Skip to main content
Darkfield

Operator dossier

teslacrypt is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 2 public victims claimed by this operator between February 22, 2016 and March 9, 2016. TeslaCrypt was a ransomware family that emerged in February 2016, primarily motivated by financial gain through encryption of victim files and ransom demands. The group operated independently rather than as a Ransomware-as-a-Service model, with limited public information available regarding their country of origin or affiliations to other cybercriminal organizations. Based on documented cases, TeslaCrypt primarily targeted government facilities in the United States, though their specific initial access vectors and technical methodologies remain poorly documented in public threat intelligence reporting. The ransomware family had a relatively limited operational scope with only two known documented victims according to available intelligence sources. TeslaCrypt ceased operations and is no longer considered an active threat, with the operators having released master decryption keys in 2016 before disappearing from the threat landscape.

Most-targeted sectors

Most-affected countries

Recent disclosures by teslacrypt

All 2 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for teslacrypt →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

teslacrypt

2 victims indexed · first seen 10 years ago · last activity 10 years ago

2
Victims indexed
#300 of 364 tracked operators
1m
Active period
Feb 2016 → Mar 2016
1
Countries hit
top US · 2

At a glance

Status
inactive
First seen
10 years ago
Last activity
10 years ago
Primary sector
Government Facilities · 2 hits

About

TeslaCrypt was a ransomware family that emerged in February 2016, primarily motivated by financial gain through encryption of victim files and ransom demands. The group operated independently rather than as a Ransomware-as-a-Service model, with limited public information available regarding their country of origin or affiliations to other cybercriminal organizations. Based on documented cases, TeslaCrypt primarily targeted government facilities in the United States, though their specific initial access vectors and technical methodologies remain poorly documented in public threat intelligence reporting. The ransomware family had a relatively limited operational scope with only two known documented victims according to available intelligence sources. TeslaCrypt ceased operations and is no longer considered an active threat, with the operators having released master decryption keys in 2016 before disappearing from the threat landscape.

Timeline

2 months
2016-02-01T00:00:00+00:00 · 12016-03-01T00:00:00+00:00 · 1
2016-02-01T00:00:00+00:002016-03-01T00:00:00+00:00

Top countries

🇺🇸 United States
2
United States dossier →

Top sectors

Government Facilities
2
Government Facilities dossier →

MITRE ATT&CK

3 techniques · 3 tactics

Tactics

Initial AccessExecutionImpact

Techniques

Recent victims

Loading…

Source

Updated 10 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time teslacrypt posts a victim.

Add teslacrypt to your watchlist — Pro pings you within 5 minutes of any new teslacrypt leak-site post, Telegram callout, or affiliate-rebrand inference.