Spook
Spook ransomware operated briefly in September–October 2021 as a rebrand of the Prometheus ransomware group (built on the Thanos builder), conducting double-extortion attacks against global targets with a concentration in manufacturing and unusually publishing all victim names regardless of ransom payment.
Victims
35
First Discovered
2021-10-04
victim
Last Discovered
2021-10-19
victim
Inactive Since
4yrs
more than
Avg Delay
N/A
attack→claim
Infostealer
N/A
victims with domain
Countries
0
hit
Known Locations (1)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
Spook | No | 2026-04-28T07:22:26 |
spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion
|
Target
Top 5 Activity Sectors
- Manufacturing 10
- Professional Services 7
- Retail & E-Commerce 5
- Transportation 3
- Agriculture and Food Production 3
Top 5 Countries
Heatmap
YARA Rules (1)
Victims (35)
