Ransomware Group intelligence
Eclipse
ActiveTrack Eclipse with 20 published victims and 2 known leak locations in a single intelligence view.
Overview
Eclipse is tracked by Breach House as a ransomware group with 20 published victims.
Singapore is currently the most targeted country in this dataset.
2 known leak locations are currently associated with this group.
Leak Status Distribution
- Leaked 13 65.0%
- Pending 7 35.0%
- Deleted 0 0.0%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (2)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Up checked 1h ago | eclipse4g5kxfwsvpu4qx5sdcnrji6gxl5gt67bucjlgt35g7akvjoid.onion |
| Leak location 2 | Onion service | Down checked 1h ago | yecdjimqiaekprxza6wkqecma4bwt757qiyfjngsaxg7rkjv4xukpwad.onion |
Top Activity Sectors (9)
Typical Attacks (7)
▼MITRE ATT&CK does not currently catalogue Eclipse, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v20.0. Confidence: low. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: Eclipse executes malicious payloads via PowerShell scripts to deploy ransomware and evade detection.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: Eclipse disables security tools like antivirus software to prevent system recovery and hinder incident response.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: Eclipse deletes Volume Shadow Copies and backup files via vssadmin to eliminate recovery options.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1083 File and Directory Discovery Discovery
What they do: Eclipse uses file and directory discovery to locate sensitive data and backup locations for targeting.
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1560.001 Archive via Utility Collection
What they do: Eclipse archives victim data using utility tools prior to encryption to facilitate potential exfiltration.
What that means: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration.
-
T1486 Data Encrypted for Impact Impact
What they do: Eclipse encrypts victim files using strong symmetric encryption to maximize impact and ransom demand.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: Eclipse inhibits system recovery by corrupting critical services and disabling restore mechanisms.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (20)
Search, filter and paginate the victim timeline for Eclipse. Showing 1–20 of 20.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | PART2 Global AirFreight International id34962 View details | Singapore | Transportation / Travel / Logistics | pending | ||
|
PART2 Global AirFreight International www.globalair.com.sg PUBLISHED PART 2 Global Airfreight International is a logistics solution provider specializing in air freight, ocean freight, cross-border trucking, and contract logistics. They cater to various industries including aerospace, healthcare, technology, and general cargo, offering services such as temperature-controlled solutions and project cargo management. The company focuses on delivering high standards of service and innovative solutions to meet customer requirements. Their clients include businesses in need of reliable and efficient supply chain solutions for critical shipments. Oct 17, 2026 40 downloads 255 views |
||||||
| Ransomware | Taiwan Otsuka Pharmaceutical id33867 View details | Taiwan, Province of China | — | pending | ||
|
Taiwan Otsuka Pharmaceutical was founded in 1974, with the philosophy of "pursuing the health and well-being of people worldwide". With the continuous efforts for the expansion and renewal of production equipment, pharmaceutical technology has continuously improved the quality. It has driven Taiwan's pharmaceutical industry to recognize the high-quality infusion containers. Taiwan Otsuka Pharmaceutical Factory was ranked as Grade A by the Department of Health in 1984. It was approved as a GMP pharmaceutical factory by the Department of Health and the Ministry of Economic Affairs of the Executive Yuan in 1986. It was approved as a PIC/S GMP pharmaceutical factory by the Department of Health of the Executive Yuan in 2010, and its products are exported to many countries in Asia, which proves that the quality has reached the high standard. Taiwan Otsuka Pharmaceutical also adheres to the business philosophy of "Otsuka people" and is committed to research and development. We will continue to strive for perfection and make unremitting efforts for the health of the people and the well-being of the society. At the same time, we hope that all sectors of society will continue to give us advice and guidance. We will also adhere to the spirit of "honesty, creativity, and service" to achieve our goals. |
||||||
| Ransomware | japantimes.co.jp id33868 View details | Japan | — | pending | ||
|
[AI generated] The Japan Times is Japan's oldest and largest English-language newspaper, founded in 1897. It operates in the media and publishing industry, providing news, analysis, and commentary on Japanese politics, business, society, and culture to an international audience. Headquartered in Tokyo, Japan, the company publishes both print and digital editions, serving expatriates, diplomats, businesspeople, and readers worldwide interested in Japan-related news. |
||||||
| Ransomware | dipecarr.com.br id33580 View details | Brazil | — | pending | ||
|
[AI generated] N/A I don't have reliable, verifiable information about a company operating at "dipecarr.com.br." I'm unable to confirm its business activities, industry classification, or operational details with confidence. Providing fabricated details about an unfamiliar domain could result in inaccurate threat intelligence. If you have additional context or source material about this entity, I'd be glad to help analyze it. |
||||||
| Ransomware | simplexengg.in id33572 View details | India | — | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | sanjoseattorneys.com id33573 View details | United States | — | pending | ||
|
[AI generated] N/A Based on the domain name alone, I cannot reliably verify specific details about this website, such as its actual operating status, business legitimacy, ownership, or operational history. The name suggests a legal services website potentially related to attorneys in San Jose, California, USA, but I don't have verified, factual information about this specific entity to provide an accurate threat intelligence assessment. |
||||||
| Ransomware | DIPECARR id33570 View details | Brazil | — | leaked | ||
|
Dipecarr is Brazil's top truck parts distributor, founded in 1994 by Adilson José de Almeida. With over 10,000 items ready to ship and partnerships with world-known brands, they serve 80,000 customers across seven branches in key Brazilian states. The company offers everything a truck owner needs, focusing on quality service and continuous growth. |
||||||
| Ransomware | Global AirFreight International id33569 View details | Singapore | — | pending | ||
|
