Ransomware Group
Obscura
Obscura is a ransomware strain observed in 2025, written in Go and specifically targeting Windows domain controllers via the SYSVOL/NETLOGON share, using Curve25519 + XChaCha20 encryption with double-extortion tactics and a 10-day payment deadline.
Known victims33
Threat level
MEDIUM
Get an alert if one of your domains is named on a ransomware leak site.
Monitor your domainsFree account · up to 5 monitored targets
Known infrastructure
The following Tor hidden services have been associated with this group:
Obscura Leaks Blog
These sites are malicious. Open them only from an isolated environment.
Check if you’re affected
Look up your domain to see whether it appears on Obscura’s victim list.
Try it nowFree⌘K
Try
risk score · threat categories · sources · age · confidence — in one request