APT / THREAT GROUP

RansomVC

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Ransomed.VC burst onto the scene with a well-orchestrated PR campaign, encompassing a clearnet site and multiple communication channels including Telegram and Twitter/X profiles. Their operations are heavily inclined towards exploiting GDPR penalties as a method of extortion, threatening victims with potential legal repercussions in case of data leaks.

Threat Analysis

RansomVC is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://therecord.media/colonial-pipeline-attributes-ransomware-claims-to-unrelated-third-party-breach

→https://socradar.io/on-the-horizon-ransomed-vc-ransomware-group-spotted-in-the-wild/

→https://www.sentinelone.com/blog/sep-2023-cybercrime-update-new-ransomware-threats-and-the-rising-menace-of-telegram/

→https://socradar.io/unmasking-usdod-the-enigma-of-the-cyber-realm/

→https://www.videogameschronicle.com/news/a-ransomware-group-claims-to-have-beached-all-sony-systems/

→https://securityaffairs.com/151550/data-breach/ransomed-vc-sony-ntt-alleged-attacks.html

→https://blog.talosintelligence.com/threat-source-newsletter-sept-28-2023/

→https://www.resecurity.com/blog/article/ransomedvc-in-the-spotlight-what-we-know-about-the-ransomware-group-targeting-major-japanese-businesses

Quick Facts

TypeAPT / Threat Group

Aliases2

SourceMalpedia

Also Known As

RansomVCRansomed.vc

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search RansomVC