Ransomware group profile · #310 by claimed victims

Insane ransomware

Insane is a short-lived ransomware group that briefly surfaced in early 2024, claiming a single victim in Thailand before going quiet, with minimal documented activity or technical details available.

Active First seen Jan 2024

1Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

1Countries hit

0Leak-site URLs tracked

17 Jan 2024Latest claim recorded

Victimology

Who Insane claims to have breached, from 1 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Healthcare1

Top countries

Thailand1

Latest claimed victims 1 most recent

Victim	Sector	Country	Claimed
JspPharma	Healthcare	TH	17 Jan 2024

All 1 Insane victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Insane is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Insane ransomware still active?

Insane is tracked as active. The most recent leak-site claim VULONE recorded is dated 17 January 2024.

How many victims has Insane claimed?

VULONE has recorded 1 leak-site victim claims attributed to Insane since January 2024, across 1 countries and 1 sectors.

Which industries does Insane target?

The sectors most often named on the Insane leak site are Healthcare.

Which countries are most affected by Insane?

Most Insane victims recorded by VULONE are located in Thailand.

Where does VULONE get Insane victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

VULONE research mentioning Insane

QUAKE3, The XSS Moderator Who Wrote REvil

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].