All ransomware groups
ms13089
4 tracked victims
·first seen 2025-12-18·last activity 2026-05-05Group profile
MS13089 is a newly emerged ransomware group (first observed December 2025) that named itself after a 2013 Microsoft Security Bulletin, claiming a handful of victims including a law firm, operating primarily as a double-extortion actor.
Recent victims
| Date | Website / victim | Sector | Country |
|---|---|---|---|
| 2026-05-05 |  brittanyresidential.combrittanyresidential.com | Consumer Services | US |
| 2026-01-15 |  sjl-legal.comsjl-legal.com | Business Services | LU |
| 2025-12-18 |  dgpcommercialisti.itdgpcommercialisti.it | Business Services | IT |
| 2025-12-18 |  uro.comuro.com | Healthcare | DE |