Ransomware.live 👀

Ransomware Group:

Monti

Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are impacting your business

Sites

Title	Available	Last Visit	FQDN	Screenshot
404 Not Found	🔴	2022-10-10 17:13:45.969929	4s4lnfeujzo67fy2jebz2dxskez2gsqj2jeb35m75ktufxensdicqxad.onion	N/A
MONTI - Leaks site	🟢	2024-11-21 06:14:36.112231	mblogci3rudehaagbryjznltdp33ojwzkq6hn2pckvjq33rycmzczpid.onion	📸

External information

https://blogs.blackberry.com/en/2022/09/the-curious-case-of-monti-ransomware-a-real-world-doppelganger

Tools used

Discovery	RMM Tools	Defense Evasion	Credential Theft	Exfiltration
SoftPerfect NetScan	Action1	Avast Anti-Rootkit driver	Mimikatz	MEGA
	AnyDesk	GMER	Veeam-Get-Creds	PSCP
				WinSCP

This information is provided by Ransomware-Tool-Matrix

Yara Rules

Click here to open yara rules

Ransom Note(s)

Click here to see Ransom Note(s)

Activity over time

Worldmap

92 Victims

Oxford Auto Insurance

Ransomware Group:

Monti

Discovery Date: 2024-11-20 02:32

Sector: Financial Services

Insurance

Victim: | Group:

Anderson Miller LTD

Ransomware Group:

Monti

Discovery Date: 2024-11-19 14:31

Sector: Not Found

Hospitality

Victim: | Group:

Premier Tax Services

Ransomware Group:

Monti

Discovery Date: 2024-11-19 14:30

Sector: Financial Services

Accounting Services

Victim: | Group:

KVF

Ransomware Group:

Monti

Discovery Date: 2024-11-19 14:29

Sector: Not Found

Industrial Machinery & Equipment

Victim: | Group:

Southern Oregon Veterinary Specialty Center

Ransomware Group:

Monti

Discovery Date: 2024-11-19 14:28

Sector: Healthcare

Healthcare Services

Victim: | Group:

Superline

Ransomware Group:

Monti

Discovery Date: 2024-10-21 21:11

Estimated Attack Date: 2023-10-19

Sector: Not Found

Our utmost priorities are to bring the latest trends to our customers while providing each and every one with the quality care and service that they deserve.

Victim: | Group:

City Of Forest Park

Ransomware Group:

Monti

Discovery Date: 2024-10-21 21:10

Estimated Attack Date: 2024-10-04

Sector: Public Sector

Georgia, United States

Victim: | Group:

Burgess Kilpatrick

Ransomware Group:

Monti

Discovery Date: 2024-10-21 21:09

Sector: Financial Services

Accounting Services

Victim: | Group:

Welding and Fabrication (Humble Mfg)

Ransomware Group:

Monti

Discovery Date: 2024-10-21 21:08

Sector: Manufacturing

Building Materials

Victim: | Group:

Raeyco Lab Equipment

Ransomware Group:

Monti

Discovery Date: 2024-10-21 21:07

Sector: Healthcare

Office Products Retail & Distribution

Victim: | Group:

La Tazza D'oro

Ransomware Group:

Monti

Discovery Date: 2024-10-21 19:46

Sector: Consumer Services

Hospitality · Italy

Victim: | Group:

City Of Forest Park - Full Leak

Ransomware Group:

Monti

Discovery Date: 2024-10-04 18:04

Sector: Public Sector

Georgia, United States

Victim: | Group:

bluemaven.ca problems

Ransomware Group:

Monti

Discovery Date: 2024-09-03 11:06

Estimated Attack Date: 2024-08-26

Sector: Technology

additional information

Victim: | Group:

Phyton Biotech

Ransomware Group:

Monti

Discovery Date: 2024-08-30 22:37

Sector: Healthcare

Business Services

Victim: | Group:

Burgess Kilpartick

Ransomware Group:

Monti

Discovery Date: 2024-08-30 20:17

Sector: Construction

Burgess Kilpatrick is an accounting and professional services firm located in Vancouver, BC.

