Skip to main content
Darkfield

Operator dossier

TRIPLE X is a ransomware operator currently active on public leak sites. Darkfield has indexed 4 public victims claimed by this operator between May 27, 2026 and June 13, 2026. TRIPLE X is a ransomware group first observed in May 2026 with an apparently financially motivated operational focus, though its limited activity to date makes comprehensive characterization difficult. Based on available data, the group has claimed or confirmed at least one victim, with targeting concentrated in Indonesia and within the financial sector, suggesting either a regionally focused threat actor or an early-stage operation still establishing its scope. No detailed technical analysis of TRIPLE X has been publicly documented by CISA, the FBI, Mandiant, or other major threat intelligence providers at this time, meaning its initial access vectors, encryption methodology, extortion tactics, and tooling remain unattributed or unconfirmed in open sources. No notable high-profile campaigns, record ransom demands, or law enforcement actions involving this group have been publicly reported. Given its very recent emergence and single known victim, TRIPLE X should be considered an emerging or nascent threat actor whose operational patterns, affiliations, and capabilities warrant continued monitoring but cannot be fully assessed with the intelligence currently available in the public domain.

Most-targeted sectors

Most-affected countries

Recent disclosures by TRIPLE X

All 4 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for TRIPLE X →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

TRIPLE X

4 victims indexed · first seen 2 months ago · last activity 1 month ago

4
Victims indexed
#267 of 364 tracked operators
1m
Active period
May 2026 → Jun 2026
3
Countries hit
top Indonesia · 1

At a glance

Status
active
First seen
2 months ago
Last activity
1 month ago
Onion sites
1 known endpoint
Primary sector
Finance · 1 hits

About

TRIPLE X is a ransomware group first observed in May 2026 with an apparently financially motivated operational focus, though its limited activity to date makes comprehensive characterization difficult. Based on available data, the group has claimed or confirmed at least one victim, with targeting concentrated in Indonesia and within the financial sector, suggesting either a regionally focused threat actor or an early-stage operation still establishing its scope. No detailed technical analysis of TRIPLE X has been publicly documented by CISA, the FBI, Mandiant, or other major threat intelligence providers at this time, meaning its initial access vectors, encryption methodology, extortion tactics, and tooling remain unattributed or unconfirmed in open sources. No notable high-profile campaigns, record ransom demands, or law enforcement actions involving this group have been publicly reported. Given its very recent emergence and single known victim, TRIPLE X should be considered an emerging or nascent threat actor whose operational patterns, affiliations, and capabilities warrant continued monitoring but cannot be fully assessed with the intelligence currently available in the public domain.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

2 months
2026-05-01T00:00:00+00:00 · 12026-06-01T00:00:00+00:00 · 3
2026-05-01T00:00:00+00:002026-06-01T00:00:00+00:00

Top countries

🇮🇩 Indonesia
1
🇺🇸 United States
1
🇮🇩 Indonesia
1
Indonesia dossier →United States dossier →Indonesia dossier →

Top sectors

Finance
1
Business Services
1
Legal / Immigration Law
1
Financial Services
1
Finance dossier →Business Services dossier →Legal / Immigration Law dossier →Financial Services dossier →

Recent victims

Loading…

Onion infrastructure

1 known
  • http://ojcmpbdncjo5dhaxxll44bq6to3kwqtoeraevgsjquhdtt4uv5l4igid.onion

Source

Updated 1 month ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time TRIPLE X posts a victim.

Add TRIPLE X to your watchlist — Pro pings you within 5 minutes of any new TRIPLE X leak-site post, Telegram callout, or affiliate-rebrand inference.