ClassicBrechasMapaActoresTTP MatrixAnaliticaAlertasCyberNewsArsenalExploitsKillChainOrigenSSLBLRansomLookRansomwhere
aware
3 incidentes
1 paises
0 sectores
ransomware null Ultimo: 2026-06-29
Aliases: Umbrella Revolution, Dissident Groups, Listed slide 4
Aware is a ransomware group that emerged in late 2023 and gained momentum throughout 2024. It operates a Tor-based data leak site. The group is known for deploying a specialized ransomware variant designed to encrypt sensitive data across Windows, Linux, and ESXi environments. Aware employs a double extortion model, which involves exfiltrating victim data before encryption to maintain leverage, even if victims have backups. Public documentation regarding Aware's specific victims, tools, or detailed tactics, techniques, and procedures is currently very limited.
Aliases del actor
Actores similares
Canales, DLS e infraestructura asociada
Clasificacion automatica desde IntelTracker/APTTrail/OSINT. Estado real solo si viene indicado por la fuente.
| Tipo | Estado | Host / enlace | Title / ultimo titulo |
|---|---|---|---|
| Repositorio | unknown | github.com | Ransom Notes: aware (1 notes from ThreatLabz) |
| DLS / onion | unknown | ui2uleaiisccbtcooyi34cy5u3plpd5wraiza6wtibolshuf7tnzziid.onion | aware |
| DLS / leak site | unknown | ransomware.anggipradana.com | Ransomware Group: aware |
| DLS / leak site | unknown | nitter.net | eCrime.ch: RT by @ecrime_ch: #ESETresearch has observed DeadLock ransomware expanding its use of Polygon blockchain smart contracts. Previously used only for chat proxy server address rotation, DeadLock has now added a new contract with the gang's DLS entries - a first of its kind we are aware of. 1/6 |
| X/Twitter | unknown | x.com | eCrime.ch: RT by @ecrime_ch: #ESETresearch has observed DeadLock ransomware expanding its use of Polygon blockchain smart contracts. Previously used only for chat proxy server address rotation, DeadLock has now added a new contract with the gang's DLS entries - a first of its kind we are aware of. 1/6 |
| Foro | unknown | nitter.net | Dark Web Informer: VRI Portal de Conteúdo dataset claim posted on a forum VRI Portal de Conteúdo is a Brazilian content portal focused on technical material in accounting, corporate, labor, and tax law areas. A forum user claims a dataset tied to VRI Portal de Conteúdo was exposed, allegedly containing 40K rows. |
| Foro | unknown | x.com | Dark Web Informer: VRI Portal de Conteúdo dataset claim posted on a forum VRI Portal de Conteúdo is a Brazilian content portal focused on technical material in accounting, corporate, labor, and tax law areas. A forum user claims a dataset tied to VRI Portal de Conteúdo was exposed, allegedly containing 40K rows. |
Paises afectados
United States (1)Paises objetivo (SOCRadar)
United Arab Emirates
Australia
Belgium
Brazil
Canada
Germany
France
Italy
Maldives
PakistanSectores objetivo (SOCRadar)
Energy & Utilities ConstructionManufacturingRetailTransportation&WarehousingInformation ServicesFinanceProfessional&Technical ServicesEducational ServicesHealthCare & Social Assistance