0mega
Activity analysis
HackerFeeds has tracked 7 victims claimed by 0mega since July 2022, most recently in January 2024 — ranking #239 of 332 groups (0% of all tracked ransomware victims). No new victims have been posted in the last 180 days; the most recent claim was in January 2024. Its most-targeted sector is Business Services (3 victims), followed by Healthcare (2). The United States accounts for 2 victims (100% of those with a known location); 5 victims did not disclose a location.
Victims per year
- 20222
- 20234
- 20241
Top sectors
- Business Services3
- Healthcare2
- Transportation/Logistics1
- Manufacturing1
Top countries
Computed from victims claimed on the group's leak site as collected by HackerFeeds; claims are not independently verified. Monthly reports · Methodology
Group profile
0mega is a double-extortion ransomware group that emerged in May 2022, targeting businesses across multiple sectors worldwide by encrypting files and threatening to leak stolen data; it also pivoted to cloud-based extortion by compromising Microsoft 365 admin accounts.
MITRE ATT&CK TTPs
Initial Access
T1078Valid Accounts
Access was obtained through the compromise of global Microsoft SaaS administrator accounts that were weakly protected.
Privilege Escalation
T1136Create Account: Cloud Account
After gaining initial access, the group created a new user in Active Directory (AD) named "0mega" with multiple administrator roles (e.g., Global Administrator, SharePoint Administrator) to maintain maximum control.
Defense Evasion
T1531Account Access Removal
The group systematically deleted over 220 corporate administrator accounts within a two-hour period, impairing the victim's ability to respond and recover.
Collection
T1119Automated Collection
The group collected sensitive data using the obtained permissions.
Exfiltration
T1041Exfiltration Over C2 Channel
Data was exfiltrated from environments such as the victim's SharePoint, consistent with a double extortion tactic.
Impact
T1486Data Encrypted for Impact
The attack used AES-256 or RSA encryption on critical files after network mapping, blocking legitimate access. In some cases, the focus was solely on exfiltration and extortion without encryption.
T1490Inhibit System Recovery
The ransomware searched for and disabled connected or online backups to prevent quick data recovery without paying the ransom.
Recent victims
| Date | Website / victim | Sector | Country |
|---|---|---|---|
| 2024-01-25 |  Four Hands LLCfourhands.com | Professional Services | US |
| 2023-10-17 | R Rotorcraft Leasing Company | Transportation | |
| 2023-10-04 | U US Liner Company & American Made LLC | Manufacturing | |
| 2023-02-12 |  Aviacode (GeBBS)gebbs.com | Healthcare | |
| 2023-01-09 |  Aviacodeaviacode.com | Healthcare | |
| 2022-09-15 |  Nextlabsnextlabs.com | Professional Services | US |
| 2022-07-14 | M Maxey Moverley | Professional Services |