RAGroup

Dark since December 29, 2024
60 victims named on the leak site
0 in the last 30 days
0 in the last 12 months
Apr 2023 first victim we recorded
Dec 29, 2024 most recent victim posted
5 leak sites tracked

Data as of August 16, 2026.

Credential exposure before the attack

23.3% of RAGroup victims whose domain we can identify (14 of 60) had employee credentials leak in the 12 months before RAGroup named them as a victim.

We don't know whether any of these credentials were how RAGroup gained initial access.

What industries RAGroup targets

Sector identified for 33 of 60 victims.

Financial Services6
Logistics6
Healthcare5
Manufacturing4
Construction3
Energy2
Retail2
Automotive2

Where the victims are located

Country identified for 25 of 60 victims.

Germany9
Taiwan3
United Kingdom2
Italy2
South Korea2
Thailand1
Poland1
Singapore1

Most recent RAGroup victims

VictimSectorCountryPosted
Ire-Omba SpA ire-omba.itNot identifiedItalyDec 29, 2024
die STEG steg.deNot identifiedGermanyDec 29, 2024
Watertown High School watertownps.orgEducationNot identifiedDec 29, 2024
Compass Communications compass.net.nzTelecommunicationsNew ZealandDec 13, 2024
NTrust ntrustinfotech.comFinancial ServicesNot identifiedDec 5, 2024
Contrack FM contrackfm.comNot identifiedNot identifiedNov 28, 2024
Ventana Micro Systems ventanamicro.comNot identifiedNot identifiedNov 28, 2024
Gulf Energy Maritime gemships.comEnergyNot identifiedNov 25, 2024
Orange County Pathology Medical Group ocpathology.comHealthcareNot identifiedNov 13, 2024
SK Gas skgas.co.krEnergySouth KoreaNov 13, 2024
Bullonerie Galvit bulloneriegalvit.itLogisticsItalyNov 1, 2024
P+B Team Aircargo Service pbteam.deLogisticsGermanyOct 24, 2024
Prince Pipes princepipes.comManufacturingNot identifiedOct 24, 2024
Digital Engineering digitalengineering.comManufacturingNot identifiedOct 16, 2024
Matouk Bassiouny matoukbassiouny.comLegalNot identifiedOct 16, 2024
The ASCENT Group theascent-group.comNot identifiedNot identifiedJul 29, 2024
Kusum Group kusum.comNot identifiedNot identifiedJul 25, 2024
Melchers Singapore melchers.com.sgNot identifiedSingaporeJul 25, 2024
The Lutheran Foundation thelutheranfoundation.orgNot identifiedNot identifiedJul 25, 2024
Main Wein main-wein.comNot identifiedNot identifiedApr 25, 2024

Showing the 20 most recent of 60. Browse recent data breaches for more.

RAGroup leak sites

Addresses we've seen RAGroup publish victims from. Any .onion address needs the Tor Browser.

  • raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion
  • gofile.io
  • pa32ymaeu62yo5th5mraikgw5fcvznnsiiwti42carjliarodltmqcqd.onion
  • raworlddecssyq43oim3hxhc5oxvlbaxuj73xbz2pbbowso3l4kn27qd.onion
  • hkpomcx622gnqp2qhenv4ceyrhwvld3zwogr4mnkdeudq2txf55keoad.onion

RAGroup questions

Is RAGroup still active?

Not for over a year. The last victim we recorded was December 29, 2024. The leak site has published nothing since, though the data it already leaked is still out there.

How many victims has RAGroup claimed?

RAGroup has named 60 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.

When did RAGroup first appear?

The first victim we recorded for RAGroup was posted on April 3, 2023. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does RAGroup target?

Financial Services accounts for the most victims we can classify, with 6. Logistics follows at 6. We could identify a sector for 33 of 60 victims, so treat this as the shape of the targeting rather than a full census.

Has RAGroup already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.