Section9
Intelligence Profile
🚨 This is a fake group with fake victims.
Intelligence Assessment
Section9 is a financially motivated ransomware operation. It functions as a threat group targeting diverse industries.
The group has impacted 18 victims in the last 90 days, focusing on sectors like Technology and Financial Services across countries including Brazil, the US, and France.
The actor is currently active, with all 18 tracked attacks occurring on July 26, 2026.
Threat Analysis
Section9 is a ransomware operation that deploys encryption-based extortion against organizations globally. This group maintains a data leak site (DLS) to pressure victims into paying ransom demands.
Financially motivated threat actors like Section9 prioritize monetary gain through methods such as ransomware deployment, banking trojans, cryptocurrency theft, BEC scams, or credential harvesting for resale on underground markets.
Ransomware Victims (20)
CTIWATCH tracks 20 organizations claimed as victims by Section9 on its data leak site, with attack dates, sectors and countries.
View full victims list →Known Campaigns
Section9 is conducting an active ransomware campaign targeting organizations across 10 countries. Primary targets: Agriculture and Food Production, Education, Financial Services. 20 confirmed victims recorded in the last 45 days. Campaign status: ACTIVE (last activity 30 Jul 2026).