Operator dossier

ULose is a ransomware operator with no recorded disclosures in the past 60 days. Darkfield has indexed 5 public victims claimed by this operator between June 9, 2026. ULose is a ransomware group first observed in June 2026 with an assessed primary motivation of financial gain, operating against a limited but targeted victim set of five known organizations. Based on available data, the group has concentrated its operations against South Korea, with targeting patterns spanning the Financial Services, Manufacturing, and Healthcare sectors, suggesting a deliberate focus on high-value industries where operational disruption and data sensitivity may increase victim willingness to pay. Due to the group's recent emergence and limited victim count, no comprehensive public reporting from CISA, FBI, Mandiant, or equivalent threat intelligence authorities has been documented at this time, and attribution regarding country of origin, RaaS affiliation, specific tooling, or initial access vectors cannot be responsibly stated beyond what the available telemetry reflects. No notable high-profile campaigns, record ransom demands, or law enforcement actions against ULose have been publicly recorded, which is consistent with a nascent or low-volume threat actor that may be in early operational stages, deliberately maintaining a low profile, or operating beneath the threshold that typically triggers formal advisories. The group's current status remains active as of its first observed date, though its trajectory, longevity, and potential rebranding activity should be monitored given the sensitive nature of its targeted sectors.

Recent disclosures by ULose

All 5 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for ULose →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status changes from active to dormant when no new disclosure appears for 60 days. Without a disclosure date, activity is unknown. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

ULose

5 victims indexed · first seen 3 months ago · last activity 3 months ago

Victims indexed

#281 of 399 tracked operators

<1m

Active period

Jun 2026 → Jun 2026

—

Countries hit

At a glance

Status: active
First seen: 3 months ago
Last activity: 3 months ago

About

ULose is a ransomware group first observed in June 2026 with an assessed primary motivation of financial gain, operating against a limited but targeted victim set of five known organizations. Based on available data, the group has concentrated its operations against South Korea, with targeting patterns spanning the Financial Services, Manufacturing, and Healthcare sectors, suggesting a deliberate focus on high-value industries where operational disruption and data sensitivity may increase victim willingness to pay. Due to the group's recent emergence and limited victim count, no comprehensive public reporting from CISA, FBI, Mandiant, or equivalent threat intelligence authorities has been documented at this time, and attribution regarding country of origin, RaaS affiliation, specific tooling, or initial access vectors cannot be responsibly stated beyond what the available telemetry reflects. No notable high-profile campaigns, record ransom demands, or law enforcement actions against ULose have been publicly recorded, which is consistent with a nascent or low-volume threat actor that may be in early operational stages, deliberately maintaining a low profile, or operating beneath the threshold that typically triggers formal advisories. The group's current status remains active as of its first observed date, though its trajectory, longevity, and potential rebranding activity should be monitored given the sensitive nature of its targeted sectors.

References

1 link

External sources curated by the MISP threat-intel community.

ransomlook.io/group/ulose

Recent victims

Loading recent victims

Source

Updated 3 months ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time ULose posts a victim.

Add ULose to your watchlist — Pro pings you within 5 minutes of any new ULose leak-site post, Telegram callout, or affiliate-rebrand inference.