Underground
Underground ransomware is deployed by the Russia-based RomCom group (Storm-0978) and has victimized companies across multiple industries since July 2023 by exploiting CVE-2023-36884, encrypting files without changing extensions and deleting Volume Shadow Copies and Windows event logs in double-extortion campaigns.
Victims
26
First Discovered
2024-05-01
victim
Last Discovered
2025-08-15
victim
Inactive Since
272
days
Avg Delay
89.2
days
Infostealer
41.7%
victims with domain
Countries
11
hit
Attack Velocity — Last 12 months
Known Locations (2)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
SignIn | Chat | No | 2026-04-28T07:22:03 |
undgrddapc4reaunnrdrmnagvdelqfvmgycuvilgwb5uxm25sxawaoqd.onion
|
|||
|
All data | Underground store | Yes | 2026-05-14T00:45:19 | nginx |
47glxkuxyayqrvugfumgsblrdagvrah7gttfscgzn56eyss5wg3uvmqd.onion
|
Target
Top 5 Activity Sectors
- Technology 7
- Manufacturing 5
- Healthcare 5
- Business Services 5
- Agriculture and Food Production 2
Top 5 Countries
-
United States
9
-
Korea, Republic of
3
-
Canada
3
-
Taiwan, Province of China
2
-
Germany
2
Heatmap
Ransom Notes (1)
YARA Rules (1)
Victims (26)
