underground
Activity analysis
HackerFeeds has tracked 26 victims claimed by underground since May 2023, most recently in August 2025 — ranking #151 of 332 groups (0.1% of all tracked ransomware victims). No new victims have been posted in the last 180 days; the most recent claim was in August 2025. Its most-targeted sector is Technology (7 victims), followed by Manufacturing (5). The United States accounts for 9 victims (36% of those with a known location); 1 victims did not disclose a location.
Victims per year
- 20234
- 202417
- 20255
Top sectors
- Technology7
- Manufacturing5
- Healthcare5
- Business Services5
- Agriculture and Food Production2
- Transportation/Logistics1
Top countries
Computed from victims claimed on the group's leak site as collected by HackerFeeds; claims are not independently verified. Monthly reports · Methodology
Group profile
Underground ransomware is deployed by the Russia-based RomCom group (Storm-0978) and has victimized companies across multiple industries since July 2023 by exploiting CVE-2023-36884, encrypting files without changing extensions and deleting Volume Shadow Copies and Windows event logs in double-extortion campaigns.
Recent victims
| Date | Website / victim | Sector | Country |
|---|---|---|---|
| 2025-08-15 |  SFA Engineeringsfa.co.kr | Technology | KR |
| 2025-06-25 |  GMORS Co., Ltdgmors.com | Manufacturing | TW |
| 2025-02-13 |  Afa Systems Ltd.afasystemsinc.com | Technology | CA |
| 2025-04-08 |  shengyusteel.comshengyusteel.com | Manufacturing | TW |
| 2025-04-15 |  semex.comsemex.com | Agriculture and Food Production | CA |
| 2024-12-16 |  Simmtech Co., Ltd.simmtech.com | Technology | KR |
| 2024-10-25 |  hcsgcorp.comhcsgcorp.com | Healthcare | US |
| 2024-10-09 |  Casio Computer Co., Ltdcasio.co.jp | Technology | JP |
| 2024-07-03 |  ramservices.comramservices.com | Professional Services | US |
| 2024-06-20 |  Ethypharmethypharm.com | Healthcare | FR |
| 2024-05-24 |  A-Line Staffing Solutionsalinestaffing.com | Healthcare | US |
| 2024-05-04 |  belcherpharma.combelcherpharma.com | Healthcare | US |
| 2024-05-15 |  CentralSecurities.comcentralsecurities.com | Financial Services | US |
| 2024-05-04 | www.belcherpharma.combelcherpharma.com | Healthcare | US |
| 2024-02-23 |  kc.co.krkc.co.kr | Technology | KR |
| 2023-07-14 |  bulldogbag.combulldogbag.com | Manufacturing | CA |
| 2023-07-18 |  frenckengroup.comfrenckengroup.com | Manufacturing | SG |
| 2023-05-30 |  synology.comsynology.com | Technology | DE |
| 2023-07-04 |  tpa-group.sktpa-group.sk | Professional Services | SK |
| 2024-01-26 |  Triathlon.grouptriathlon.group | Transportation | DE |
| 2024-01-25 |  awwg.comawwg.com | Professional Services | ES |
| 2024-03-06 | K KyungChang | Manufacturing | |
| 2024-03-14 |  Y. Hata & Co., Ltd.yhata.com | Agriculture and Food Production | US |
| 2024-03-21 |  Skender Constructionskender.com | Professional Services | US |
| 2024-03-17 |  Creative Business Interiorscreativebusinessinteriors.com | Professional Services | US |
| 2024-04-15 |  cochraneglobal.comcochraneglobal.com | Technology | AE |