Teamxxx
TeamXXX is an emerging ransomware group that launched its leak site in June 2025, claiming victims across healthcare, agriculture, hospitality, financial services, and shipping sectors in the US, UK, Norway, Ireland, and Europe within its first months.
Victims
12
First Victim
2025-02-17
(est. attack date)
Discovery Date
2025-06-10
Last Seen
2025-08-04
Inactive Since
1yr
more than
Avg Delay
44.6
days
Infostealer
16.7%
victims with domain
Countries
8
hit
Uptime
0.0% avg (30d)
Known Locations (1)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | Status | |
|---|---|---|---|---|---|---|---|---|
|
No | 2026-08-22T08:56:28 |
tp5cwh6d2b5hekcg6jlhoe6mawa7dlwiv47epvnfmzuaaur2dnaa3uid.onion
|
Target
Top 5 Activity Sectors
- Healthcare 4
- Transportation 2
- Retail & E-Commerce 2
- Professional Services 1
- Financial Services 1
Top 5 Countries
-
United States
3
-
United Kingdom
2
-
Sweden
1
-
Hong Kong
1
-
Ireland
1
Heatmap
YARA Rules (1)
Indicators of Compromise (IoCs) (1)
Victims (12)
[AI generated] Scania is a leading Swedish company that specializes in the production of heavy truck…
[AI generated] Intercommunityct.org is associated with InterCommunity Inc., a community-based health…
[AI generated] "ArvikHavn.no" is a Norwegian information service that focuses on the area around the…
[AI generated] Vent-Medical is a healthcare company specializing in respiratory care and artificial …