Victim: | Group:

Richmond Auto Mall

Ransomware Group:

Monti

Discovery Date: 2024-08-30 20:16

Sector: Consumer Services

Automobile Dealers

Victim: | Group:

Seng Tsoi Architect

Ransomware Group:

Monti

Discovery Date: 2024-08-30 20:14

Sector: Construction

Architecture, Engineering & Design

Victim: | Group:

Raeyco Lab Equipment Systems Management

Ransomware Group:

Monti

Discovery Date: 2024-08-30 20:13

Sector: Healthcare

Office Products Retail & Distribution

Victim: | Group:

Welding and Fabrication (humblemfg)

Ransomware Group:

Monti

Discovery Date: 2024-08-30 20:12

Sector: Manufacturing

Building Materials

Victim: | Group:

City Projects

Ransomware Group:

Monti

Discovery Date: 2024-08-30 20:11

Sector: Construction

Commercial & Residential Construction

Victim: | Group:

Prism Construction

Ransomware Group:

Monti

Discovery Date: 2024-08-30 20:10

Sector: Construction

Commercial & Residential Construction

Victim: | Group:

Cotala Cross-Media

Ransomware Group:

Monti

Discovery Date: 2024-08-30 20:09

Sector: Business Services

Business Services

Victim: | Group:

Abatti Companies

Ransomware Group:

Monti

Discovery Date: 2024-08-26 16:21

Estimated Attack Date: 2023-08-04

Sector: Agriculture and Food Production

Abatti Companies is a vertically integrated group of companies that handles all facets of farm products from field to market. In 1981 Alex Abatti Jr. started as a custom harvest operator that later began farming to become one of the largest farmers in the Imperial Valley, California.

Victim: | Group:

Imt

Ransomware Group:

Monti

Discovery Date: 2024-08-26 16:20

Estimated Attack Date: 2023-11-27

Sector: Manufacturing

Victim: | Group:

Law Offices of John E Hill

Ransomware Group:

Monti

Discovery Date: 2024-08-26 16:19

Estimated Attack Date: 2023-11-28

Sector: Business Services

We are dedicated to providing you with the personal service and attention you expect. Our goal is to help you understand your rights and assess your options, so that you can obtain the maximum recovery possible.

Victim: | Group:

Tryax Realty Management

Ransomware Group:

Monti

Discovery Date: 2024-08-26 16:18

Estimated Attack Date: 2023-12-07

Sector: Business Services

Tryax Realty Management serves the West Bronx communities of Morris Heights, Mt. Eden, Melrose, High Bridge, Kingsbridge and Norwood, and the Harlem communities of Hamilton Heights, Sugar Hill, and Strivers Row.

Victim: | Group:

HMW

Ransomware Group:

Monti

Discovery Date: 2024-08-26 16:17

Estimated Attack Date: 2023-12-09

Sector: Not Found

#Robert_stop_fap_on_kids HMW Special Utility District is a Texas water district and special utility district under Chapters 49 and 65, Texas Water Code. Its purpose is to provide water utility services as permitted by applicable law.

Victim: | Group:

Smith Capital

Ransomware Group:

Monti

Discovery Date: 2024-08-26 16:16

Estimated Attack Date: 2024-02-01

Sector: Not Found

Smith Affiliated Capital (SAC) was formed in 1982 to provide both discretionary and advisory investment management services to high-net worth individuals, their families, and institutional investors.

Victim: | Group:

Blue Maven Group

Ransomware Group:

Monti

Discovery Date: 2024-08-26 11:18

Sector: Not Found

Blue Maven provides extensive IT Procurement services.

