groove
First seen September 9, 2021Active13 claimed victims
The claims below are reproduced as posted by groove on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Groove emerged in mid-2021 as a loose criminal collective linked to former Babuk gang members, known for publicly leaking Fortinet VPN credentials to attract affiliates and calling for attacks on US government and financial targets; the group later claimed its entire operation was a hoax to mislead security researchers.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Я не пью виски но с ним бы выпил | October 30, 2021 | ransomware_live | — |
| therecord.media 30k USD | October 23, 2021 | ransomware_live | — |
| Про русских в США | October 23, 2021 | ransomware_live | — |
| episcopalretirement.com Возможна утечка | October 23, 2021 | ransomware_live | — |
| trivalleypc.com | October 22, 2021 | ransomware_live | — |
| hagerstownpd.org | October 22, 2021 | ransomware_live | — |
| robinwoodortho.com | September 13, 2021 | ransomware_live | — |
| Украина и экстрадиции в США | September 10, 2021 | ransomware_live | — |
| Одно интервью | September 10, 2021 | ransomware_live | — |
| Мы можем просто договориться | September 9, 2021 | ransomware_live | — |
| Запатченные fortinet точки входа | September 9, 2021 | ransomware_live | — |
| Мысли о смысле | September 9, 2021 | ransomware_live | — |
| ludofact.de 50 GB data stolen | September 9, 2021 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).