Ransomware Group intelligence
Barracuda
ActiveTrack Barracuda with 14 published victims and 3 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Barracuda is tracked by Breach House as a ransomware group with 14 published victims.
United States is currently the most targeted country in this dataset.
3 known leak locations are currently associated with this group.
Leak Status Distribution
14
- Leaked 5 35.7%
- Pending 7 50.0%
- Deleted 2 14.3%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (3)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 3 | Onion service | Up checked 2h ago | qr6uopkqxmq254osyct3oibil32xp3qsimkkbqdscsrsb4zqbagnifad.onion |
| Leak location 1 | Onion service | Up checked 2h ago | darkfoxaqhfpxkrbt7vxns2z2u2k72sgmqbzeorupaiottw3ecm2wgyd.onion |
| Leak location 2 | Onion service | Up checked 2h ago | uvm6hk4wwstfddja5z5htgtlehmfyflffijz6iozsuqyacyibzxefkqd.onion |
Top Activity Sectors (8)
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Barracuda, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v20.0. Confidence: medium. Treat it as orientation, not attribution.
-
What they do: Barracuda leverages local accounts harvested from credential dumps to gain initial access and persist execution on victim machines.
What that means: Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
-
T1059.001 PowerShell Execution
What they do: Barracuda executes ransomware payload logic via encoded PowerShell commands to stage encryption routines across compromised hosts.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: Barracuda disables security tools by terminating antivirus processes and modifying Windows Defender service configurations.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1083 File and Directory Discovery Discovery
What they do: Barracuda performs file and directory discovery using PowerShell globbing to identify critical system and user data folders.
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1135 Network Share Discovery Discovery
What they do: Barracuda uses network share discovery to locate victim file servers and map accessible storage paths for encryption targets.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: Barracuda moves laterally through SMB/Windows Admin Shares using stolen credentials to encrypt additional networked systems.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1560.001 Archive via Utility Collection
What they do: Barracuda archives stolen data using utility-based collection commands before exfiltration to its command-and-control infrastructure.
What that means: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration.
-
T1486 Data Encrypted for Impact Impact
What they do: Barracuda encrypts discovered files and directories with custom symmetric encryption, appending its own勒索 note to each affected file.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: Barracuda inhibits system recovery by deleting Volume Shadow Copy snapshots and disabling backup restore mechanisms via built-in Windows tools.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
-
T1491.001 Internal Defacement Impact
What they do: Barracuda performs internal defacement by replacing system icons and web content with ransom notices to increase disruption.
What that means: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.
Victims (14)
Search, filter and paginate the victim timeline for Barracuda. Showing 1–14 of 14.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | Ministarstvo poljoprivrede, šumarstva i ribarstva id33593 View details | Croatia | — | pending | ||
|
We have complete database dumps from the Ministry of Agriculture and all documents from its main file server. They contain information about residents of Croatia, including agricultural registration records and personal data such as phone numbers, surnames, first names, and photos, as well as details about each resident’s agricultural activities. We also have Ministry of Agriculture contracts and other confidential documents. Recently, the authorities claimed that no data breach had occurred. It’s unfortunate that this was a lie. https://mps.hr | Status: selling | $50,000 |
||||||
| Ransomware | Automovil Club del Ecuador ANETA id33390 View details | Ecuador | Transportation / Travel / Logistics | pending | ||
|
We have a database of all the car club's customers and applications, photos of customers, financial documents, and a complete dump of emails from the mail server for the entire year: [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] | Status: selling | $30,000 |