Global Airfreight International is a logistics solution provider specializing in air freight, ocean freight, cross-border trucking, and contract logistics. They cater to various industries including aerospace, healthcare, technology, and general cargo, offering services such as temperature-controlled solutions and project cargo management. The company focuses on delivering high standards of service and innovative solutions to meet customer requirements. Their clients include businesses in need of reliable and efficient supply chain solutions for critical shipments. |
||||||
| Ransomware | part02.simplexengg.in id33476 View details | India | Manufacturing / Engineering | leaked | ||
|
[AI generated] N/A |
||||||
| Ransomware | The Japan Times id33357 View details | Japan | Services | leaked | ||
|
The Japan Times is a leading English-language news outlet that provides comprehensive coverage of Japan's business, politics, culture, sports, and entertainment. It offers various subscription options, including digital and print formats, catering to a diverse audience interested in Japanese news and insights. The company also features specialized services such as academic and business subscriptions, as well as access to its digital archives. Its intended clients include local and international readers seeking reliable information about Japan and its global interactions. |
||||||
| Ransomware | Dublin City Schools GA id32815 View details | United States | Education | leaked | ||
|
Dublin City Schools is a charter school system dedicated to preparing students to be effective communicators, problem solvers, and lifelong learners. The district offers a range of academic programs, including advanced and gifted education, special education, and various support services. Their intended clients include students and families in Dublin, Georgia, as well as educators seeking employment opportunities within the district |
||||||
| Ransomware | Rosello et Fils id32814 View details | France | Hospitality / Food & Beverage / Tourism | leaked | ||
|
Rosello & Fils is a fruit and vegetable wholesaler based in Saint-Laurent-Blangy, France. With over 100 years of experience, the company operates exclusively within the Hauts-de-France region, serving professionals in the Nord, Pas-de-Calais, and Somme departments. Its client base includes commercial and collective catering, local shops, and large and medium-sized retail surfaces |
||||||
| Ransomware | The Zhou Law Group id32679 View details | United States | Finance / Legal / Insurance | leaked | ||
|
The Zhou Law Group is one of the largest family law firms in California, specializing in divorce and related family law issues such as child custody, spousal support, and property division. With a team of top-rated divorce lawyers and Certified Family Law Specialists, they provide effective legal solutions to clients, including tech company founders and high asset-holders. The firm operates in the Greater Bay Area and Greater Los Angeles, offering services in multiple languages, including English and Chinese. Their reputation for professionalism and client care has earned them stellar reviews and a strong presence in the family law industry. |
||||||
| Ransomware | TTG Asia Media id32680 View details | Singapore | Retail / E-commerce | leaked | ||
|
TTG Asia is a leading travel trade business resource in the Asia-Pacific region, established in 1974. The company provides a comprehensive range of services and information related to travel, including hotels, transportation, airlines, and cruises. Its intended clients include travel professionals and businesses within the tourism industry looking for insights and resources to enhance their operations. TTG Asia also features news, trade calendars, and branded content to support the growth of the travel sector. |
||||||
| Ransomware | part1.simplexengg.in id32419 View details | India | Manufacturing / Engineering | leaked | ||
|
[AI generated] N/A |
||||||
| Ransomware | Royal Plaza On Scotts id32416 View details | Singapore | Retail / E-commerce | leaked | ||
|
Royal Plaza on Scotts Hotel is a five-star independent hotel located in the heart of Singapore's Orchard Road, offering spacious and modern accommodations. With a legacy of over 50 years, it has been recognized as Asia Pacific's Best Independent Hotel, providing guests with a comfortable stay and award-winning halal-certified dining at its renowned Carousel restaurant. The hotel caters to both leisure and business travelers, featuring facilities for meetings, events, and weddings. Guests can enjoy exclusive offers and loyalty rewards through the I Prefer Hotel Rewards Programme. |
||||||
| Ransomware | ETNA Software id32217 View details | Italy | IT | leaked | ||
|
ETNA Software is a company that provides white-label online trading solutions for brokers and FinTech firms, including mobile and web trading platforms. Their products are designed to help retail broker-dealers launch trading capabilities efficiently and cost-effectively. |
||||||
| Ransomware | Simplex Engineering id32166 View details | India | Manufacturing / Engineering | leaked | ||
|
Simplex Engineering & Foundry Works Pvt. Ltd. specializes in the design, fabrication, machining, and assembly of industrial equipment and components. With over seventy years of experience, the company has successfully completed numerous turnkey projects for both private and public sector organizations. Additionally, Simplex offers refurbishment services for industrial equipment and steel procurement through its Steel Service Center. Their esteemed clientele includes some of the largest engineering companies in India. |
||||||
| Ransomware | Crystal Pharmatech id32021 View details | United States | Healthcare / Pharma | leaked | ||
|
Crystal Pharmatech is a technology-driven contract research organization (CRO) that focuses on materials science and engineering for drug development. Established in 2010 and have R&D centers located in Suzhou (China), New Jersey, San Francisco (USA), and Toronto (Canada). Also its key differentiator is integrated and specialized services, including API solid-state research, crystallization, preformulation, formulation development and manufacturing, clinical supply. |
||||||
| Ransomware | Moscord id31775 View details | Singapore | IT | leaked | ||
|
Moscord is a digital marketplace that connects buyers and sellers in the maritime industry, offering a platform for various suppliers to aggregate and present their products. The company aims to enhance business operations for its clients by providing innovative solutions in procurement, logistics, and eCommerce. Targeting maritime and oil & gas sectors, Moscord serves a global clientele through its extensive network of ports and offices across multiple countries. With a focus on improving user experience and operational efficiency, Moscord leverages advanced technology and industry expertise to facilitate seamless transactions. |
||||||