Teamxxx
TeamXXX is an emerging ransomware group that launched its leak site in June 2025, claiming victims across healthcare, agriculture, hospitality, financial services, and shipping sectors in the US, UK, Norway, Ireland, and Europe within its first months.
Victims
12
First Discovered
2025-06-10
victim
Last Discovered
2025-08-04
victim
Inactive Since
287
days
Avg Delay
44.6
days
Infostealer
8.3%
victims with domain
Countries
8
hit
Attack Velocity — Last 12 months
Known Locations (1)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
No | 2026-04-28T07:21:58 |
tp5cwh6d2b5hekcg6jlhoe6mawa7dlwiv47epvnfmzuaaur2dnaa3uid.onion
|
Target
Top 5 Activity Sectors
- Healthcare 4
- Transportation/Logistics 2
- Business Services 1
- Financial Services 1
- Hospitality and Tourism 1
Top 5 Countries
-
United States
3
-
United Kingdom
2
-
Sweden
1
-
Hong Kong
1
-
Ireland
1
Heatmap
YARA Rules (1)
Indicators of Compromise (IoCs) (1)
Victims (12)
[AI generated] Scania is a leading Swedish company that specializes in the production of heavy truck…
[AI generated] Intercommunityct.org is associated with InterCommunity Inc., a community-based health…
[AI generated] "ArvikHavn.no" is a Norwegian information service that focuses on the area around the…
[AI generated] Vent-Medical is a healthcare company specializing in respiratory care and artificial …
