apt73
Also known as: basheFirst seen April 22, 2024Active157 claimed victims
The claims below are reproduced as posted by apt73 on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
A new ransomware group is said to have emerged in mid-April 2024, under the name 'APT73.' It's worth noting that the group reportedly self-proclaimed as an APT, which stands for 'Advanced Persistent Threat' in the cybersecurity field. According to research, much of the available information about the aforementioned group came from another ransomware group known as LockBit. Source: https://github.com/crocodyli/ThreatActors-TTPs
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| metrabyte.cloud | July 24, 2026 | ransomware_live | — |
| westernint.com | July 6, 2026 | ransomware_live | — |
| vicentetrapani.com | July 6, 2026 | ransomware_live | — |
| azarestan.com | July 6, 2026 | ransomware_live | — |
| dgcement.com | July 6, 2026 | ransomware_live | — |
| aydeniz.com | July 3, 2026 | ransomware_live | — |
| ritavo.com | July 2, 2026 | ransomware_live | — |
| holidaypalace.com | July 2, 2026 | ransomware_live | — |
| flazio.com | July 2, 2026 | ransomware_live | — |
| viennaairport.com | June 23, 2026 | ransomware_live | — |
| gov.br | June 23, 2026 | ransomware_live | — |
| kliknklik.com | June 23, 2026 | ransomware_live | — |
| smarty.arpinet.am | June 3, 2026 | ransomware_live | — |
| elections.mia.gov.am from WOLVES OF TURAN | June 2, 2026 | ransomware_live | — |
| tvnmedia.com | May 22, 2026 | ransomware_live | — |
| minsa.com.mx | May 22, 2026 | ransomware_live | — |
| tkgm.gov.tr | May 22, 2026 | ransomware_live | — |
| alkaloid.com.mk | May 21, 2026 | ransomware_live | — |
| narit.or.th | May 21, 2026 | ransomware_live | — |
| grupopetersen.com.ar | May 21, 2026 | ransomware_live | — |
| providentgh.com | April 27, 2026 | ransomware_live | — |
| medikaplaza.com | April 27, 2026 | ransomware_live | — |
| jgpetrucci.com | April 27, 2026 | ransomware_live | — |
| grupo-principal.com | April 27, 2026 | ransomware_live | — |
| dunav.com | April 27, 2026 | ransomware_live | — |
| cofaco.com | April 27, 2026 | ransomware_live | — |
| arrawdah.org.sa | April 27, 2026 | ransomware_live | — |
| alx-pc.com | April 27, 2026 | ransomware_live | — |
| algosaibi-gtb.com | April 27, 2026 | ransomware_live | — |
| ifmis.go.ke | April 27, 2026 | ransomware_live | — |
| olpro.com.my | April 27, 2026 | ransomware_live | — |
| whessoe.com.my | April 27, 2026 | ransomware_live | — |
| phb.com | April 27, 2026 | ransomware_live | — |
| egov.sc | April 27, 2026 | ransomware_live | — |
| asunim.co | April 27, 2026 | ransomware_live | — |
| centrum.sk | April 27, 2026 | ransomware_live | — |
| 2m.ma | April 27, 2026 | ransomware_live | — |
| ires.ma | April 27, 2026 | ransomware_live | — |
| iam.ma | April 27, 2026 | ransomware_live | — |
| dpwh.gov.ph | April 27, 2026 | ransomware_live | — |
| doghairinc.com | April 27, 2026 | ransomware_live | — |
| isosl.be | April 27, 2026 | ransomware_live | — |
| vanheyghenstaal.be | April 27, 2026 | ransomware_live | — |
| moccae.gov.ae | April 27, 2026 | ransomware_live | — |
| shj.ae | April 27, 2026 | ransomware_live | — |
| haca.ma | April 27, 2026 | ransomware_live | — |
| gedco.ps | April 27, 2026 | ransomware_live | — |
| seit.cl | April 27, 2026 | ransomware_live | — |
| novoair-bd.com | April 27, 2026 | ransomware_live | — |
| bg.ac.rs | April 27, 2026 | ransomware_live | — |
| bankasia-bd.com | April 27, 2026 | ransomware_live | — |
| banak.com | April 27, 2026 | ransomware_live | — |
| amtaar.com | April 27, 2026 | ransomware_live | — |
| corahperu.org | April 27, 2026 | ransomware_live | — |
| mahidol.ac.th | April 27, 2026 | ransomware_live | — |
| compensatii.gov.md | April 27, 2026 | ransomware_live | — |
| hl.co.uk | April 27, 2026 | ransomware_live | — |
| prixet.com | April 27, 2026 | ransomware_live | — |
| minerasancristobal.com | April 27, 2026 | ransomware_live | — |
| bms.com | April 27, 2026 | ransomware_live | — |
| aliorbank.pl | April 27, 2026 | ransomware_live | — |
| certifiedinfosec.com | April 27, 2026 | ransomware_live | — |
| siapenet.gov.br | April 27, 2026 | ransomware_live | — |
| sansirostadium.com | April 27, 2026 | ransomware_live | — |
| polleninformation.at | April 27, 2026 | ransomware_live | — |
| sella.eng.br | April 27, 2026 | ransomware_live | — |
| netromsoftware.ro | April 27, 2026 | ransomware_live | — |
| protectasecurity.pe | April 27, 2026 | ransomware_live | — |
| lamaisonducitron.com | April 27, 2026 | ransomware_live | — |
| baldinger-ag.ch | April 27, 2026 | ransomware_live | — |
| trinitesolutions.com | April 27, 2026 | ransomware_live | — |
| scopeset.de | April 27, 2026 | ransomware_live | — |
| talonsolutions.co.uk | April 27, 2026 | ransomware_live | — |
| pindrophearing.co.uk | April 27, 2026 | ransomware_live | — |
| bigalsfoodservice.co.uk | April 27, 2026 | ransomware_live | — |
| servicepower.com | April 27, 2026 | ransomware_live | — |
| credio.eu | April 27, 2026 | ransomware_live | — |
| trifecta.com | April 27, 2026 | ransomware_live | — |
| tni.mil.id | February 25, 2025 | ransomware_live | — |
| autogedal.ro | February 7, 2025 | ransomware_live | — |
| boostheat.com | February 5, 2025 | ransomware_live | — |
| India car owners | February 4, 2025 | ransomware_live | — |
| mistralsolutions.com | February 4, 2025 | ransomware_live | — |
| coel.com.mx | February 3, 2025 | ransomware_live | — |
| ome.tv | January 30, 2025 | ransomware_live | — |
| icicibank.com | January 21, 2025 | ransomware_live | — |
| malindoair.com | January 20, 2025 | ransomware_live | — |
| fol-23.fr | January 17, 2025 | ransomware_live | — |
| realtaxcanada.com | January 17, 2025 | ransomware_live | — |
| pnp.co.za | January 9, 2025 | ransomware_live | — |
| federalbank.co.in (PART1) | December 24, 2024 | ransomware_live | — |
| linebank.co.id | December 23, 2024 | ransomware_live | — |
| n4telecom.com.br | December 23, 2024 | ransomware_live | — |
| federalbank.co.in | December 20, 2024 | ransomware_live | — |
| bri.co.id | December 18, 2024 | ransomware_live | — |
| www.prixet.com | December 16, 2024 | ransomware_live | — |
| www.minerasancristobal.com | December 11, 2024 | ransomware_live | — |
| leadboxhq.com | December 10, 2024 | ransomware_live | — |
| bankily.mr | December 9, 2024 | ransomware_live | — |
| www.bms.com | December 9, 2024 | ransomware_live | — |
Page 1 of 2Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).