Ransomware Group
Curious worm
Known victims9Distinct claims on its leak site, one per victim and day, as ransomware.live publishes them. A claim is not proof of a compromise.First claim2026-11-11Latest claim2026-11-11
Claims, last 30 days
9
Previous 30 days: 0
More than the 30 days beforeMore or fewer when the change is at least 3 claims and a quarter of the previous 30 days; otherwise close.
Data as of 2026-11-12 13:56Z
Get an alert if one of your domains is named on a ransomware leak site.
Monitor your domainsFree account · up to 5 monitored targets
Known infrastructure
The following Tor hidden services have been associated with this group:
hhevzhgcokx6xlzh4o4exuo2kryy6ectpb7trm5ut2g3u4trskptv7ad.onion
These sites are malicious. Open them only from an isolated environment.
Who Curious worm targets
Share of its claims, through 2026-11-11.
Targeted sectors
- 01Healthcare4 claims44 %
- 02Business services2 claims22 %
- 03Manufacturing1 claim11 %
- 04Technology1 claim11 %
Not specified1 claim11 %
Targeted countries
- 01USUnited States4 claims44 %
- 02CACanada1 claim11 %
- 03GBUnited Kingdom1 claim11 %
- 04IEIreland1 claim11 %
- 05SASaudi Arabia1 claim11 %
Not specified1 claim11 %
Check if you’re affected
Look up your domain to see whether it appears on Curious worm’s victim list.
Try it nowFree⌘K
Try
risk score · threat categories · sources · age · confidence — in one request