AuditTeam
First seen April 8, 2026Active56 claimed victims
The claims below are reproduced as posted by AuditTeam on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
AuditTeam is a small ransomware group with approximately 5 known victims, primarily targeting organizations in East and Southeast Asia across technology and manufacturing sectors, operating a data leak site consistent with double-extortion methodology.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Sa***ge | October 13, 2026 | ransomware_live | — |
| Ze***ce | October 13, 2026 | ransomware_live | — |
| AD***ed | October 13, 2026 | ransomware_live | — |
| Admirals Trading | October 2, 2026 | ransomware_live | — |
| Ad***ng | October 2, 2026 | ransomware_live | — |
| Paid Victim 32373FFB7AF7E725 | September 29, 2026 | ransomware_live | — |
| ProMind IT | September 22, 2026 | ransomware_live | — |
| Pr***IT | September 22, 2026 | ransomware_live | — |
| steelco | September 20, 2026 | ransomware_live | — |
| st***co | September 20, 2026 | ransomware_live | — |
| td***up | September 19, 2026 | ransomware_live | — |
| Paid Victim 192EB2B6AD7B98D9 | September 18, 2026 | ransomware_live | — |
| Ne***ox | September 14, 2026 | ransomware_live | — |
| vit.ac.in | September 13, 2026 | ransomware_live | — |
| vi***in | September 13, 2026 | ransomware_live | — |
| Paid Victim FDC699DE3A112669 | September 13, 2026 | ransomware_live | — |
| Paid Victim F9CF4B639CAC1B18 | September 13, 2026 | ransomware_live | — |
| TEK SPB | September 12, 2026 | ransomware_live | — |
| TE***PB | September 12, 2026 | ransomware_live | — |
| kit-e.jp | September 9, 2026 | ransomware_live | — |
| my***ru | September 9, 2026 | ransomware_live | — |
| ki***jp | September 9, 2026 | ransomware_live | — |
| mo***al | September 9, 2026 | ransomware_live | — |
| krimax.org | September 8, 2026 | ransomware_live | — |
| gownet.net | September 8, 2026 | ransomware_live | — |
| dg.ac.kr | September 8, 2026 | ransomware_live | — |
| buben | September 8, 2026 | ransomware_live | — |
| Wise IT | September 8, 2026 | ransomware_live | — |
| palletshop | September 8, 2026 | ransomware_live | — |
| kr***rg | September 8, 2026 | ransomware_live | — |
| go***et | September 8, 2026 | ransomware_live | — |
| dg***kr | September 8, 2026 | ransomware_live | — |
| pa***op | September 8, 2026 | ransomware_live | — |
| Wi***IT | September 8, 2026 | ransomware_live | — |
| bu***en | September 8, 2026 | ransomware_live | — |
| PIT.local | August 27, 2026 | ransomware_live | — |
| PI***al | August 27, 2026 | ransomware_live | — |
| mansurovogroup | August 26, 2026 | ransomware_live | — |
| ma***up | August 25, 2026 | ransomware_live | — |
| De***up | August 18, 2026 | ransomware_live | — |
| Demidov Steel Group | August 18, 2026 | ransomware_live | — |
| I-SYS | June 15, 2026 | ransomware_live | — |
| I-***YS | June 14, 2026 | ransomware_live | — |
| Paid Victim 111CEAA5AD9DA2F1 | June 4, 2026 | ransomware_live | — |
| ca***lm | June 2, 2026 | ransomware_live | — |
| On***de | May 28, 2026 | ransomware_live | — |
| Paid Victim B35411691DDC2265 | May 28, 2026 | ransomware_live | — |
| Mo***et | May 15, 2026 | ransomware_live | — |
| Mopas Online Supermarket | May 15, 2026 | ransomware_live | — |
| Tr***ic | May 10, 2026 | ransomware_live | — |
| Trésor Public | May 10, 2026 | ransomware_live | — |
| Paid Victim D3C1388C1B73BCA2 | April 8, 2026 | ransomware_live | — |
| Paid Victim A98A624456DA525F | April 8, 2026 | ransomware_live | — |
| Paid Victim CCD233FEE92FFA2D | April 8, 2026 | ransomware_live | — |
| joycity | March 5, 2026 | ransomware_live | — |
| Kawasaki Motors Philippines Corporation | February 21, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).