morpheus
First seen January 7, 2025Active24 claimed victims
The claims below are reproduced as posted by morpheus on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Morpheus emerged in late 2024 as a semi-private RaaS operation whose affiliates share identical payloads with the HellCat ransomware group, targeting pharmaceutical, manufacturing, legal, and Italian ESXi environments with ransom demands reaching up to 32 BTC (~$3M USD).
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Superior Plating Technology CO | October 1, 2026 | ransomlook | — |
| Yue Ki Industrial | July 30, 2026 | ransomware_live | — |
| Kyowa Singapore Pte Ltd | July 21, 2026 | ransomware_live | — |
| Hansa Research Group Pvt. Ltd | July 6, 2026 | ransomware_live | — |
| Delegal Poindexter & Underkofler, P.A. | June 25, 2026 | ransomware_live | — |
| HDFC FUND | June 10, 2026 | ransomware_live | — |
| 3I INFOTECH | June 8, 2026 | ransomware_live | — |
| BAYTECH A/S | May 14, 2026 | ransomware_live | — |
| GGI | April 21, 2026 | ransomware_live | — |
| SBCTANZANIA | March 30, 2026 | ransomware_live | — |
| SURTECHINC | February 27, 2026 | ransomware_live | — |
| SUNSETWORLDRESORTS | January 29, 2026 | ransomware_live | — |
| VALLEREDONDO | December 27, 2025 | ransomware_live | — |
| SCIPIONI | December 12, 2025 | ransomware_live | — |
| Teamglobal | November 17, 2025 | ransomware_live | — |
| Landmark Properties | May 20, 2025 | ransomware_live | — |
| Metal Sales Manufacturing Corporation | April 4, 2025 | ransomware_live | — |
| Latronica Law Firm, P.C | April 3, 2025 | ransomware_live | — |
| Alora Pharmaceuticals, LLC | April 1, 2025 | ransomware_live | — |
| DZL | February 24, 2025 | ransomware_live | — |
| Dinizulu Law Group LTD | February 24, 2025 | ransomware_live | — |
| LYNXSPA | January 17, 2025 | ransomware_live | — |
| Pus Gmbh | January 7, 2025 | ransomware_live | — |
| Arrotex Pharmaceuticals | January 7, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).