Ransomware Group
Vortex
Known victims14Distinct claims on its leak site, one per victim and day, as ransomware.live publishes them. A claim is not proof of a compromise.First claim2026-11-10Latest claim2026-11-10
Claims, last 30 days
14
Previous 30 days: 0
More than the 30 days beforeMore or fewer when the change is at least 3 claims and a quarter of the previous 30 days; otherwise close.
Data as of 2026-11-10 13:34Z
Get an alert if one of your domains is named on a ransomware leak site.
Monitor your domainsFree account · up to 5 monitored targets
Known infrastructure
The following Tor hidden services have been associated with this group:
zyz6phauvraxghujxmecpwzlg34gtogybb4wzcmw6pvps5m2nzvsriid.onion
These sites are malicious. Open them only from an isolated environment.
Who Vortex targets
Share of its claims, through 2026-11-10.
Targeted sectors
- 01Healthcare7 claims50 %
- 02Manufacturing3 claims21 %
- 03Business services1 claim7 %
- 04Hospitality and tourism1 claim7 %
- 05Retail and consumer1 claim7 %
- 06Transportation and logistics1 claim7 %
Targeted countries
- 01USUnited States13 claims93 %
- 02DEGermany1 claim7 %
Check if you’re affected
Look up your domain to see whether it appears on Vortex’s victim list.
Try it nowFree⌘K
Try
risk score · threat categories · sources · age · confidence — in one request