netwalker
First seen January 31, 2020Active26 claimed victims
The claims below are reproduced as posted by netwalker on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
NetWalker ransomware group operates by the threat actor known as "CIRCUS SPIDER". The NetWalker ransomware was discovered in 2019. The group mainly targeting the Asia Pacific region but can attack globally. The group uses common attacking tools like Mimikatz and other legitimate tools (LOLBINS) like PSTools, AnyDesk, TeamViewer, NLBrute, and more. The group knowing by targeting the healthcare sector.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Nygard International | December 12, 2020 | ransomware_live | — |
| CSAT Solutions | December 1, 2020 | ransomware_live | — |
| Enel Group | October 19, 2020 | ransomware_live | — |
| KYB Corporation | October 1, 2020 | ransomware_live | — |
| Wilmington Surgical Associates | October 1, 2020 | ransomware_live | — |
| K-Electric (electric utility supplier) | September 7, 2020 | ransomware_live | — |
| Equinix | September 7, 2020 | ransomware_live | — |
| Jands | September 1, 2020 | ransomware_live | — |
| Cygilant (threat detection cybersecurity company) | September 1, 2020 | ransomware_live | — |
| Direccion Nacional de Migraciones (Argentina's official immigration agency) | August 27, 2020 | ransomware_live | — |
| Entrust Energy | August 5, 2020 | ransomware_live | — |
| Forsee Power | August 1, 2020 | ransomware_live | — |
| Center for Fertility and Gynecology (Los Angeles) | August 1, 2020 | ransomware_live | — |
| Canadian Tire | August 1, 2020 | ransomware_live | — |
| Olympia House (Petaluma) | August 1, 2020 | ransomware_live | — |
| Alfanar | July 9, 2020 | ransomware_live | — |
| Trinity Metro (Fort Worth transit agency) | July 1, 2020 | ransomware_live | — |
| Lorien Health Services | June 6, 2020 | ransomware_live | — |
| Columbia College of Chicago | June 3, 2020 | ransomware_live | — |
| University of San Francisco (UCSF) | June 1, 2020 | ransomware_live | — |
| Michigan State University | May 27, 2020 | ransomware_live | — |
| Spectra Logic | May 1, 2020 | ransomware_live | — |
| Network of Village of Weiz | May 1, 2020 | ransomware_live | — |
| Northwest Territories Power Corporation | April 30, 2020 | ransomware_live | — |
| Champaign-Urbana Public Health District | March 10, 2020 | ransomware_live | — |
| Toll Group | January 31, 2020 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).