Victim: | Group:

Adorna & Guzman Dentistry

Ransomware Group:

Monti

Discovery Date: 2024-08-01 21:20

Sector: Healthcare

Dental

Victim: | Group:

forestparkga.gov

Ransomware Group:

Monti

Discovery Date: 2024-07-24 11:15

Sector: Public Sector

City & PD

Victim: | Group:

Regas (regasenergy.com)

Ransomware Group:

Monti

Discovery Date: 2024-07-24 11:14

Sector: Energy

Electricity, Oil & Gas

Victim: | Group:

Excelsior Orthopaedics

Ransomware Group:

Monti

Discovery Date: 2024-07-09 15:02

Estimated Attack Date: 2024-07-08

Sector: Healthcare

Hospitals & Physicians Clinics

Victim: | Group:

Wayne Memorial Hospital

Ransomware Group:

Monti

Discovery Date: 2024-06-30 19:41

Sector: Healthcare

Wayne Memorial Hospital is a non-profit, community-controlled hospital based in Honesdale, Pennsylvania serving Wayne, Pike and Sullivan Counties.

Victim: | Group:

Compagnia Trasporti Integrati S.R.L

Ransomware Group:

Monti

Discovery Date: 2024-06-24 15:33

Sector: Transportation/Logistics

Italian Logistics. ctilog.it

Victim: | Group:

VTWin.ca

Ransomware Group:

Monti

Discovery Date: 2024-06-24 15:32

Sector: Not Found

shitty

Victim: | Group:

CNPC Sport

Ransomware Group:

Monti

Discovery Date: 2024-05-26 14:16

Sector: Energy

Colleges & Universities

Victim: | Group:

Esc Pau Etudes-Conseils

Ransomware Group:

Monti

Discovery Date: 2024-05-26 14:16

Sector: Business Services

Colleges & Universities

Victim: | Group:

Aéroport de Pau

Ransomware Group:

Monti

Discovery Date: 2024-05-26 14:15

Sector: Transportation/Logistics

Full leak

Victim: | Group:

project sold

Ransomware Group:

Monti

Discovery Date: 2024-05-15 20:53

Sector: Technology

project sold

Victim: | Group:

Kuhn Rechtsanwlte GmbH

Ransomware Group:

Monti

Discovery Date: 2024-05-10 10:22

Sector: Business Services

Law Firms & Legal Services

Victim: | Group:

Spine West

Ransomware Group:

Monti

Discovery Date: 2024-02-24 14:43

Sector: Healthcare

Hospitals & Physicians Clinics · Colorado, United States

Victim: | Group:

APEX - apexspedition.de

Ransomware Group:

Monti

Discovery Date: 2024-02-23 14:51

Sector: Transportation/Logistics

Spedition Hamburg Apex - europaweit und international, Spedition Apex aus Hamburg transportiert europaweit und nach bersee Warengüter aller Art

Victim: | Group:

Smith Capital - Press Release

Ransomware Group:

Monti

Discovery Date: 2024-01-23 08:44

Estimated Attack Date: 2024-01-21

Sector: Not Found

Smith Affiliated Capital (SAC) was formed in 1982 to provide both discretionary and advisory investment management services to high-net worth individuals, their families, and institutional investors.

Victim: | Group:

Diablo Valley Oncology and Hematology Medical Group - Press Release

Ransomware Group:

Monti

Discovery Date: 2024-01-04 13:14

Sector: Healthcare

Diablo Valley Oncology provides comprehensive cancer care to patients by bringing together medical oncology, chemotherapy, radiation therapy, PET/CT and diagnostic imaging, research, and supportive care all in one convenient location.

Victim: | Group:

HMW - Press Release

Ransomware Group:

Monti

Discovery Date: 2023-12-08 23:50

Sector:

#Robert_stop_fap_on_kid HMW Special Utility District is a Texas water district and special utility district under Chapters 49 and 65, Texas Water Code. Its purpose is to provide water utility services as permitted by applicable law.

