Ransomware group

Underground ransomware: victims and leak site activity

The Underground ransomware group has listed 26 victims on its leak site since May 2024; its latest post is from 15 August 2025. Most affected countries: United States, Canada and South Korea. Most targeted sector: Technology.

Total posts 26
First seen 2024-05-01
Latest post 2025-08-15
Countries hit 11

About Underground

Underground ransomware is deployed by the Russia-based RomCom group (Storm-0978) and has victimized companies across multiple industries since July 2023 by exploiting CVE-2023-36884, encrypting files without changing extensions and deleting Volume Shadow Copies and Windows event logs in double-extortion campaigns.

Leak site (Tor)
http://47glxkuxyayqrvugfumgsblrdagvrah7gttfscgzn56eyss5wg3uvmqd.onion

Most targeted countries

  1. United States 9
  2. Canada 3
  3. South Korea 3
  4. Germany 2
  5. Taiwan 2
  6. United Arab Emirates 1
  7. Spain 1
  8. France 1
  9. Japan 1
  10. Singapore 1
All countries →

Most targeted sectors

  1. Technology 7
  2. Healthcare 5
  3. Manufacturing 5
  4. Professional Services 5
  5. Agriculture and Food Production 2
  6. Financial Services 1
  7. Transportation 1
All sectors →

Underground victims per year

21 2024
5 2025

All 26 victims

Search every post in the full table.
Victim Country Sector Discovered
SFA Engineering South Korea Technology
GMORS Co., Ltd Taiwan Manufacturing
Afa Systems Ltd. Canada Technology
shengyusteel.com Taiwan Manufacturing
semex.com Canada Agriculture and Food Production
Simmtech Co., Ltd. South Korea Technology
hcsgcorp.com United States Healthcare
Casio Computer Co., Ltd Japan Technology
ramservices.com United States Professional Services
Ethypharm France Healthcare
A-Line Staffing Solutions United States Healthcare
belcherpharma.com United States Healthcare
CentralSecurities.com United States Financial Services
www.belcherpharma.com United States Healthcare
kc.co.kr South Korea Technology
bulldogbag.com Canada Manufacturing
frenckengroup.com Singapore Manufacturing
synology.com Germany Technology
tpa-group.sk Slovakia Professional Services
Triathlon.group Germany Transportation
awwg.com Spain Professional Services
KyungChang — Manufacturing
Y. Hata & Co., Ltd. United States Agriculture and Food Production
Skender Construction United States Professional Services
Creative Business Interiors United States Professional Services
cochraneglobal.com United Arab Emirates Technology