Sekhmet is a relatively obscure ransomware group that emerged in May 2020, primarily motivated by financial gain through targeted attacks against critical infrastructure sectors. The group's origin and affiliations remain largely undocumented in public threat intelligence reports, with limited information available about whether they operate independently or as part of a ransomware-as-a-service model. Based on available data, Sekhmet has demonstrated a preference for targeting organizations in the United States, with documented attacks against entities in the information technology and energy sectors, though their specific attack methodologies, initial access vectors, and encryption techniques have not been extensively detailed in public security research. The group's limited public profile is reflected in their small number of documented victims, with only two confirmed cases reported in open-source intelligence. Sekhmet's current operational status remains unclear due to the scarcity of recent public reporting on their activities, making it difficult to determine whether the group remains active, has ceased operations, or potentially rebranded under a different name. The group has been linked to 2 public disclosures across our corpus. First observed on a leak site on May 30, 2020; most recent post June 20, 2020. The operation is currently inactive.
How we know this. Darkfield monitors public ransomware leak sites continuously, archiving every new disclosure and the data later released against the victim. Each entry on this page is sourced from the operator's own publication and cross-checked against complementary OSINT feeds (RansomLook, ransomware.live, RansomWatch). We do not collect or host stolen data — only the metadata, timestamps and screenshots needed to make the public disclosure searchable and accountable. Records here are corrected when the original post is edited, retracted, or merged with another disclosure.