Group:

Tryax Realty Management - Press Release

Ransomware Group:

Monti

Discovery Date: 2023-12-06 22:08

Sector:

Victim: | Group:

Rudolf-Venture Chemical Inc - Part 1

Ransomware Group:

Monti

Discovery Date: 2023-12-05 16:10

Sector:

RUDOLF GROUP implements the manufacturing of chemical auxiliaries

Victim: | Group:

Hello Cristina from Law Offices of John E Hill

Ransomware Group:

Monti

Discovery Date: 2023-12-01 19:00

Sector:

SSN

Victim: | Group:

Hello Jacobs from RVC

Ransomware Group:

Monti

Discovery Date: 2023-12-01 17:31

Sector:

Passport

Victim: | Group:

Rudolf GmbH & Rudolf Venture Chemicals Inc - Press Release

Ransomware Group:

Monti

Discovery Date: 2023-11-30 22:08

Sector:

RUDOLF GROUP implements the manufacturing of chemical auxiliaries

Victim: | Group:

Imt - Press Release

Ransomware Group:

Monti

Discovery Date: 2023-11-27 20:52

Sector:

Time is critical and prompt reporting of results is our objective. Most negative reports are released in less than 2 hours. We report results 7 days per week 365 days per year.

Victim: | Group:

Law Offices of John E Hill - Press Release

Ransomware Group:

Monti

Discovery Date: 2023-11-27 20:52

Sector:

Victim: | Group:

Rudolf Venture Chemical Inc - Press Release

Ransomware Group:

Monti

Discovery Date: 2023-11-09 17:38

Sector:

We are RUDOLF, a global innovation leader for the textile, construction, coatings and car care industries. We support our customers with personal service and outstanding know-how. Our products maximize performance while minimizing environmental impact.

Victim: | Group:

Magsaysay Maritime - Press Release

Ransomware Group:

Monti

Discovery Date: 2023-11-09 17:38

Sector:

Magsaysay People Resources is one of the world's leading human resource companies. Through its subsidiaries Magsaysay Global Services for land-based placement and Magsaysay Maritime Corporation for sea-based placement

Victim: | Group:

University of Defence - Full Leak

Ransomware Group:

Monti

Discovery Date: 2023-10-23 17:48

Sector:

The city of Brno was chosen as the location for the new engineering-oriented military college due to its long tradition of superior quality engineering education.

Victim: | Group:

Superline - Full Leak

Ransomware Group:

Monti

Discovery Date: 2023-10-19 23:31

Sector:

Our utmost priorities are to bring the latest trends to our customers while providing each and every one with the quality care and service that they deserve.

Victim: | Group:

Superline - Press Release

Ransomware Group:

Monti

Discovery Date: 2023-10-09 14:57

Sector:

Our utmost priorities are to bring the latest trends to our customers while providing each and every one with the quality care and service that they deserve.

Victim: | Group:

University Obrany - Part 2 (Tiny Leak)

Ransomware Group:

Monti

Discovery Date: 2023-10-07 14:32

Sector:

story about scam negotiator and stupid top level of unob

Victim: | Group:

For UNOB

Ransomware Group:

Monti

Discovery Date: 2023-10-06 13:12

Sector:

story about scams

Victim: | Group:

University of Defence - Part 1

Ransomware Group:

Monti

Discovery Date: 2023-10-03 19:17

Sector:

The city of Brno was chosen as the location for the new engineering-oriented military college due to its long tradition of superior quality engineering education.

Victim: | Group:

Cascade Family Dental - Press Release

Ransomware Group:

Monti

Discovery Date: 2023-10-01 19:13

Sector:

Cascade Family Dental offers dental services for families in the Payson and Springville, Utah area.

Victim: | Group:

Rainbow Travel Service - Press Release

Ransomware Group:

Monti

Discovery Date: 2023-10-01 19:13

Sector:

Rainbow Travel is a full service agency specializing in upscale leisure, special interest travel, and cruises.

Victim: | Group:

Auckland University of Technology

Ransomware Group:

Monti

Discovery Date: 2023-09-21 22:18

Sector:

Founded in 1895, Auckland University of Technology is an educational facility that offers certificates, undergraduates, and postgraduate diplomas in a variety of fields.

Victim: | Group:

University Obrany - Press Release

Ransomware Group:

Monti

Discovery Date: 2023-09-19 23:47

Sector:

The city of Brno was chosen as the location for the new engineering-oriented military college due to its long tradition of superior quality engineering education.