||||||
| Ransomware | International Chemical Co. id33209 View details | — | — | pending | ||
|
International Chemical Company (ICC) manufactures specialty metalworking fluids, industrial cleaners, rust preventatives, and custom chemical formulations. We have extracted the most important files from their main file server and possess data on their sales, formulas, patents, manufacturing, contracts, and partners. For example, we possess the full formulation and manufacturing instructions for I.C.C.’s patented Biodraulic hydraulic oil. And even more than that. It is available for sale to competitors. Victim website: https://e-icc.com | Severity: HIGH | Size: 90 GB | Status: selling | $50,000 |
||||||
| Ransomware | Solucioning S.A. id33126 View details | Argentina | — | pending | ||
|
This is a small company of 4-5 people, yet it has big clients in the oil production sector. Unfortunately, the company neglected data security, allowing us to gain access to all their confidential files - projects, documents, blueprints, and so on. The company has been ignoring us for five days now, and we will soon publish their files. This is a warning. We do not wish to harm anyone, but we are prepared to inflict maximum damage. Victim website: https://www.solucioning.com/ | Severity: HIGH | Size: 463 GB | Status: selling | $100,000 |
||||||
| Ransomware | Abtach Ltd. id33123 View details | — | null | pending | ||
|
Abtach Ltd. was renamed Intersys Ltd.—a Pakistani company engaged in fraud targeting the US. The company’s employees charged fees for services that did not actually exist. The company’s founder, Azneem Bilwani, was involved in the illicit trafficking of synthetic opioids and fentanyl analogues, which were supplied to the US market via the eWorldTrade marketplace. We encrypted all virtual machines and snapshots on their ESXi hypervisors and all files on employee computers, and exfiltrated 1.5 TB of data from their infrastructure. We possess all their documents and bank records, which contain evidence of Azneem Bilwani’s illegal activities. Will be published soon... | Severity: HIGH | Size: 1.5 TB | Status: selling | $100,000 |
||||||
| Ransomware | i2i-systems id32793 View details | Türkiye | IT | pending | ||
|
This is one of the most poorly secured companies we have ever encountered. Over the course of a week, we analyzed the infrastructure and moved freely across their network. The infrastructure lacked proper security configurations, and the IT department showed a complete disregard for the data. As a result of the attack, 693 gigabytes of data were exfiltrated. We downloaded the complete source code for the following projects: Caplan DataGov-Dev-Docker DDR DDR-Veriskop DFE-Dev Kangal-Dev SDD-DEV-DOCKER SDD-MAIN commonprojects.zip Copycat.zip CopycatLive.zip datacat.war datagov.war Kangal-Dev.zip Kangal-Master.zip [email protected] smartdq.war The volume of exfiltrated source code totaled 44 gigabytes. The data includes a full snapshot of the latest releases from the development repository. i2i-systems has a direct connection to the information security company Veriskop; therefore, this breach directly affects them as well. In addition, i2i-systems engaged in joint projects with partners such as Vodafone, Etiya, Bouygues, Freedom Mobile, and others; this is evidenced by the Linux servers located within the i2i-systems infrastructure: 1864654005 backup_Veriskop-SQA1.local_2026-08-31_203808.tar.gz 3292962897 copycat2019.i2isystems.local_critical_backup_2026-08-31_19-30-29.tar.gz 18422354 critical_backup_bouygues_fcbs_batch2.local_20260830_221815.tar.gz 2231188487 etiya-mobile-test-01.local_backup_20260831_213207.tar.gz 20546323810 freedom-mobile1-critical-vault.tar.gz 1050673952 freedom-mobile2-secrets-20260830-232814.tar.gz 721661 maya-redhat7-9_2026-08-30_233036.tar.gz 22966288270 ol8-10-innobi_full_backup_20260831_022640.tar.gz 529695763 veriskop-db-critical-backup-2026-08-31_234418.tar.gz 13012999372 veriskop-fiziksel-yedek-20260831023535.tar.gz 309528511 veriskop-oracle-critical-backup-2026-08-31_203340.tar.gz 633604141 veriskop-rhel-7.local_critical_backup.tar.gz 4878999722 Veriskoptest01.local_backup_20260831_213236.tar.gz 238487575 Veriskoptest02.local_critical_backup_20260831_213052.tar.gz 33936543608 veriskoptest03_critical_backup_2026-08-31.tar.gz We have extracted absolutely all critical data from these infrastructure Linux systems and created a snapshot of the databases. In addition, i2i-systems recently launched a joint project with Turk Telekom—we have downloaded the database containing all their customers. The data will be published soon... | Severity: HIGH | Size: 643 GB | Status: selling | 300000$ |
