Ransomware Group intelligence
HYFLOCK
ActiveTrack HYFLOCK with 10 published victims and 1 known leak locations in a single intelligence view.
Overview
HYFLOCK is tracked by Breach House as a ransomware group with 10 published victims.
Canada is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Leak Status Distribution
- Leaked 7 70.0%
- Pending 3 30.0%
- Deleted 0 0.0%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Up checked 1h ago | yhgphvfgaecacgtlbn67u7yfhafe6evnj4gs4s2oyb3hzjnlhq45azqd.onion |
Top Activity Sectors (2)
Typical Attacks (8)
▼MITRE ATT&CK does not currently catalogue HYFLOCK, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v20.0. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: HYFLOCK executes malicious payloads through PowerShell scripts injected into legitimate system processes.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: HYFLOCK modifies Windows Registry Run keys to establish persistence across reboots.
What that means: Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: HYFLOCK disables Windows Defender and security tools by terminating processes and modifying service configurations.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1027.013 Encrypted/Encoded File Stealth
What they do: HYFLOCK encodes ransom notes and malicious binaries using custom XOR and Base64 encoding routines.
What that means: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection.
-
T1070.004 File Deletion Stealth
What they do: HYFLOCK deletes Volume Shadow Copies and backup directories via vssadmin and built-in file deletion commands.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1083 File and Directory Discovery Discovery
What they do: HYFLOCK uses file and directory discovery via PowerShell to enumerate critical system folders before encryption.
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1486 Data Encrypted for Impact Impact
What they do: HYFLOCK encrypts victim files using custom ransomware binaries targeting documents, images, and backups.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: HYFLOCK inhibits system recovery by corrupting restore points and disabling backup services.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (10)
Search, filter and paginate the victim timeline for HYFLOCK. Showing 1–10 of 10.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | gabonmeca.com leak incident id35380 View details | Gabon | Services | pending | ||
|
gabonmeca.com leak incident ████████ Corp |
||||||
| Ransomware | dangvuongcac id35381 View details | Viet Nam | Other | pending | ||
|
We got their hotel room info and all kinds of chat records.,,dangvuongcac.com (commonly called Teng Wang Ge or Tengwang Pavilion in Chinese) is a very well-known large-scale, male-oriented high-end entertainment club, spa massage, and KTV group in Ho Chi Minh City, Vietnam. In the Chinese 'experienced insider' circles and the local nightlife scene, it’s often referred to as the 'Vietnam Dragon Palace' or as part of the 'Yueyang Tower/Yueyang Tower system' (Hệ Thống Nhạc Dương Lầu). Here’s a brief overview of the company’s background and main business: 1. Business Nature and Positioning It’s not an ordinary massage or wellness shop. It’s a high-end, male-focused comprehensive adult nightlife venue (Empire of Nightlife). Its main offering isn’t purely physical therapy, but more of a ‘pro’ project that emphasizes socializing, partying, and entertainment. 2. Core Services • High-end Spa/Massage: Offers advanced, entertainment-oriented massage packages including Thai, essential oil, Nuru (sliding bed), and some premium rooms include bathing with staff. • Pool Party: This is a signature feature, with large indoor luxury spa pools and special pools with artificial rain, supporting multi-person pool parties. • Tech KTV (Karaoke): The venue offers multi-dimensional KTV rooms with cyberpunk or futuristic tech styles, combining dining and singing. Some netizens consider it the top-tier setup in Ho Chi Minh nightlife. 