Victim: | Group:

Ja Quith Press Release

Ransomware Group:

Monti

Discovery Date: 2023-09-14 17:36

Sector:

Jaquith Industries three main specialties - Airport Lighting - BMF Metal Forms - Custom Contract Fabrication are manufactured here in the USA.

Victim: | Group:

East Baking Press Release

Ransomware Group:

Monti

Discovery Date: 2023-09-14 17:36

Sector:

East Baking Company Inc. has the ability to manufacture any private label bakery program from bagels, breads, rolls, pancakes, and sweet goods to a very specific customized bakery products.

Victim: | Group:

Abatti Companies - Press Release

Ransomware Group:

Monti

Discovery Date: 2023-08-04 07:07

Sector:

Victim: | Group:

Bickel & Brewer - Press Release

Ransomware Group:

Monti

Discovery Date: 2023-08-02 13:06

Sector:

Founded in 1984, Bickel & Brewer has earned a reputation as one of the most successful law firms in the United States practicing exclusively in the field of complex commercial litigation and dispute resolution.

Victim: | Group:

Hungarian Investment Promotion Agency

Ransomware Group:

Monti

Discovery Date: 2023-07-30 10:02

Sector:

Hungarian Investment Promotion Agency is a company that operates in the Financial Services industry. It employs 11-20 people and has $5M-$10M of revenue.

Victim: | Group:

Siden & Associates Press Release

Ransomware Group:

Monti

Discovery Date: 2023-07-22 14:55

Sector:

Siden & Associates, P.C. provides legal services to clients throughout the greater Boston and New England areas. Our clients range from large and medium sized corporations to small and developing businesses.

Victim: | Group:

Hungarian Investment Promotion Agency Press Release

Ransomware Group:

Monti

Discovery Date: 2023-07-22 14:55

Sector:

Hungarian Investment Promotion Agency is a company that operates in the Financial Services industry. It employs 11-20 people and has $5M-$10M of revenue.

Victim: | Group:

Servizi Omnia All data upload

Ransomware Group:

Monti

Discovery Date: 2023-05-30 12:57

Sector:

I nostri consulenti svolgono tutte le attività di gestione della contabilità e predisposizione delle dichiarazioni tributarie..

Victim: | Group:

Servizi Omnia

Ransomware Group:

Monti

Discovery Date: 2023-05-26 21:57

Sector:

I nostri consulenti svolgono tutte le attività di gestione della contabilità e predisposizione delle dichiarazioni tributarie..

Victim: | Group:

ASL 1 - Avezzano Sulmona L'Aquila All data upload

Ransomware Group:

Monti

Discovery Date: 2023-05-15 11:56

Sector:

asl1abruzzo.it Portale istituzionale dell'Azienda Sanitaria Locale 1 Avezzano Sulmona L'Aquila.

Victim: | Group:

ASL 1 - Avezzano Sulmona L'Aquila UPD 05-13

Ransomware Group:

Monti

Discovery Date: 2023-05-12 23:55

Sector:

asl1abruzzo.it Portale istituzionale dell'Azienda Sanitaria Locale 1 Avezzano Sulmona L'Aquila.

Victim: | Group:

CSD Network Services Ltd

Ransomware Group:

Monti

Discovery Date: 2023-05-11 14:01

Sector:

Today, we are publishing a Data Breach report of an outsourcing company, and we want to announce that tomorrow we will leak the databases of the following hotels into public access.

Victim: | Group:

ASL 1 - Avezzano Sulmona L'Aquila UPD 05-11

Ransomware Group:

Monti

Discovery Date: 2023-05-11 12:54

Sector:

asl1abruzzo.it Portale istituzionale dell'Azienda Sanitaria Locale 1 Avezzano Sulmona L'Aquila.

Victim: | Group:

ASL 1 - Avezzano Sulmona L'Aquila UPD 05-10

Ransomware Group:

Monti

Discovery Date: 2023-05-10 15:56

Sector:

asl1abruzzo.it Portale istituzionale dell'Azienda Sanitaria Locale 1 Avezzano Sulmona L'Aquila.

