Ransomware Group intelligence
Securotrop
ActiveTrack Securotrop with 46 published victims and 1 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Securotrop is tracked by Breach House as a ransomware group with 46 published victims.
United States is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Down checked 5h ago | securo45z554mw7rgrt7wcgv5eenj2xmxyrsdj3fcjsvindu63s4bsid.onion |
Top Activity Sectors (11)
Typical Attacks (11)
▼MITRE ATT&CK does not currently catalogue Securotrop, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: securotrop executes malicious payloads via PowerShell scripts to stage ransomware operations on compromised hosts.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: securotrop modifies Windows Registry Run Keys to ensure malware persistence across reboots on infected systems.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: securotrop disables antivirus tools and security monitoring utilities to evade detection during ransomware deployment.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: securotrop deletes Volume Shadow Copies and backup directories via command-line utilities to prevent data recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1003.001 LSASS Memory Credential Access
What they do: securotrop accesses LSASS memory to steal credentials for privilege escalation and lateral movement.
What that means: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
-
T1018 Remote System Discovery Discovery
What they do: securotrop performs remote system discovery to map network topology and identify additional targets for lateral movement.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1135 Network Share Discovery Discovery
What they do: securotrop scans network shares using native tools to identify victim file directories for targeted encryption.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: securotrop exploits SMB/Windows Admin Shares to move laterally between networked machines within victim environments.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: securotrop encrypts victim files using strong symmetric cryptography to maximize disruption and ransom demand leverage.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1489 Service Stop Impact
What they do: securotrop executes service-stop commands to disable backup and recovery services during the encryption phase.
What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
-
T1490 Inhibit System Recovery Impact
What they do: securotrop terminates critical system services and processes to cripple recovery mechanisms before encryption completes.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (46)
Search, filter and paginate the victim timeline for Securotrop. Showing 1–46 of 46.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | ADL Embedded Solutions id31833 View details | United States | — | ||
|
Status: AWAITING Size: 925 GB |
|||||
| Ransomware | Lepi Enterprises id31728 View details | United States | Construction / Real Estate | ||
|
Lepi Enterprises operates in the construction and real estate sector in the United States, providing various services to its clients. As a company in this sector, it likely engages in activities such as property development, construction management, and real estate investment. Lepi Enterprises was listed as a ransomware victim associated with securotrop |
|||||
| Ransomware | Lepi Enterprises id31728 View details | United States | Construction / Real Estate | ||
|
Status: AWAITING Size: 692 GB |
|||||
| Ransomware | MAG USA Inc id31064 View details | United States | IT | ||
|
Magusainc.com operates in the IT sector, providing services to clients in the United States. As an IT company, Magusainc.com likely offers a range of technology-related services. Magusainc.com was listed as a ransomware victim associated with securotrop |
|||||
| Ransomware | MAG USA Inc id31064 View details | United States | IT | ||
|
Status: AWAITING Size: 1871 GB |
|||||
| Ransomware | Advantage Sintered Metals id30836 View details | United States | Other | ||
|
Advantagesintered.com is a company based in the United States, operating in the other sector. The company likely provides various services or products, although specific details about its offerings are not readily available. Advantagesintered.com was listed as a ransomware victim associated with securotrop |
|||||
| Ransomware | Advantage Sintered Metals id30836 View details | United States | Other | ||
|
Status: AWAITING Size: 503 GB |
|||||
| Ransomware | ProDirectional Drilling id30569 View details | United States | Transportation / Travel / Logistics | ||
|
Prodirectional is a US-based company operating in the transportation, travel, and logistics sector, providing services to facilitate movement of goods and people. The company is involved in directional services, likely supporting the efficient navigation and management of transportation routes. Prodirectional was listed as a ransomware victim associated with securotrop. |
|||||
| Ransomware | ProDirectional Drilling id30569 View details | United States | Transportation / Travel / Logistics | ||
