Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Apt73/Bashe

Inactive for 114 d RaaS
World map Statistics
A new ransomware group is said to have emerged in mid-April 2024, under the name 'APT73.' It's worth noting that the group reportedly self-proclaimed as an APT, which stands for 'Advanced Persistent Threat' in the cybersecurity field.

According to research, much of the available information about the aforementioned group came from another ransomware group known as LockBit.
Source: https://github.com/crocodyli/ThreatActors-TTPs
Victims
160
none this month
Rank
#49 / 388
#29 over the last 12 months
First victim
2024-04-05
estimated attack date
Last victim
2026-07-24
114 days ago
Attack → claim
61.2 d
average delay
Countries
50
hit
Infostealer
71.0%
of victims with a domain
Leak-site uptime
79.7% average, 30 days

Victims per month

By estimated attack date when known, otherwise by discovery date.

Top sectors

  • Professional Services 32 · 20%
  • Technology 28 · 18%
  • Financial Services 20 · 12%
  • Government & Defense 17 · 11%
  • Healthcare 13 · 8%
  • Manufacturing 11 · 7%
  • Transportation 8 · 5%
  • Retail & E-Commerce 7 · 4%
  • Agriculture and Food Production 7 · 4%
  • Energy & Utilities 7 · 4%

Top countries

What ransomware.live knows about apt73

Exclusive interview with apt73 by the CyberSecurityIL Telegram channel: read it