Victim: | Group:

ASL 1 - Avezzano Sulmona L'Aquila first 10gb upload

Ransomware Group:

Monti

Discovery Date: 2023-05-08 20:55

Sector:

asl1abruzzo.it Portale istituzionale dell'Azienda Sanitaria Locale 1 Avezzano Sulmona L'Aquila.

Victim: | Group:

{UPD} Control & Automation technology - LUX Automation

Ransomware Group:

Monti

Discovery Date: 2023-05-08 19:54

Sector:

lux-automation.com For drive, regulation or control technology: LUX Automation is your expert when it comes to automation technology and process automation.

Victim: | Group:

ASL 1 - Avezzano Sulmona L'Aquila UPDATE

Ransomware Group:

Monti

Discovery Date: 2023-05-06 13:48

Sector:

asl1abruzzo.it Portale istituzionale dell'Azienda Sanitaria Locale 1 Avezzano Sulmona L'Aquila.

Victim: | Group:

ASL 1 - Avezzano Sulmona L'Aquila

Ransomware Group:

Monti

Discovery Date: 2023-05-03 16:54

Sector:

asl1abruzzo.it Portale istituzionale dell'Azienda Sanitaria Locale 1 Avezzano Sulmona L'Aquila.

Victim: | Group:

Control & Automation technology - LUX Automation

Ransomware Group:

Monti

Discovery Date: 2023-05-03 16:53

Sector:

lux-automation.com For drive, regulation or control technology: LUX Automation is your expert when it comes to automation technology and process automation.

Victim: | Group:

Weickert Industries

Ransomware Group:

Monti

Discovery Date: 2023-03-23 22:41

Sector:

www.weickert.com

Victim: | Group:

American Institute for Healthcare Quality

Ransomware Group:

Monti

Discovery Date: 2023-03-19 13:09

Sector:

https://www.zoominfo.com/c/american-institute-for-healthcare-quality/359823076

Victim: | Group:

Donut Leaks

Ransomware Group:

Monti

Discovery Date: 2023-03-19 13:09

Sector:

this gay rippers : Monti #ransomware team posted about how Dount Leaks stole 100K from them and did not 'fulfill the terms of the deal' 👀

Victim: | Group:

UnitedLex

Ransomware Group:

Monti

Discovery Date: 2023-03-17 19:21

Sector:

www.unitedlex.com

Victim: | Group:

Cambridge College

Ransomware Group:

Monti

Discovery Date: 2023-03-15 11:13

Sector:

boston.cambridgecollege.edu

Victim: | Group:

Regional Transportation Authority

Ransomware Group:

Monti

Discovery Date: 2023-03-08 00:14

Estimated Attack Date: 2023-03-07

Sector:

A government agency created by the State of Illinois to coordinate the Chicago region’s transit system https://rtachicago.org

Victim: | Group:

Every one of you been a good customer this year

Ransomware Group:

Monti

Discovery Date: 2022-12-22 20:17

Sector:

Group:

test

Ransomware Group:

Monti

Discovery Date: 2022-12-07 10:36

Sector:

Group:

Infostealer information available for

Employees(s)	Customer(s)	Third Party Employee(s)

This information is provided by HudsonRock

rule Linux_Ransomware_Monti_9c64f016 {
    meta:
        author = "Elastic Security"
        id = "9c64f016-0fd9-41bf-8916-cdf3a35efdd6"
        fingerprint = "af28cc97eed328f3b2b0181784545e41a521e9dfff09a504177cb56929606b84"
        creation_date = "2023-07-27"
        last_modified = "2024-02-13"
        threat_name = "Linux.Ransomware.Monti"
        reference_sample = "ad8d1b28405d9aebae6f42db1a09daec471bf342e9e0a10ab4e0a258a7fa8713"
        severity = 100
        arch_context = "x86"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "linux"
    strings:
        $a1 = "[%s] Flag doesn't equal MONTI."
        $a2 = "--vmkill Whether to kill the virtual machine"
        $a3 = "MONTI strain."
        $a4 = "http://monti"
    condition:
        2 of them
}