|
Status: AWAITING Size: 4329 GB |
|||||
| Ransomware | Charisma Media id29856 View details | United States | Communication / Marketing | ||
|
Status: AWAITING Size: 808 GB |
|||||
| Ransomware | Kriete Truck Centers id29639 View details | United States | Transportation / Travel / Logistics | ||
|
Status: AWAITING Size: 221 GB |
|||||
| Ransomware | Thompson Builders Corporation id28866 View details | United States | IT | ||
|
Status: AWAITING Size: 3633 GB |
|||||
| Ransomware | Synergy Engineering id28701 View details | United States | Energy | ||
|
Status: AWAITING Size: 2111 GB |
|||||
| Ransomware | Tax Prep and More id28107 View details | United States | Finance / Legal / Insurance | ||
|
Status: AWAITING Size: 146 GB |
|||||
| Ransomware | Jones Haber Law id27742 View details | United States | Finance / Legal / Insurance | ||
|
Status: AWAITING Size: 524 GB |
|||||
| Ransomware | Universal Mailing Service id26684 View details | United States | Other | ||
|
Status: AWAITING Size: 490 GB |
|||||
| Ransomware | Marshal Renee Construction id26614 View details | United States | Construction / Real Estate | ||
|
Status: AWAITING Size: 1750 GB |
|||||
| Ransomware | Living Realty id25473 View details | Canada | Other | ||
|
Status: AWAITING Size: 2105 GB |
|||||
| Ransomware | Spartan Carbide id25014 View details | United States | Other | ||
|
Status: AWAITING Size: 149 GB |
|||||
| Ransomware | Cadman Power Equipment id24586 View details | Canada | Energy | ||
|
Status: AWAITING Size: 3042 GB |
|||||
| Ransomware | Delta Coast Consultants id24394 View details | United States | Other | ||
|
Status: AWAITING Size: 3051 GB |
|||||
| Ransomware | Mister Guns id24128 View details | United States | Other | ||
|
Status: AWAITING Size: 290 GB |
|||||
| Ransomware | Pocatello Ready Mix id23738 View details | United States | Other | ||
|
Status: AWAITING Size: 274 GB |
|||||
| Ransomware | Superior Air Parts id23285 View details | United States | Manufacturing / Engineering | ||
|
Status: AWAITING Size: 383 GB |
|||||
| Ransomware | Churchill Claims Services id22929 View details | United States | Services | ||
|
Status: AWAITING Size: 240 GB |
|||||
| Ransomware | Mill Bay Marine Group id22809 View details | Canada | Services | ||
|
Status: AWAITING Size: 536 GB |
|||||
| Ransomware | Structural Component Systems id22739 View details | United States | Services | ||
|
Status: AWAITING Size: 1219 GB |
|||||
| Ransomware | Allardyce Bower Consulting id22702 View details | Canada | Services | ||
|
Status: AWAITING Size: 2743 GB |
|||||
| Ransomware | Weschler's Auctioneers id22684 View details | United States | Other | ||
|
Status: AWAITING Size: 1429 GB |
|||||
| Ransomware | JW Howard Attorneys id22675 View details | United States | Finance / Legal / Insurance | ||
|
Status: AWAITING Size: 637 GB |
|||||
| Ransomware | Mitrani Rynor Adamsky & Toland id22492 View details | United States | Other | ||
|
Status: AWAITING Size: 2960 GB |
|||||
| Ransomware | VRE Systems id22173 View details | Canada | Services | ||
|
Status: PUBLISHED Size: 174 GB |
|||||
| Ransomware | Controlled Combustion id22172 View details | United States | Other | ||
|
Status: AWAITING Size: 1141 GB |
|||||
| Ransomware | TigerCommunications id21660 View details | United Kingdom | Communication / Marketing | ||
|
[AI generated] TigerCommunications is a UK-based company dedicated to providing specialized business communications analytics for various industries. It offers a range of services such as call logging, fraud detection, and systems integration. Their solutions help clients optimize communication infrastructure, control costs, improve productivity and ensure compliance. With over 30 years of experience, the company supports enterprises around the globe. |
|||||
| Ransomware | Budinger & Associates id21568 View details | United States | Construction / Real Estate | ||
|
[AI generated] Budinger & Associates is a consulting engineering company that specializes in geotechnical engineering, construction monitoring, environmental consultations, and mining and materials services. With its headquarters in Spokane Valley, Washington, the firm has over 40 years of experience and serves professionals in industries like infrastructure, construction, mining, and real estate. |
|||||
| Ransomware | Tiger Communications id21417 View details | United Kingdom | Communication / Marketing | ||
|
[AI generated] Tiger Communications is a UK-based company that specializes in providing telecoms analytics and call management solutions. They offer businesses insights into their telecommunications, whether it be for general analysis, cost reduction, or security purposes. Tiger's range of solutions includes real-time and historical reporting, CRM integration, fraud detection and prevention, and more. |
|||||
| Ransomware | FasseValves id21313 View details | United States | Agriculture / Food | ||
|
