J, also known as J Group, emerged as a new ransomware group in early 2025, launching its data leak site in May 2025. This group operates as a cybercriminal cartel primarily focused on double extortion through data exfiltration and public leakage. Their primary motivation is financial gain, monetizing stolen data even if ransom negotiations fail. J Group's behavior indicates an evolving modus operandi, as they are still establishing their operational procedures, and have been observed to adopt data brokerage as a common approach. They are often characterized as a leak-site-centric extortion identity, distinguishing themselves by attempting to sell data publicly rather than solely relying on encryption-based ransom payments.

Aliases del actor

lo que sugiere una red de actividades coordenadasComment PandaPLA Unit 61398TG-8223APT1BrownFoxGroup 3GIF89aShadyRATShanghai GroupByzantine CandorG0006Putter PandaPLA Unit 61486TG-6952especialmente en entornos de oficinaTG-0110APT3BuckeyeUPS TeamGroup 6Boyusec – the Guangzhou Boyu Information Technology CompanyLtdG0023ELMER backdoorGh0stHTRANUNICATPoison IvyPandora1Hammer Panda

Actores similares

Conquerors Electronic Armyapt · 0Operation DRBControlapt · 0PhantomControlapt · 0Eloquent Pandaapt · 0apt-desertfalconactor · 1Desert Falconsapt · 0apt-stealthfalconactor · 1Stealth Falconapt · 1Contagious Interviewapt · 1Confuciusapt · 1

Paises afectados

URLs nuevas detectadas en IntelTracker