obscura
Activity analysis
HackerFeeds has tracked 33 victims claimed by obscura since July 2025, most recently in January 2026 — ranking #137 of 332 groups (0.1% of all tracked ransomware victims). No new victims have been posted in the last 180 days; the most recent claim was in January 2026. Its most-targeted sector is Technology (5 victims), followed by Healthcare (4). The United States accounts for 6 victims (20% of those with a known location); 3 victims did not disclose a location.
Victims per year
- 202531
- 20262
Top sectors
- Technology5
- Healthcare4
- Energy4
- Construction4
- Business Services4
- Transportation/Logistics3
Top countries
Computed from victims claimed on the group's leak site as collected by HackerFeeds; claims are not independently verified. Monthly reports · Methodology
Group profile
Obscura is a ransomware strain observed in 2025, written in Go and specifically targeting Windows domain controllers via the SYSVOL/NETLOGON share, using Curve25519 + XChaCha20 encryption with double-extortion tactics and a 10-day payment deadline.
Recent victims
No victims tracked yet.