Ransomware group profile · #170 by claimed victims

Eclipse ransomware

Eclipse is a ransomware operation tracked by VULONE since August 2026. Its leak site has named 20 victims since August 2026, 9 of them in the last 30 days. The group most often targets Technology, Manufacturing, Other.

Active First seen Aug 2026

20Victims claimed on leak sites

9Victims in the last 30 days

20Victims in the last 90 days

8Countries hit

7Leak-site URLs tracked, 0 online

17 Oct 2026Latest claim recorded

Victimology

Who Eclipse claims to have breached, from 20 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Technology3

Manufacturing3

Other3

Transportation2

Professional Services2

Hospitality2

Healthcare2

Education1

Top countries

Singapore5

United States4

India4

Japan2

Brazil2

Italy1

France1

Taiwan1

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
PART2 Global AirFreight International globalair.com.sg	Transportation	SG	17 Oct 2026
Taiwan Otsuka Pharmaceutical otsuka.com.tw	Healthcare	TW	14 Oct 2026
japantimes.co.jp japantimes.co.jp	Other	JP	14 Oct 2026
dipecarr.com.br dipecarr.com.br	Manufacturing	BR	8 Oct 2026
simplexengg.in simplexengg.in	Manufacturing	IN	8 Oct 2026
sanjoseattorneys.com sanjoseattorneys.com	Professional Services	US	8 Oct 2026
DIPECARR dipecarr.com.br	Other	BR	8 Oct 2026
Global AirFreight International globalair.com.sg	Transportation	SG	8 Oct 2026
part02.simplexengg.in part02.simplexengg.in	Technology	IN	5 Oct 2026
The Japan Times japantimes.co.jp	Other	JP	30 Sep 2026
Dublin City Schools GA dublincityschools.us	Education	US	14 Sep 2026
Rosello et Fils rosello-fils.fr	Agriculture and Food Production	FR	14 Sep 2026

All 20 Eclipse victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Eclipse is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Eclipse ransomware still active?

Eclipse is tracked as active. The most recent leak-site claim VULONE recorded is dated 17 October 2026. 9 victims were claimed in the last 30 days.

How many victims has Eclipse claimed?

VULONE has recorded 20 leak-site victim claims attributed to Eclipse since August 2026, across 8 countries and 10 sectors.

Which industries does Eclipse target?

The sectors most often named on the Eclipse leak site are Technology, Manufacturing, Other.

Which countries are most affected by Eclipse?

Most Eclipse victims recorded by VULONE are located in Singapore, United States, India.

Where does VULONE get Eclipse victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 31 October 2026. Questions or corrections: research@vulone.com.