RedRansomware
Data as of August 16, 2026.
What industries RedRansomware targets
Sector identified for 11 of 16 victims.
| Manufacturing | 5 | |
| Construction | 2 | |
| Technology | 2 | |
| Education | 1 | |
| Legal | 1 |
Where the victims are located
Country identified for 2 of 16 victims.
| Canada | 1 | |
| Denmark | 1 |
Every RedRansomware victim
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Kutes kutes.com | Construction | Not identified | Jun 20, 2024 |
| Aircod aircod.com | Not identified | Not identified | May 29, 2024 |
| Sullair Argentina sullairargentina.com | Construction | Not identified | May 20, 2024 |
| Targus targus.com | Manufacturing | Not identified | Apr 12, 2024 |
| Aluminum Trailer aluminumtrailer.com | Manufacturing | Not identified | Apr 3, 2023 |
| Bay State College baystate.edu | Education | Not identified | Apr 3, 2023 |
| COMO Hotels and Resorts comohotels.com | Not identified | Not identified | Apr 3, 2023 |
| K2 Systems k2systems.ca | Technology | Canada | Apr 3, 2023 |
| Kogok kogok.com | Manufacturing | Not identified | Apr 3, 2023 |
| Bendall & Mednick reallawyers.net | Legal | Not identified | Apr 3, 2023 |
| SAGlobal saglobal.com | Not identified | Not identified | Apr 3, 2023 |
| sfi-wfc.com sfi-wfc.com | Not identified | Not identified | Apr 3, 2023 |
| Sauceda solucionesls.com | Not identified | Not identified | Apr 3, 2023 |
| Southco southcoindustries.com | Manufacturing | Not identified | Apr 3, 2023 |
| Tecnolite tecnolite.com | Manufacturing | Not identified | Apr 3, 2023 |
| Thors Data thors-data.dk | Technology | Denmark | Apr 3, 2023 |
Browse recent data breaches for more.
RedRansomware leak sites
Addresses we've seen RedRansomware publish victims from. Any .onion address needs the Tor Browser.
q7uspeblxi35hfd4jzy5evyz7ipjqtezww7giejgwpp5xdnjwxk5sdad.onion33zo6hifw4usofzdnz74fm2zmhd3zsknog5jboqdgblcbwrmpcqzzbid.onion
RedRansomware questions
Is RedRansomware still active?
Not for over a year. The last victim we recorded was June 20, 2024. The leak site has published nothing since, though the data it already leaked is still out there.
How many victims has RedRansomware claimed?
RedRansomware has named 16 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did RedRansomware first appear?
The first victim we recorded for RedRansomware was posted on April 3, 2023. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does RedRansomware target?
Manufacturing accounts for the most victims we can classify, with 5. Construction follows at 2. We could identify a sector for 11 of 16 victims, so treat this as the shape of the targeting rather than a full census.
Has RedRansomware already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.