underground
First seen May 1, 2024Active26 claimed victims
The claims below are reproduced as posted by underground on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Underground ransomware is deployed by the Russia-based RomCom group (Storm-0978) and has victimized companies across multiple industries since July 2023 by exploiting CVE-2023-36884, encrypting files without changing extensions and deleting Volume Shadow Copies and Windows event logs in double-extortion campaigns.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| SFA Engineering | August 15, 2025 | ransomware_live | — |
| GMORS Co., Ltd | June 25, 2025 | ransomware_live | — |
| semex.com | April 15, 2025 | ransomware_live | — |
| shengyusteel.com | April 8, 2025 | ransomware_live | — |
| Afa Systems Ltd. | February 13, 2025 | ransomware_live | — |
| Simmtech Co., Ltd. | December 16, 2024 | ransomware_live | — |
| hcsgcorp.com | October 25, 2024 | ransomware_live | — |
| Casio Computer Co., Ltd | October 9, 2024 | ransomware_live | — |
| ramservices.com | July 3, 2024 | ransomware_live | — |
| Ethypharm | June 20, 2024 | ransomware_live | — |
| A-Line Staffing Solutions | May 24, 2024 | ransomware_live | — |
| CentralSecurities.com | May 15, 2024 | ransomware_live | — |
| www.belcherpharma.com | May 4, 2024 | ransomware_live | — |
| belcherpharma.com | May 4, 2024 | ransomware_live | — |
| cochraneglobal.com | April 15, 2024 | ransomware_live | — |
| Skender Construction | March 21, 2024 | ransomware_live | — |
| Creative Business Interiors | March 17, 2024 | ransomware_live | — |
| Y. Hata & Co., Ltd. | March 14, 2024 | ransomware_live | — |
| KyungChang | March 6, 2024 | ransomware_live | — |
| kc.co.kr | February 23, 2024 | ransomware_live | — |
| Triathlon.group | January 26, 2024 | ransomware_live | — |
| awwg.com | January 25, 2024 | ransomware_live | — |
| frenckengroup.com | July 18, 2023 | ransomware_live | — |
| bulldogbag.com | July 14, 2023 | ransomware_live | — |
| tpa-group.sk | July 4, 2023 | ransomware_live | — |
| synology.com | May 30, 2023 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).