obscura
First seen September 5, 2025Active33 claimed victims
The claims below are reproduced as posted by obscura on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Obscura is a ransomware strain observed in 2025, written in Go and specifically targeting Windows domain controllers via the SYSVOL/NETLOGON share, using Curve25519 + XChaCha20 encryption with double-extortion tactics and a 10-day payment deadline.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| REDtone | January 11, 2026 | ransomware_live | — |
| STC Concrete Product | January 11, 2026 | ransomware_live | — |
| [Redacted] #1927 | December 24, 2025 | ransomware_live | — |
| Revoil | December 24, 2025 | ransomware_live | — |
| Trend Import Export | December 16, 2025 | ransomware_live | — |
| k*m**w.com | December 15, 2025 | ransomware_live | — |
| cle**rp**er.eu | December 15, 2025 | ransomware_live | — |
| CleverPower | December 15, 2025 | ransomware_live | — |
| New Obscura 2.0! | December 12, 2025 | ransomware_live | — |
| StanleyCo Malaysia | December 4, 2025 | ransomware_live | — |
| Startek Engineering Inc. | December 3, 2025 | ransomware_live | — |
| ACE Forwarding | November 19, 2025 | ransomware_live | — |
| New Toyo International Holdings Ltd | November 1, 2025 | ransomware_live | — |
| Thompson Dorfman Sweatman | October 30, 2025 | ransomware_live | — |
| Federal Auto Holdings Berhad | October 29, 2025 | ransomware_live | — |
| Cape Dara Resort Pattaya | October 20, 2025 | ransomware_live | — |
| michigancityin.gov | October 13, 2025 | ransomware_live | — |
| espectral.pt | October 13, 2025 | ransomware_live | — |
| eastdesign.com.my | October 13, 2025 | ransomware_live | — |
| thefixingcompany.com | October 13, 2025 | ransomware_live | — |
| heavenly-dental.com | October 13, 2025 | ransomware_live | — |
| plazadental.com | October 13, 2025 | ransomware_live | — |
| meamargroup.com | October 13, 2025 | ransomware_live | — |
| relationmedia.dk | October 13, 2025 | ransomware_live | — |
| Espectral | September 19, 2025 | ransomware_live | — |
| EAST Design Architect Sdn. Bhd | September 19, 2025 | ransomware_live | — |
| Rulmaksan Makina | September 1, 2025 | ransomware_live | — |
| WZV Warndt | August 29, 2025 | ransomware_live | — |
| Plazadental | August 29, 2025 | ransomware_live | — |
| HeavenlyDental | August 29, 2025 | ransomware_live | — |
| The Fixing Company | August 29, 2025 | ransomware_live | — |
| MeamarGroup | August 27, 2025 | ransomware_live | — |
| RelationMedia A/S | July 16, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).