← All ransomware groups

Ransomware group profile ยท #188 by claimed victims

Climax Inc ransomware

Climax Inc is a ransomware operation tracked by VULONE since November 2026. Its leak site has named 17 victims since November 2026, 17 of them in the last 30 days. The group most often targets Manufacturing, Other, Retail & E-Commerce.

Active First seen Nov 2026
17Victims claimed on leak sites
17Victims in the last 30 days
17Victims in the last 90 days
10Countries hit
0Leak-site URLs tracked
10 Nov 2026Latest claim recorded

Victimology

Who Climax Inc claims to have breached, from 17 leak-site posts recorded by VULONE.

Claims per month last 12 months

Dec 2025: 0DecJan 2026: 0Feb 2026: 0Mar 2026: 0MarApr 2026: 0May 2026: 0Jun 2026: 0JunJul 2026: 0Aug 2026: 0Sep 2026: 0SepOct 2026: 0Nov 2026: 17

Top sectors

Manufacturing3
Other3
Retail & E-Commerce3
Hospitality2
Professional Services1
Energy & Utilities1
Healthcare1
Technology1

Top countries

United States3
Japan2
India2
South Korea2
Nepal1
China1
Brazil1
Spain1

Latest claimed victims 12 most recent

VictimSectorCountryClaimed
Redacted Redacted Not Found - 10 Nov 2026
Nepal Electricity Authority nea.org.np Energy & Utilities NP 10 Nov 2026
Frolina Home frolinahome.com Retail & E-Commerce BR 10 Nov 2026
Mayur Group mayurgroup.com Manufacturing IN 10 Nov 2026
EMW emw.co.kr Not Found KR 10 Nov 2026
Maruki Medical Systems Inc. maruki-ms.co.jp Healthcare JP 10 Nov 2026
Zetton Inc. (Aloha Table Inc.) zetton.co.jp Hospitality JP 10 Nov 2026
MiraeING Co. miraeing.co.kr Other KR 10 Nov 2026
Double Star Industry Co., Ltd. doublestaricl.com Manufacturing CN 10 Nov 2026
Servicasa S.L. servicasareformas.com Other ES 10 Nov 2026
Emerging Display Technologies Corp edtc.com Technology US 10 Nov 2026
Futura (VF Distribution SAS) vf-distribution.fr Retail & E-Commerce FR 10 Nov 2026

All 17 Climax Inc victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Climax Inc is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Climax Inc ransomware still active?
Climax Inc is tracked as active. The most recent leak-site claim VULONE recorded is dated 10 November 2026. 17 victims were claimed in the last 30 days.
How many victims has Climax Inc claimed?
VULONE has recorded 17 leak-site victim claims attributed to Climax Inc since November 2026, across 10 countries and 9 sectors.
Which industries does Climax Inc target?
The sectors most often named on the Climax Inc leak site are Manufacturing, Other, Retail & E-Commerce.
Which countries are most affected by Climax Inc?
Most Climax Inc victims recorded by VULONE are located in United States, Japan, India.
Where does VULONE get Climax Inc victim data?
Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Qilin logoQilin2,485 victims Lockbit3 logoLockbit32,016 victims Akira logoAkira1,678 victims Clop logoClop1,366 victims Play1,349 victims Thegentlemen1,081 victims Lockbit21,002 victims Incransom993 victims

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 12 November 2026. Questions or corrections: research@vulone.com.