Underground
Underground ransomware is deployed by the Russia-based RomCom group (Storm-0978) and has victimized companies across multiple industries since July 2023 by exploiting CVE-2023-36884, encrypting files without changing extensions and deleting Volume Shadow Copies and Windows event logs in double-extortion campaigns.
Victims
26
First Victim
2023-05-30
(est. attack date)
Discovery Date
2024-05-01
Last Seen
2025-08-15
Inactive Since
1yr
more than
Avg Delay
89.2
days
Infostealer
56.0%
victims with domain
Countries
11
hit
Uptime
96.6% avg (30d)
Known Locations (2)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | Status | |
|---|---|---|---|---|---|---|---|---|
|
SignIn | Chat | No | 2026-08-22T08:54:03 |
undgrddapc4reaunnrdrmnagvdelqfvmgycuvilgwb5uxm25sxawaoqd.onion
|
||||
|
All data | Underground store | Yes | 2026-09-03T16:48:38 | nginx |
47glxkuxyayqrvugfumgsblrdagvrah7gttfscgzn56eyss5wg3uvmqd.onion
|
Target
Top 5 Activity Sectors
- Technology 7
- Manufacturing 5
- Healthcare 5
- Professional Services 5
- Agriculture and Food Production 2
Top 5 Countries
-
United States
9
-
Korea, Republic of
3
-
Canada
3
-
Taiwan, Province of China
2
-
Germany
2
Heatmap
Ransom Notes (1)
YARA Rules (1)
Victims (26)
