Ransomware group

IMNCrew ransomware: victims and leak site activity

The IMNCrew ransomware group has listed 12 victims on its leak site since May 2025; its latest post is from 16 September 2025. Most affected countries: United States, Canada and Colombia. Most targeted sector: Manufacturing.

Total posts 12
First seen 2025-05-05
Latest post 2025-09-16
Countries hit 9

About IMNCrew

IMN Crew is a data extortion and ransomware group that emerged in late March 2025, primarily targeting financial services organizations in the US, Croatia, and Indonesia by exploiting exposed perimeter services such as firewalls and VPNs, claiming at least five victims.

Leak site (Tor)
http://imncrewwfkbjkhr2oylerfm5qtbzfphhmpcfag43xc2kfgvluqtlgoid.onion

Most targeted countries

  1. United States 4
  2. Canada 1
  3. Colombia 1
  4. Czechia 1
  5. Croatia 1
  6. Indonesia 1
  7. Italy 1
  8. Mexico 1
  9. Sweden 1
All countries →

Most targeted sectors

  1. Manufacturing 3
  2. Retail & E-Commerce 3
  3. Professional Services 2
  4. Technology 2
  5. Financial Services 1
  6. Healthcare 1
All sectors →

IMNCrew victims per year

12 2025

All 12 victims

Search every post in the full table.
Victim Country Sector Discovered
Jansenfurniture.com Canada Retail & E-Commerce
Onegolditalia.it Italy Manufacturing
Apntelecom.com United States Technology
Repremundo.com.co Colombia Professional Services
Stiga.com Sweden Retail & E-Commerce
Synthesia.com Czechia Technology
Grupo Herradura Occidente Mexico Manufacturing
Croatianmint.hr Croatia Professional Services
Derp.org United States Retail & E-Commerce
Abdainsurance.co.id Indonesia Financial Services
Vnakc.org United States Healthcare
Goodson.com United States Manufacturing