onyx
First seen April 29, 2022Active28 claimed victims
The claims below are reproduced as posted by onyx on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Onyx is a ransomware group first observed in April 2022, based on the Chaos ransomware builder, that is notably destructive — files larger than 2MB are overwritten with random data rather than encrypted, making recovery impossible even after ransom payment — claiming approximately 13 victims across six countries.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| www.projectredirectdc.org | November 21, 2022 | ransomware_live | — |
| www.minex.gob.gt | November 21, 2022 | ransomware_live | — |
| www.jaspercountysheriffoffice.com | November 21, 2022 | ransomware_live | — |
| www.arisaseguros.com | November 21, 2022 | ransomware_live | — |
| www.cucafresca.com.br | November 21, 2022 | ransomware_live | — |
| www.advantagedirectcare.com | November 21, 2022 | ransomware_live | — |
| www.waynefamilypractice.com | November 21, 2022 | ransomware_live | — |
| www.pacmaritime.com | November 21, 2022 | ransomware_live | — |
| www.baltholding.eu | November 21, 2022 | ransomware_live | — |
| www.semaphorehq.com | November 21, 2022 | ransomware_live | — |
| www.ackermanplumbinginc.com | November 21, 2022 | ransomware_live | — |
| www.candcfarmsupply.com | November 21, 2022 | ransomware_live | — |
| www.wayan.com.mx | November 21, 2022 | ransomware_live | — |
| www.artisticstairs.com | November 21, 2022 | ransomware_live | — |
| Ministerio de Relaciones Exteriores | September 27, 2022 | ransomware_live | — |
| Borough of Union Beach | August 5, 2022 | ransomware_live | — |
| ARISA CORREDORES DE SEGUROS | August 1, 2022 | ransomware_live | — |
| Baltholding OÃ | July 26, 2022 | ransomware_live | — |
| Artistic Stairs & Railings | July 26, 2022 | ransomware_live | — |
| WAYAN NATURAL WEAR | July 26, 2022 | ransomware_live | — |
| CUCA FRESCA | July 26, 2022 | ransomware_live | — |
| Ackerman Plumbing Inc | April 29, 2022 | ransomware_live | — |
| Semaphore Solutions Inc | April 29, 2022 | ransomware_live | — |
| C&C FARMERSâ SUPPLY CORP | April 29, 2022 | ransomware_live | — |
| Advantage Direct Care | April 29, 2022 | ransomware_live | — |
| WAYNE FAMILY PRACTICE, ASSOC., P.C. | April 29, 2022 | ransomware_live | — |
| Pacific Maritime Industries Corp. | April 29, 2022 | ransomware_live | — |
| Jasper County Sheriff's Office | April 29, 2022 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).