Perpetuuiti

Perpetuuiti was compromised in a ransomware attack attributed to dragonforce in February 2026. The organization, operating in the Technology sector in India, was added to the group's data leak site as part of an extortion campaign.

dragonforce operates as a financially motivated ransomware-as-a-service (RaaS) operation, exfiltrating sensitive data and threatening public disclosure to pressure victims into paying ransom demands.

An initial analysis of the structure and names of the files revealed that the directory contains software source codes, configuration and installation files, backup copies of information systems, database structures and dumps, as well as financial, administrative, operational, and technical documentation related to the functioning of the organization's IT systems. However, the presence or absence of personal data, including contact telephone numbers, cannot be reliably confirmed without additional analysis of the contents of the backups and databases, which indicates a potential area of risk in the context of data protection and information security management requirements. Listing files = 145MB.

Intelligence correlations link this incident to 1 vulnerability(ies) including CVE-2025-5777, which may have been leveraged as initial access vectors or for lateral movement.