Skip to main content
Darkfield

Operator dossier

Underground is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 26 public victims claimed by this operator between May 1, 2024 and August 15, 2025. Underground is a relatively new ransomware group that emerged in May 2024, primarily motivated by financial gain through extortion operations targeting organizations across multiple sectors. The group's origin and affiliations remain largely undocumented in public threat intelligence reporting, with no confirmed details about their country of origin or whether they operate as an independent entity or through a Ransomware-as-a-Service model. Based on the limited public information available, Underground has demonstrated a preference for targeting technology, healthcare, business services, manufacturing, and agriculture sectors, with their attacks concentrated primarily in the United States, Canada, South Korea, Germany, and Taiwan. The group's specific attack methodologies, initial access vectors, and technical capabilities have not been extensively documented in publicly available threat intelligence reports from major security firms or government agencies. With only 26 known victims since their emergence in May 2024, Underground represents a smaller-scale operation compared to established ransomware groups, though their cross-sector targeting approach indicates opportunistic victim selection rather than specialized industry focus. Given the recent emergence of this group and limited public reporting, Underground appears to remain active but operates at a relatively low profile compared to more established ransomware families.

Most-targeted sectors

Most-affected countries

Recent disclosures by Underground

All 26 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Underground →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Underground

26 victims indexed · first seen 2 years ago · last activity 11 months ago

26
Victims indexed
#147 of 364 tracked operators
1y 3m
Active period
May 2024 → Aug 2025
10
Countries hit
top United States · 6

At a glance

Status
inactive
First seen
2 years ago
Last activity
11 months ago
Onion sites
1 known endpoint
Primary sector
Technology · 7 hits

About

Underground is a relatively new ransomware group that emerged in May 2024, primarily motivated by financial gain through extortion operations targeting organizations across multiple sectors. The group's origin and affiliations remain largely undocumented in public threat intelligence reporting, with no confirmed details about their country of origin or whether they operate as an independent entity or through a Ransomware-as-a-Service model. Based on the limited public information available, Underground has demonstrated a preference for targeting technology, healthcare, business services, manufacturing, and agriculture sectors, with their attacks concentrated primarily in the United States, Canada, South Korea, Germany, and Taiwan. The group's specific attack methodologies, initial access vectors, and technical capabilities have not been extensively documented in publicly available threat intelligence reports from major security firms or government agencies. With only 26 known victims since their emergence in May 2024, Underground represents a smaller-scale operation compared to established ransomware groups, though their cross-sector targeting approach indicates opportunistic victim selection rather than specialized industry focus. Given the recent emergence of this group and limited public reporting, Underground appears to remain active but operates at a relatively low profile compared to more established ransomware families.

Timeline

8 months
2024-05-01T00:00:00+00:00 · 132024-06-01T00:00:00+00:00 · 32024-07-01T00:00:00+00:00 · 22024-10-01T00:00:00+00:00 · 22024-12-01T00:00:00+00:00 · 12025-04-01T00:00:00+00:00 · 32025-06-01T00:00:00+00:00 · 12025-08-01T00:00:00+00:00 · 1
2024-05-01T00:00:00+00:002025-08-01T00:00:00+00:00

Top countries

🇺🇸 United States
6
🇨🇦 Canada
3
🇰🇷 South Korea
3
🇩🇪 Germany
2
🇹🇼 Taiwan
2
🇪🇸 Spain
1
🇫🇷 France
1
🇸🇬 Singapore
1
United States dossier →Canada dossier →South Korea dossier →Germany dossier →

Top sectors

Technology
7
Healthcare
5
Business Services
5
Manufacturing
4
Agriculture and Food Production
2
Financial
1
Transportation/Logistics
1
Technology dossier →Healthcare dossier →Business Services dossier →Manufacturing dossier →

MITRE ATT&CK

5 techniques · 4 tactics

Tactics

Initial AccessExecutionDefense EvasionImpact

Techniques

  • T1566Phishing
  • T1190Exploit Public-Facing Application
  • T1204User Execution
  • T1027Obfuscated Files or Information
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

1 known
  • http://47glxkuxyayqrvugfumgsblrdagvrah7gttfscgzn56eyss5wg3uvmqd.onion

Source

Updated 11 months ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Underground posts a victim.

Add Underground to your watchlist — Pro pings you within 5 minutes of any new Underground leak-site post, Telegram callout, or affiliate-rebrand inference.