BreachCensus

flocker

First seen May 3, 2024Active59 claimed victims

The claims below are reproduced as posted by flocker on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.

Listed organisation? Contact [email protected].

Profile

Flocker (also linked to the FSociety brand) is a ransomware-as-a-service group active since 2023–2024, targeting Windows and Linux systems via phishing, compromised RDP, and exploit kits using a double extortion model, and observed collaborating with FunkSec.

Description from ransomware.live.

Claimed victims (as posted by the group — unverified)

Victim (as posted)Claimed onSourcePress coverage
H**u.i*v.twJuly 31, 2025ransomware_live—
G*****n.comJuly 31, 2025ransomware_live—
T***********p.comJuly 31, 2025ransomware_live—
Ieee-apscon.orgJuly 31, 2025ransomware_live—
G*********************y.orgJuly 15, 2025ransomware_live—
S******h.comJuly 5, 2025ransomware_live—
I*******n.comJune 30, 2025ransomware_live—
Idgcayman.comJune 30, 2025ransomware_live—
A*****e.gov.aeJune 5, 2025ransomware_live—
Ajmanre.gov.aeJune 5, 2025ransomware_live—
l*s.com.vnMay 28, 2025ransomware_live—
Lts.com.vnMay 28, 2025ransomware_live—
D****v.orgMay 25, 2025ransomware_live—
Dcsdev.orgMay 25, 2025ransomware_live—
T******p.aeMay 23, 2025ransomware_live—
Trustgrp.aeMay 23, 2025ransomware_live—
Z****a.comApril 19, 2025ransomware_live—
W*******w.comMarch 28, 2025ransomware_live—
K**d.eduMarch 3, 2025ransomware_live—
S********e.comMarch 3, 2025ransomware_live—
Salemerode.comMarch 3, 2025ransomware_live—
A*u.edu.auFebruary 16, 2025ransomware_live—
E*******s.gov.zmFebruary 12, 2025ransomware_live—
Eservices.gov.zmFebruary 12, 2025ransomware_live—
M****s.infoFebruary 8, 2025ransomware_live—
G*********7.comFebruary 8, 2025ransomware_live—
R******e.twFebruary 8, 2025ransomware_live—
Realtime.twFebruary 8, 2025ransomware_live—
Mervis.infoFebruary 8, 2025ransomware_live—
Gpstech2007.comFebruary 8, 2025ransomware_live—
A**-****o.comJanuary 31, 2025ransomware_live—
T*****p.comJanuary 31, 2025ransomware_live—
W*****e.comJanuary 31, 2025ransomware_live—
Punjab.gov.pkJanuary 31, 2025ransomware_live—
A2b-cargo.comJanuary 31, 2025ransomware_live—
Toshapp.comJanuary 31, 2025ransomware_live—
K****S CORPDecember 21, 2024ransomware_live—
d****INovember 5, 2024ransomware_live—
C**********MOctober 30, 2024ransomware_live—
B****AOctober 24, 2024ransomware_live—
F*******M CorpOctober 24, 2024ransomware_live—
Q***MOctober 18, 2024ransomware_live—
K***N CorpOctober 10, 2024ransomware_live—
Y*********IAugust 14, 2024ransomware_live—
A****NAugust 7, 2024ransomware_live—
A*****DJuly 19, 2024ransomware_live—
O***MJuly 10, 2024ransomware_live—
K*****SJuly 3, 2024ransomware_live—
F*****HJuly 3, 2024ransomware_live—
H*******YJune 27, 2024ransomware_live—
D*****SJune 22, 2024ransomware_live—
SBC Global, Bitfinex, Coinmom, and Rutgers University Part 2May 5, 2024ransomware_live—
SBC Global, Bitfinex, Coinmama, and Rutgers University Part 2May 5, 2024ransomware_live—
SBC Global, Bitfinex, Coinmama, and Rutgers University Part 2 LeakMay 5, 2024ransomware_live—
CoinmomaApril 26, 2024ransomware_live—
Rutgers UniversityApril 26, 2024ransomware_live—
CoinmamaApril 26, 2024ransomware_live—
SBC GlobalApril 25, 2024ransomware_live—
BitfinexApril 25, 2024ransomware_live—

Claim data from ransomware.live and RansomLook (CC BY 4.0).