[AI generated] FasseValves is a leading provider of hydraulic solutions based in Sidney, Nebraska. The company specializes in designing and manufacturing multi-function remote hydraulic selectors. Their products allow for in-the-cab, push-button control of hydraulic functions, thereby enhancing the efficiency and safety of equipment operations. Founded in 1988, the company serves sectors like agriculture, construction, and many others. |
|||||
| Ransomware | Bronze Craft id21312 View details | United States | Energy | ||
|
[AI generated] Bronze Craft is a New Hampshire-based firm with a specialization in the design and manufacture of cast bronze window hardware. Since its establishment in 1945, the company has come to offer a comprehensive range of over 50,000 different types of precision cast and custom wrought products. It serves industries like timber windows, metal windows, and doors, among others. They also offer engineering and design services. |
|||||
| Ransomware | VRE Sytems id21304 View details | Canada | Communication / Marketing | ||
|
[AI generated] VRE Systems is a Canada-based company that specializes in designing and manufacturing custom and standard products for various industries, including horticulture, cannabis, retail garden centers, and livestock. Their products range from greenhouses, garden center retail carts, to livestock handling equipment. They prioritize offering solutions that optimize productivity and efficiency for their customers. |
|||||
| Ransomware | Titan Trailer Mfg id21303 View details | United States | Manufacturing / Engineering | ||
|
[AI generated] Titan Trailer Manufacturing, Inc. is a company based in North America that specializes in the design and production of high-quality trailers. They mainly create bulk commodity trailers and flatbeds. Their catalog incorporates different models suitable for various needs, ranging from agriculture and construction to commercial freight. Combining quality and strength, each Titan Trailer is designed for durability and efficiency. |
|||||
| Ransomware | SPG Construction id21302 View details | Switzerland | Construction / Real Estate | ||
|
[AI generated] SPG Construction is a specialized construction company that operates within a variety of sectors including industrial, commercial, and residential. The company offers a wide array of services covering different aspects of construction from initial design and planning to the final build. They are recognized for their high-quality work and commitment to client satisfaction, maintaining a solid reputation in the construction industry. |
|||||
| Ransomware | Nucamp RV id21301 View details | United States | Communication / Marketing | ||
|
[AI generated] Nucamp RV is an Ohio-based manufacturer of recreational vehicles (RVs) and teardrop trailers. Their RVs are known for their streamlined design, affordability, and functionality. Their product line includes models like the T@B teardrop, T@G teardrop, and Cirrus Truck Camper. The company prioritizes craftsmanship, aiming to offer lightweight, innovative, and quality camping solutions. |
|||||
| Ransomware | Moser Engineering id21300 View details | United States | Manufacturing / Engineering | ||
|
[AI generated] Moser Engineering is a renowned company recognized for manufacturing high-grade performance auto parts. Founded in 1986 in Portland, Indiana, it specializes in producing aftermarket axle and drivetrain components. Its product line includes axles, differential covers, rear ends, brake kits, and more. The company serves varied customers, including drag racing, muscle cars, street rods, hot rods, and vehicle restoration enthusiasts. |
|||||
| Ransomware | Great Lakes Wholesale Group id21299 View details | United States | Retail / E-commerce | ||
|
[AI generated] Great Lakes Wholesale Group is a wholesale distributor providing a wide variety of general merchandise to dollar stores, discount stores, and grocery stores. The company offers products across several categories including health & beauty, groceries, household, houseware, hardware, toys, party supplies, pet supplies and others. They offer goods at a lower price point and are based in Lockport, Illinois, USA. |
|||||
| Ransomware | Fasse Valves id21298 View details | United States | Communication / Marketing | ||
|
[AI generated] "Fasse Valves" is an American company that specializes in the design and manufacture of hydraulic valve systems. The company is renowned for their remote control products that fundamentally increase the productivity of hydraulic equipment. Their product line includes Multiplier valves, selector valves, remote valve control systems, and more, with applications in agricultural machinery, construction equipment, and industrial hydraulics. |
|||||
| Ransomware | BronzeCraft id21297 View details | United States | Communication / Marketing | ||
|
[AI generated] BronzeCraft is a leading manufacturer and distributor of high-quality, durable, and decorative bronze foundry cast products. The American-based company has been business since 1944, providing a wide range of products including window hardware, custom and specialty products. They use time-honored casting techniques and offer excellent customer service to meet the requirements of their diverse clientele. |
|||||