3. Venue Size and Location • Address: Located in the Trung Son area of Binh Chanh District, Ho Chi Minh City (Address: 20 Đường số 6A, Khu dân cư Trung Sơn, Bình Chánh, Thành phố Hồ Chí Minh). While administratively in Binh Chanh, it’s very close to the Chinese-dense districts 5 and 7 (Phu My Hung), with very convenient transport. • Staff Size: Officially claims to have over 400 trained young female technicians (KTV/Kỹ thuật viên) in its system. • Opening Hours: Daily from 9:00 AM to 5:00 AM the next day. 4. Clientele and Marketing The club mainly targets foreign tourists (especially Chinese visitors from Mainland China, Taiwan, and Hong Kong) and local high-spending customers. Since its management and customer service team are very familiar with the Chinese market, it has a highly visible marketing presence on WeChat, Telegram, Zalo, and TikTok, providing fully Chinese-speaking customer service for bookings and orders. |
||||||
| Ransomware | YYC Advisors id33838 View details | Canada | — | leaked | ||
|
YYC Advisors (YYC Group) is a long-established local accounting and comprehensive business consulting group in Malaysia, focusing on a "one-stop" service for tax + audit + business advisory. It mainly serves SMEs and growing companies and also deals with cross-border expansion, M&A succession, and digital software. 1. Basic Overview Founded: 1974, by Yap Seong Fatt, starting from a single table in Pudu, Kuala Lumpur Headquarters: No.32 & 34, Lorong Thambi 2, off Jalan Brunei, 55100 Kuala Lumpur, Malaysia; Phone: +603‑9078‑2868 Size: According to the official site, 1,100+ employees, serving 20,000+ clients, conducted 7,000+ training sessions; offices cover major Malaysian cities like Kuala Lumpur, Selangor, Penang, Johor Bahru, as well as Singapore, and some sources mention Hong Kong Position: One of the top ten local accounting firms in Malaysia, with a focus on the SME market Capital background: In 2019, OCBC Bank invested in its non-audit business; later, it reached a strategic investment/growth partnership with Singapore's SeaTown Private Capital for professional services M&A expansion in Southeast Asia Website: yycadvisors.com 2. Core Services (by line) Tax: Corporate/personal tax compliance and planning, SST, transfer pricing, tax audits and investigation responses, Malaysia e-invoicing (MyInvois/e-Invoice) implementation Audit & Accounting: YYC & Co PLT licensed audit; outsourced bookkeeping, cloud accounting (Xero, etc.), financial statements, payroll outsourcing Corporate & Business Advisory: Company registration/company secretary, M&A, deal structuring, financial due diligence, business valuation, IPO support, internal audit, market research, business succession Digital Software: emplX (HR/payroll cloud), Smart New Retail (retail/F&B POS), cloud ERP related Training & Membership: Winning Strategy Academy, taxPOD (tax subscription/live streaming/micro-courses), for business owners and finance professionals ...,We've handled a total of 300GB of data, and here we show 6GB as proof. For the rest of the data, please explain your purpose and DM us to discuss |
||||||
| Ransomware | Cooper Tec Solutions id33839 View details | Brazil | — | leaked | ||
|
Cooper Tec Solutions is a Brazilian company that provides industrial heating and combustion system solutions all across Brazil. We got a lot of their data |
||||||
| Ransomware | nodhom.com id33840 View details | Saudi Arabia | — | leaked | ||
|
Nodhom - Company Profile Nodhom is an unfunded company based in Riyadh (Saudi Arabia), founded in 2015, it is owned by a private entity named Ettesaq Ltd (https://www.ettesaq.com/). It operates as a Cloud based ERP software provider for SMBs. Nodhom has not raised any funding yet. The company has 3958 active competitors, including 58 funded and 162 that have exited. Its top competitors include companies like Workday, Oracle and SAP. Company Details Cloud based ERP software provider for SMBs. It brings together accounting, inventory, order management, procurement, HR, and more for enhanced business decisions. It allows users to manage reports, dashboard overviews, record history, system set up management, integrations, and etc. It enables user access to a subscription based pricing module. Website nodhom.com (http://nodhom.com/) Founded Year 2015 Location Riyadh, Saudi Arabia (https://tracxn.com/d/geographies/saudi-arabia/___pcaRzSx7V6lM1peTKubyaIgeBwBLDSZ-hRILoZ2k4g) Head Office: Ettesaq Company Ltd. | Palms Square, Riyadh 13322 - 3816, Saudi Arabia Contacts: WhatsApp (https://api.whatsapp.com/send?phone=966550815509&text=.) Phones: +966 55 081 5509 +966 11 243 0001 Email: [email protected] Website Contact page: https://nodhom.com/contact-us/ LinkedIn: https://www.linkedin.com/showcase/nodhom Twitter: https://twitter.com/nodhom YouTube: https://www.youtube.com/channel/UCDrztOStYh6r-8XsNyH0jrw |
