Skip to main content
Darkfield

SHIBA

active · posted 4 days ago

#355 of 402 tracked operators by disclosures · profile and aliases from MISP galaxy, checked weekly

Watch this operatorCSVAPILineage
Disclosures1none in the last 7 daysVelocity · month over monthunknownmonthly series not yet builtMirrors reachable2known locations · status not served by this backend
Corroborationunknownnot recorded for this operator yet

Infrastructure

2 known onion locations from the catalogs
  • Checking mirrors

Recent disclosures

all, filterable →
  • Loading recent disclosures
How we know this: victim rows from our Tor crawl and the RansomLook tracker, de-duplicated by canonical operator and name; "active" means a post in the last 60 days; mirror status from our own curl over Tor; aliases and references from MISP galaxy; tradecraft from ATT&CK STIX. Operator claims are claims.Updated 4 days ago

Get alerted the next time SHIBA posts a victim.

Add SHIBA to your watchlist: an alert within the sync cadence on any new SHIBA leak-site post, Telegram callout or affiliate-rebrand inference.

Operator dossier

SHIBA is a ransomware operator currently active on public leak sites. Darkfield has indexed 1 public victims claimed by this operator.

Recent disclosures by SHIBA

All 1 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for SHIBA →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated catalogues (RansomLook, deepdarkCTI, MISP-galaxy). Status changes from active to dormant when no new disclosure appears for 60 days. Without a disclosure date, activity is unknown. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.