Netrunner
| Active
NetRunner is a ransomware group active from at least 2025 targeting diverse sectors including healthcare, telecommunications, manufacturing, and agriculture across Japan, Italy, the US, and Jordan, notably demanding a $100M ransom from Nippon Medical School Musashi Kosugi Hospital.
Victims
6
First Discovered
2026-04-03
victim
Last Discovered
2026-04-03
victim
Inactive Since
45
days
Avg Delay
N/A
attack→claim
Infostealer
0.0%
victims with domain
Countries
5
hit
Attack Velocity — Last 12 months
Known Locations (1)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
NetRunner Leak | Yes | 2026-05-18T16:42:06 | nginx |
netrunrsb3bivj5gnwajzxlig5qkteb6edgthxj7fmsvhkzxtwfxwaad.onion
|
Target
Top 5 Activity Sectors
- Healthcare 2
- Agriculture and Food Production 1
- Consumer Services 1
- Telecommunication 1
- Manufacturing 1
Top 5 Countries
-
Japan
2
-
Jordan
1
-
United States
1
-
Italy
1
-
India
1
Heatmap
Ransom Notes (1)
YARA Rules (1)
Indicators of Compromise (IoCs) (2)
Email
1
tox
1
| Type | IOC |
|---|---|
Email
|
adqpf4@navi.land
|
tox
|
02B37A5C56F8A4A73284B3CF5972D6F5C92258EC0B6269DF5C64E364E8AA8C0B0C51D7B87747
|
Victims (6)
Indian Farmers Fertiliser Cooperative (IFFCO) and Jordan Phosphates Mines Company Ltd (JPMC) had for…
Harman Fitness is a multi-unit franchise operator and management company that owns and runs dozens o…
Nippon Medical School Musashi Kosugi Hospital is a 372-bed regional teaching hospital in Nakahara-ku…
Shiramume Hospital is a regional general hospital in Japan providing comprehensive inpatient and out…
GEG srl (est. 1981) designs and builds integrated mobile radio systems across Italy. Over 35 years i…
Seoyon E‑Hwa Summit is a subsidiary of Seoyon E‑Hwa that manufactures automotive components, operati…