||||||
| Ransomware | IGPL id33841 View details | Nigeria | — | pending | ||
|
Company Profile & Core Business • Overview: Established in 1988 and headquartered in Mumbai, India, IGPL operates its core manufacturing facility within the Taloja chemical industrial corridor in Maharashtra. The company is a publicly traded, international petrochemical products manufacturer listed on both the National Stock Exchange of India (NSE) and the Bombay Stock Exchange (BSE). • Core Products: The company primarily specializes in the production of Phthalic Anhydride (PAN). Leveraging economies of scale, it also recovers valuable by-products such as Maleic Anhydride and Benzoic Acid, and further extends its downstream value chain to manufacture plasticizers like Di-Ethyl Phthalate (DEP). Industry Influence • Market Dominance: IGPL stands as India's largest single-site Phthalic Anhydride (PAN) producer, commanding a massive domestic market share of approximately 50%. Its Taloja complex is also recognized as one of the largest single-location PAN manufacturing facilities globally, boasting an annual production capacity of 270,000 Metric Tonnes Per Annum (MTPA). • Critical Supply Chain Link: Phthalic Anhydride serves as an indispensable chemical intermediate in the industrial value chain. IGPL's products are widely supplied to leading global and domestic manufacturers across dozens of backbone industries, including paints, coatings, plastics, flexible PVC, unsaturated polyester resins (UPR), automotive components, construction chemicals, and fragrances. Beyond dominating the Indian market, the company exports to international markets, exerting a strong global supply chain presence. Financial Performance & Annual Revenue According to the latest financial disclosures: • Annual Revenue: IGPL's annual total revenue consistently ranges between INR 20.7 billion and INR 22.3 billion (approximately USD 210 million to USD 270 million). • Recent Revenue Trends: As of 2026, its trailing twelve months (TTM) rolling total revenue sits at approximately INR 20.73 billion (around USD 247 million). The company's top-line performance exhibits cyclical patterns, highly influenced by fluctuations in international chemical raw material prices (specifically Orthoxylene) and global supply chain demand. • Profitability: The company has maintained a net profit margin of around 3.94% over the past 12 months, with its current market capitalization valued between INR 17.4 billion and INR 17.6 billion. |
||||||
| Ransomware | ocean beverages id33842 View details | India | — | leaked | ||
|
Ocean Beverages is part of India's Ocean Drinks Private Limited. In the fiscal year 2025, it had annual revenue of about 936 crore INR, up 12.33% from the previous year. Founded in 2015, the company focuses on healthy functional drinks like low-sugar flavored waters, plant-based energy drinks, and natural sodas. For more info, check out oceanbeverages.in. |
||||||
| Ransomware | tdotnet id33843 View details | — | — | leaked | ||
|
T Dot Net is a local broadband internet service provider (ISP) operating in Bangladesh, primarily serving areas in Jhikargacha, Jessore (such as Fatepur and Narangali Bazaar). Service Details Core Services: High-speed home and corporate broadband internet, Wi-Fi setups, and network troubleshooting Popular Packages: Offers budget-friendly tiers like 30 Mbps for ৳500/month and 70 Mbps for ৳525/month, alongside higher speeds up to 100 Mbps. Features: Includes unlimited access to Facebook and YouTube, FTP server access, and a dedicated client mobile app (developed by SoftifyBD) for managing accounts and paying bills via bKash (https://play.google.com/store/apps/details?id=com.softifybd.tdotnet) |
