Spook
Spook ransomware operated briefly in September–October 2021 as a rebrand of the Prometheus ransomware group (built on the Thanos builder), conducting double-extortion attacks against global targets with a concentration in manufacturing and unusually publishing all victim names regardless of ransom payment.
Victims
35
First Victim
2021-10-04
(est. attack date)
Discovery Date
2021-10-04
Last Seen
2021-10-19
Inactive Since
4yrs
more than
Avg Delay
N/A
attack→claim
Infostealer
N/A
victims with domain
Countries
0
hit
Uptime
0.0% avg (30d)
Known Locations (1)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | Status | |
|---|---|---|---|---|---|---|---|---|
|
Spook | No | 2026-08-22T08:52:50 |
spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion
|
Target
Top 5 Activity Sectors
- Manufacturing 10
- Professional Services 7
- Retail & E-Commerce 5
- Transportation 3
- Agriculture and Food Production 3
Top 5 Countries
Heatmap
YARA Rules (1)
Victims (35)
