APT73
Data as of August 16, 2026.
Credential exposure before the attack
35.7% of APT73 victims whose domain we can identify (15 of 42) had employee credentials leak in the 12 months before APT73 named them as a victim.
We don't know whether any of these credentials were how APT73 gained initial access.
What industries APT73 targets
Sector identified for 23 of 43 victims.
| Financial Services | 6 | |
| Technology | 5 | |
| Manufacturing | 4 | |
| Retail | 2 | |
| Healthcare | 2 | |
| Hospitality | 1 | |
| Automotive | 1 | |
| Telecommunications | 1 |
Where the victims are located
Country identified for 17 of 43 victims.
| United Kingdom | 6 | |
| Switzerland | 3 | |
| France | 2 | |
| India | 1 | |
| Germany | 1 | |
| Brazil | 1 | |
| Peru | 1 | |
| Croatia | 1 |
Most recent APT73 victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| SFR sfr.fr | Telecommunications | France | Nov 22, 2024 |
| RAO doo rao.hr | Technology | Croatia | Nov 21, 2024 |
| Protecta Security protectasecurity.pe | Financial Services | Peru | Nov 19, 2024 |
| Baldinger AG baldinger-ag.ch | Not identified | Switzerland | Nov 11, 2024 |
| Emefarma emefarmario.com.br | Manufacturing | Brazil | Nov 11, 2024 |
| La Maison du Citron lamaisonducitron.com | Not identified | Not identified | Nov 11, 2024 |
| LiftKits4Less liftkits4less.com | Retail | Not identified | Nov 11, 2024 |
| Assurified assurified.com | Financial Services | Not identified | Nov 8, 2024 |
| Botiga botiga.com.uy | Not identified | Not identified | Nov 8, 2024 |
| Legilog legilog.fr | Technology | France | Oct 30, 2024 |
| Scopesset scopesset.de | Not identified | Germany | Oct 30, 2024 |
| Sokak Kreatif sokkakreatif.com | Not identified | Not identified | Oct 30, 2024 |
| Trinite Solutions trinitesolutions.com | Not identified | Not identified | Oct 30, 2024 |
| Appen appen.com | Not identified | Not identified | Oct 25, 2024 |
| Drizly drizly.com | Not identified | Not identified | Oct 25, 2024 |
| Filmai filmai.in | Not identified | India | Oct 25, 2024 |
| CDS hpecds.com | Not identified | Not identified | Oct 25, 2024 |
| MGF Sourcing mgfsourcing.com | Not identified | Not identified | Oct 25, 2024 |
| Modplan modplan.co.uk | Manufacturing | United Kingdom | Oct 25, 2024 |
| Nanolive nanolive.ch | Not identified | Switzerland | Oct 25, 2024 |
Showing the 20 most recent of 43. Browse recent data breaches for more.
APT73 leak sites
Addresses we've seen APT73 publish victims from. Any .onion address needs the Tor Browser.
bashex7mokreyoxl6wlswxl4foi7okgs7or7aergnuiockuoq35yt3ad.onionwn6vonooq6fggjdgyocp7bioykmfjket7sbp47cwhgubvowwd7ws5pyd.onionbashete63b3gcijfofpw6fmn3rwnmyi5aclp55n6awcfbexivexbhyad.onionbasheqtvzqwz4vp6ks5lm2ocq7i6tozqgf6vjcasj4ezmsy4bkpshhyd.onionsantat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion
APT73 questions
Is APT73 still active?
Not for over a year. The last victim we recorded was November 22, 2024. The leak site has published nothing since, though the data it already leaked is still out there.
How many victims has APT73 claimed?
APT73 has named 43 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did APT73 first appear?
The first victim we recorded for APT73 was posted on May 24, 2024. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does APT73 target?
Financial Services accounts for the most victims we can classify, with 6. Technology follows at 5. We could identify a sector for 23 of 43 victims, so treat this as the shape of the targeting rather than a full census.
Has APT73 already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.