||||||
| Ransomware | Ecuador police headquarters id33844 View details | Ecuador | — | leaked | ||
|
The Command of the National Police of Ecuador (Comandancia General de la Policía Nacional) is the country's top-level police administrative and command center. Here’s a breakdown of the key details: 🏢 Basic Info & Location • Headquarters Address: Av. Río Amazonas N36-152, Quito 170135, Ecuador (located on the main avenue, Amazonas Avenue, in the capital city, Quito). • Supervising Body: Directly under the Ministry of Interior of Ecuador, responsible for nationwide internal security and public order. • Official Website: Policía Nacional del Ecuador 🏛️ Core Organization & Department Structure Inside the General Command, there are multiple national-level core police and criminal investigation departments: 1. Top Command Layer (Mando Institucional): Led by the General Commander, with Deputy General Commander, Chief Inspector General, and directors in charge of public security, education, finances, and other areas. 2. Criminal Investigations Department: This is the headquarters' main operational unit, responsible for investigating major crimes, organized crimes, and cross-border crimes nationwide. 3. INTERPOL Quito National Central Bureau (NCB Quito): Located within the Criminal Investigations Department at the HQ, it provides 24/7 global intelligence connectivity, real-time access to INTERPOL databases, and leads nationwide cross-border wanted cases and law enforcement. |
||||||
| Ransomware | merkezilac_archives id33845 View details | Türkiye | — | leaked | ||
|
It is not a retail pharmacy, but a well-known large-scale comprehensive pharmaceutical and hygiene/disinfection product manufacturer with nearly a century of history. Here’s a detailed introduction about the company: 🏢 Company Background and Scale • Founded: Established in 1934, it is one of the oldest local pharmaceutical factories in modern Turkey, with 100% Turkish capital. • Production Base: Its modern central laboratory and factory are located in Çekmeköy, Istanbul, Turkey, with high-standard closed production workshops covering an area of 7,000 square meters. • Certification Standards: Production is fully supervised by the Turkish Ministry of Health (T.C. Sağlık Bakanlığı) and has passed a series of international certifications including cGMP (current Good Manufacturing Practice), cGLP (Good Laboratory Practice), ISO 9001, and ISO 13485 (Medical Device Quality Management System). 🧪 Core Products and Business Merkez İlaç follows its iconic slogan “#sağlıkiçinhijyenşart” (Hygiene is a prerequisite for health) and is the leader in Turkey for first aid, skin care, and disinfection products, with the most complete product categories and extremely high market share: 1. Disinfection and Anti-infection Series (core products): • Produces various professional and consumer skin disinfectants, hand sanitizers, anti-infection foams, surgical wipes, and wound cleansers (common brands include Opakjel and İsosol series). 2. Over-the-Counter (OTC) Medicines and Ointments: • Produces skin ointments and creams, such as İhtamol ointment, Starbaz cream, İsosol ointment, Vitamin E, and baby diaper rash cream (Pişik Kremi) for skin care, burns, and eczema. 3. First Aid and Medical Consumables: • It is the first and only company in the Turkish pharmaceutical industry to legally produce standardized first aid kits (Hızır medical kits, covering earthquakes, home, car, and industrial scenarios) and household/commercial medicine boxes. 4. Contract Manufacturing (CMO): • In addition to its own brand, it also manufactures tablets, capsules, sprays, drops, liquids, and semi-solid ointments for over 50 global and local pharmaceutical companies. 🌍 Industry Influence The company’s service network is extremely extensive, directly supplying products to over 3,000 local pharmacists and more than 9,500 hospitals and clinics in Turkey, and exporting to multiple overseas countries. In international humanitarian aid (such as Red Crescent supplies and earthquake donations), it is also a major provider of medical supplies and surgical/first aid consumables in Turkey. |
||||||