Ransomware group cactus hits assaabloy.com
assaabloy.com — a manufacturing target operating in SE has been listed by the cactus ransomware group on 2025-03-17. The information below reflects what the threat actor has publicly claimed on their leak site; the details have not been independently verified.
Incident Report
| Target Organization | assaabloy.com |
|---|---|
| Threat Group | cactus |
| Summary | assaabloy.com, a manufacturing organization in Sweden, was listed by the cactus ransomware group on its leak site on 2025-03-17. |
| Date of Breach | 2025-03-17 |
| Discovery Date | 2025-03-17 |
| Region | SE |
| Target Domain | assaabloy.com |
| Business Sector | Manufacturing |
| Severity | MEDIUM |
Claim by cactus
<p>Business Services<br><br>“The Assa Abloy AB is the global leader in access solutions. The Group has leading positions in areas such as efficient door openings, trusted identities and entrance automation. ASSA ABLOY's innovations enable safe, secure and convenient access to physical and digital places.”<br><br>Website: <a href="https://www.assaabloy.com/">https://www.assaabloy.com/</a><br><br>Revenue : $14.4B<br><br>Address: 90 Klarabergsviadukten, Stockholm, Stockholm, 111 64, Sweden<br><br>Phone Number: +46 850648500<br><br><mark class="marker-yellow"><strong>Download link #1:</strong></mark> <a href="https://6wuivqgrv2g7brcwhjw5co3vligiqowpumzkcyebku7i2busrvlxnzid.onion/ASSAABLOY/PROOF/">https://6wuivqgrv2g7brcwhjw5co3vligiqowpumzkcyebku7i2busrvlxnzid.onion/ASSAABLOY/PROOF/</a><br><br><mark class="marker-yellow"><strong>Mirror:</strong></mark> <a href="https://cactus5dqnqkppa5ayckiyk6dttpqwczdqphv5mxh4dkk5ct544q5aad.onion/ASSAABLOY/PROOF/">https://cactus5dqnqkppa5ayckiyk6dttpqwczdqphv5mxh4dkk5ct544q5aad.onion/ASSAABLOY/PROOF/</a><br><br><mark class="marker-yellow"><strong>DATA DESCRIPTIONS:</strong></mark> <span style="background-color:rgb(16,19,23);color:rgb(235,238,242);font-family:Inter, Twemoji, "Apple Color Emoji", "Segoe UI Emoji", Arial, Helvetica, sans-serif, "Noto Color Emoji";">Confidential information on corporate business strategies and processes, agreements and contracts, personal identifiable information (passports, DL, contacts, home addresses, etc. of executive management and others), various internal confidential documents, audit documents, legal data, financials and payroll, corporate and personal sensitive correspondence, exports from databases, etc.</span></p><p><img src="/uploads/Erik_Pieder_new_passport_FULL_legalized_2384077b3a.png" alt="Erik Pieder new passport FULL, legalized.png"><img src="/uploads/CONFIDENTIAL_MFP_10_July_2024_Submissions_DRAFT_ff68ae4052.png" alt="CONFIDENTIAL MFP10 July 2024- Submissions DRAFT.png"><img src="/uploads/Project_Colossus_SPA_tollgate_240325_462bbafedf.png" alt="Project Colossus_SPA tollgate_240325.png"><img src="/uploads/K089000_H_e0b5e1cfe3.png" alt="K089000H.png"><img src="/uploads/Project_Norrland_Legal_Due_Diligence_Report_Final_Version_20_February_2024_as_updated_20_March_20_d3350aaebf.png" alt="Project Norrland - Legal Due Diligence Report [Final Version 20 February 2024 as updated 20 March 20.png"><img src="/uploads/Info_Nico_Delvaux_Jan2018_PP_28b695620d.png" alt="Info_Nico_Delvaux_Jan2018_PP.png"></p>
Posted by the cactus threat actor on its public leak site. This is the group's own statement and has not been independently verified by HackerFeeds.
Sources
Victim website
assaabloy.com
Leak post (onion / Tor)
https://cactusbloguuodvqjmnzlwetjlpj6aggc6iocwhuupb47laukux7ckid.onion/posts/ASSAABLOY
Open this URL in Tor Browser. Browsing leak sites carries real risk — view passively, never click further.
Disclaimer
HackerFeeds does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.