Skip to main content
Darkfield

Operator dossier

settra is a ransomware operator currently active on public leak sites. Darkfield has indexed 22 public victims claimed by this operator between June 28, 2026 and June 30, 2026. Settra is a ransomware group first observed in June 2026 with an apparent primary motivation of financial gain, having claimed at least 11 victims within a relatively short operational window. Given the recency of their emergence and limited public documentation from major threat intelligence sources such as CISA, FBI, or Mandiant at this time, detailed technical attribution remains unconfirmed. Their targeting pattern shows a geographic concentration in the United States, Taiwan, Portugal, Singapore, and Canada, suggesting an opportunistic rather than narrowly focused regional strategy. Affected sectors include Consumer Services, Manufacturing, Transportation and Logistics, and Agriculture and Food Production, indicating the group does not restrict itself to a single vertical and likely prioritizes target accessibility over sector-specific expertise. No publicly documented information is currently available to confirm their country of origin, RaaS affiliation, specific initial access vectors, encryption methodology, or extortion tactics, and no major law enforcement actions against the group have been publicly reported as of this writing. Given their nascent operational timeline and limited victim count, Settra should be considered an emerging threat actor warranting continued monitoring as their tactics, techniques, and procedures become better characterized through future incident reporting and threat intelligence disclosures.

Most-targeted sectors

Most-affected countries

Recent disclosures by settra

All 22 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for settra →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

settra

22 victims indexed · first seen 5 days ago · last activity 3 days ago

22
Victims indexed
#154 of 360 tracked operators
<1m
Active period
Jun 2026 → Jun 2026
7
Countries hit
top US · 4

At a glance

Status
active
First seen
5 days ago
Last activity
3 days ago
Onion sites
1 known endpoint
Primary sector
Consumer Services · 3 hits

About

Settra is a ransomware group first observed in June 2026 with an apparent primary motivation of financial gain, having claimed at least 11 victims within a relatively short operational window. Given the recency of their emergence and limited public documentation from major threat intelligence sources such as CISA, FBI, or Mandiant at this time, detailed technical attribution remains unconfirmed. Their targeting pattern shows a geographic concentration in the United States, Taiwan, Portugal, Singapore, and Canada, suggesting an opportunistic rather than narrowly focused regional strategy. Affected sectors include Consumer Services, Manufacturing, Transportation and Logistics, and Agriculture and Food Production, indicating the group does not restrict itself to a single vertical and likely prioritizes target accessibility over sector-specific expertise. No publicly documented information is currently available to confirm their country of origin, RaaS affiliation, specific initial access vectors, encryption methodology, or extortion tactics, and no major law enforcement actions against the group have been publicly reported as of this writing. Given their nascent operational timeline and limited victim count, Settra should be considered an emerging threat actor warranting continued monitoring as their tactics, techniques, and procedures become better characterized through future incident reporting and threat intelligence disclosures.

Timeline

1 months
2026-06-01T00:00:00+00:00 · 11
2026-06-01T00:00:00+00:002026-06-01T00:00:00+00:00

Top countries

🇺🇸 United States
4
🇹🇼 Taiwan
2
🇵🇹 Portugal
1
🇸🇬 Singapore
1
🇨🇦 Canada
1
🇰🇷 South Korea
1
Vatican City
1
United States dossier →Taiwan dossier →Portugal dossier →Singapore dossier →

Top sectors

Consumer Services
3
Manufacturing
3
Transportation/Logistics
1
Agriculture and Food Production
1
Technology
1
Consumer Services dossier →Manufacturing dossier →Transportation/Logistics dossier →Agriculture and Food Production dossier →

MITRE ATT&CK

17 techniques · 7 tactics

Tactics

Initial AccessExecutionDefense EvasionDiscoveryCollectionExfiltrationImpact

Techniques

  • T1190Exploit Public-Facing Application
  • T1566Phishing
  • T1059Command and Scripting Interpreter
  • T1047Windows Management Instrumentation
  • T1562Impair Defenses
  • T1070Indicator Removal
  • T1083File and Directory Discovery
  • T1082System Information Discovery
  • T1135Network Share Discovery
  • T1057Process Discovery
  • T1005Data from Local System
  • T1039Data from Network Shared Drive
  • T1041Exfiltration Over C2 Channel
  • T1567Exfiltration Over Web Service
  • T1486Data Encrypted for Impact
  • T1490Inhibit System Recovery
  • T1489Service Stop

Recent victims

Loading…

Onion infrastructure

1 known
  • http://settra5ldqwgtw5q7z5awbsvlksakyfojuc5slgrz5lvapune4fantqd.onion

Source

Updated 3 days ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time settra posts a victim.

Add settra to your watchlist — Pro pings you within 5 minutes of any new settra leak-site post, Telegram callout, or affiliate-rebrand inference.