About VULONE
VULONE is an independent threat intelligence outfit tracking ransomware and extortion groups: the active crews, their operators, and the infrastructure behind them.
We started VULONE because mainstream threat intel goes a mile wide and an inch deep. The big platforms catalog everything and explain little, especially the smaller and newer extortion groups that don't get headline coverage until after they've hit someone. We go the other way, with fewer actors, followed closely, and the work shown.
Founded by Walless Al Essa and Adem El Adeb, VULONE is built on primary research. We trace aliases across forums and leak sites, map group infrastructure, and publish attribution with our confidence stated plainly rather than dressed up as certainty.
How we work
Depth over breadth. We'd rather know a handful of groups cold than skim hundreds.
Evidence, with confidence stated. Every link we draw carries a grade. We tell you what's confirmed, what's probable, and what's still a lead, and we never present inference as fact.
Attribution done carefully. Naming the wrong person or the wrong crew does real harm. We separate what an actor did from who they are, and we hold that line.
What we cover
Our research follows active ransomware and extortion operations, with an emphasis on the actors and infrastructure others overlook. Read our published research to see how we work before you decide whether it's useful to you.