||||||
| Ransomware | Skyline Implants & Periodontics id32035 View details | United States | Services | deleted | ||
|
Full personal and servers files dumps from Skyline Implants & Periodontics company. The data files contain: medical documents of patients (including MRI scans of various parts of the body — files with the .dcm extension), personal photos, and the personal data of the doctor, Scott Ferguson, as well as documents from the company Skyline Implants & Periodontics — in particular, information on equipment and pharmaceutical procurement and other related materials. | Severity: HIGH | Size: 800 GB | Status: free | FREE |
||||||
| Ransomware | Namyang Industrial Co., Ltd. id32036 View details | Korea, Republic of | IT | leaked | ||
|
Selling fresh full database dumps of company Namyang Industrial Co., Ltd. (renamed to Namyang Nexmo). Infrastructure dump, not website! There information about employers, manufacturing, parts, clients, partners and etc. Total lines (csv format): 17 641 181. | Severity: HIGH | Size: 2.51 GB | Status: free | FREE |
||||||
| Ransomware | Clinical Associates of the Finger Lakes (CAFL) id32037 View details | United States | Healthcare / Pharma | leaked | ||
|
The company mishandled its clients' and employees' data, which is why it was leaked. We extracted all files and documents from the infrastructure. These documents included children's medical records, personal information of parents and employees, a full dump of all emails from the mail server, and much more. Target website: https://www.clinassoc.com/ | Severity: HIGH | Size: 447 GB | Status: selling | $1000 |
||||||
| Ransomware | VR Advogados id31727 View details | Brazil | Finance / Legal / Insurance | pending | ||
|
VR Advogados, a Brazilian law firm, neglected its clients’ personal data, violating laws regarding data storage and confidentiality—they posted and shared all of their clients’ documents, passport information, and powers of attorney via a Discord server. We hacked it. Now we have 3,000 documents belonging to all of their clients—passports, powers of attorney, declarations, personal and work-related correspondence, and more. The firm hasn’t responded to us for three days; if this continues, we’ll start selling the data. | Status: upcoming | Size: 10 GB | Starts at $30000.00 |
||||||
| Ransomware | Ferrell \ Skyline Implants & Periodontics \ Dr. Scott Ferguson id31366 View details | United States | Healthcare / Pharma | deleted | ||
|
Full personal and servers files dumps from Skyline Implants & Periodontics company. The data files contain: medical documents of patients (including MRI scans of various parts of the body — files with the .dcm extension), personal photos, and the personal data of the doctor, Scott Ferguson, as well as documents from the company Skyline Implants & Periodontics — in particular, information on equipment and pharmaceutical procurement and other related materials. | Status: free | Size: 800 GB | Now free |
||||||
| Ransomware | Micro-Comm Inc. id31353 View details | United States | IT | leaked | ||
|
Micro-Comm, Inc. is an industrial automation company based in Olathe, Kansas, that provides water and wastewater control systems, manufacturing control panels, micro-controllers, and SCADA software. [http://www.micro-comm-inc.com]. Tree of all files: https://www.filemail.com/d/vpqdvykqwssupsw. Files count: 894 963, documents type: maps, schemes, personal employers information, personal citizens information, work photos, emails, partners personal information | Status: selling | Size: 643 GB | Starting at $30000.00 |
||||||
| Ransomware | Namyang Industrial Co., Ltd. \ NAMYANG NEXMO id31354 View details | Korea, Republic of | Telecommunications | leaked | ||
|
Selling fresh full database dumps of company Namyang Industrial Co., Ltd. (renamed to Namyang Nexmo). Infrastructure dump, not website! There information about employers, manufacturing, parts, clients, partners and etc. Total lines (csv format): 17 641 181. | Status: selling | Size: 2.51 GB | Starting at $40000.00 |
||||||
| Ransomware | RS Automation Co., Ltd. id31355 View details | China | Manufacturing / Engineering | leaked | ||
|
Full dump of all files from the servers and developers personal files and NAS. Legal documents, letters, drawings, assembly, C, and C++ source codes. Official manufacturer website: rsautomation.co.kr | Status: upcoming | Size: 637 GB | Starts at $50000.00 |
||||||