Datacarry
DataCarry is a ransomware and data-extortion operation first observed in May 2025, operating a double-extortion model with a Tor-hosted leak portal and claiming victims across insurance, healthcare, aerospace, legal, and retail sectors in at least six countries.
Victims
16
First Discovered
2025-05-26
victim
Last Discovered
2025-12-06
victim
Inactive Since
163
days
Avg Delay
155.6
days
Infostealer
28.6%
victims with domain
Countries
12
hit
Attack Velocity — Last 12 months
Known Locations (1)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
DATACARRY | Yes | 2026-05-18T19:16:00 | Apache |
dcarryhaih5oldidg3tbqwnde4lxljytnpvberrwgj2vlvunopd46dad.onion
|
Target
Top 5 Activity Sectors
- Consumer Services 5
- Transportation/Logistics 2
- Agriculture and Food Production 2
- Healthcare 2
- Financial Services 2
Top 5 Countries
-
Italy
2
-
Spain
2
-
Sweden
2
-
Belgium
2
-
France
1
Heatmap
Ransom Notes (1)
YARA Rules (1)
Indicators of Compromise (IoCs) (7)
Email
1
Hash MD5
1
Hash SHA256
2
IP Address
2
session
1
Victims (16)
[AI generated] Peggy Sage is a French beauty brand with a history spanning over 90 years. It special…
[AI generated] Món Sant Benet is a unique cultural, tourist, and leisure project in Catalonia, Spain…
[AI generated] "V² Development" is a comprehensive real estate development company that specializes …
[AI generated] Alliance Healthcare IT is a company dedicated to providing advanced healthcare inform…
[AI generated] "La Maison Liégeoise" is a Belgian company that sells Carlina tapioca, an original pr…
[AI generated] Executive Jet Support is a UK-based company that specializes in providing comprehensi…
[AI generated] Mammut Sports Group is a Swiss multinational company that specializes in producing an…
[AI generated] "Étude Bordet" is a estate firm specializing in property auctions. They provide a var…
[AI generated] Balcia Insurance SE is a European insurer founded in 1993 and based in Latvia. It off…