PEAR, also known as Pure Extraction And Ransom, is a cyber extortion group that emerged in June 2025, although it publicly listed its first victims in early August 2025. This group distinguishes itself from traditional ransomware operators by primarily focusing on data theft and extortion rather than file encryption. PEAR operates with a non-encryption model, allowing it to bypass some endpoint detection mechanisms that are designed to identify encryption activities. The group utilizes Tor servers for its storage, communication, and data leak site operations, a tactic that mirrors those employed by other data-extortion groups like Karakurt and BianLian. PEAR describes itself as a private and highly disciplined team, explicitly stating that it has no affiliation with other threat actors. Its primary motivation is financial gain, achieved through the exfiltration and subsequent leveraging of sensitive data.

Aliases del actor

Pure ExtractionRansom Pear TeamPutter PandaPLA Unit 61486TG-6952especialmente en entornos de oficinaG0023ELMER backdoorGh0stHTRANUNICATPoison IvyPandoraCactusPeteTonto TeamBisonalLone Rangerotros mencionados en fuentes OSINT verificadasItaDukeestá vinculado a activistas tibetanosuigurosaunque también ha atacado a países como SiriaIránAfganistánTanzaniaEtiopíaSudánRusiaBelarúsel Emirato Arabe Unitariostorm-1359APT EARTHBERBEROKA

Actores similares

BackdoorDiplomacyapt · 1Putter Pandaapt · 1Test Pandaapt · 0Poisonous Pandaapt · 0POISONUS PANDAapt · 0apt-1877teamactor · 1apt-hackingteamactor · 1apt-sharppandaactor · 1apt-twistedpandaactor · 1Mustang Pandaapt · 1

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker