underground Unknown

First seen: -
0
Total Victims
0
Victims (30d)
Details

Underground ransomware is deployed by the Russia-based RomCom group (Storm-0978) and has victimized companies across multiple industries since July 2023 by exploiting CVE-2023-36884, encrypting files without changing extensions and deleting Volume Shadow Copies and Windows event logs in double-extortion campaigns.

Leak Site

Onion URL: http://47glxkuxyayqrvugfumgsblrdagvrah7gttfscgzn56eyss5wg3uvmqd.onion

Metadata

Slug: underground

Created: 14/01/2026 08:19

Updated: 28/06/2026 16:02

Back