Ransomware group profile · #223 by claimed victims

0Mega ransomware

0mega is a double-extortion ransomware group that emerged in May 2022, targeting businesses across multiple sectors worldwide by encrypting files and threatening to leak stolen data; it also pivoted to cloud-based extortion by compromising Microsoft 365 admin accounts.

Active First seen Jul 2022

7Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

1Countries hit

4Leak-site URLs tracked, 1 online

25 Jan 2024Latest claim recorded

Victimology

Who 0Mega claims to have breached, from 7 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Professional Services3

Healthcare2

Transportation1

Manufacturing1

Top countries

United States2

Latest claimed victims 7 most recent

Victim	Sector	Country	Claimed
Four Hands LLC fourhands.com	Professional Services	US	25 Jan 2024
Rotorcraft Leasing Company	Transportation	—	17 Oct 2023
US Liner Company & American Made LLC	Manufacturing	—	4 Oct 2023
Aviacode (GeBBS) gebbs.com	Healthcare	—	12 Feb 2023
Aviacode aviacode.com	Healthcare	—	9 Jan 2023
Nextlabs nextlabs.com	Professional Services	US	15 Sep 2022
Maxey Moverley	Professional Services	—	14 Jul 2022

All 7 0Mega victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for 0Mega is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is 0Mega ransomware still active?

0Mega is tracked as active. The most recent leak-site claim VULONE recorded is dated 25 January 2024.

How many victims has 0Mega claimed?

VULONE has recorded 7 leak-site victim claims attributed to 0Mega since July 2022, across 1 countries and 4 sectors.

Which industries does 0Mega target?

The sectors most often named on the 0Mega leak site are Professional Services, Healthcare, Transportation.

Which countries are most affected by 0Mega?

Most 0Mega victims recorded by VULONE are located in United States.

Where does VULONE get 0Mega victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].