5 minutes of any new Redransomware leak-site post, Telegram callout, or affiliate-rebrand inference.