Ransomware group profile · #177 by claimed victims

Madliberator ransomware

MadLiberator is a ransomware group that emerged in mid-2024, known for erratic behavior including randomized ransom demands and unpredictable encryption patterns, targeting government entities including the Italian Ministry of Culture and using a data leak site to post exfiltrated files.

Active First seen Jul 2024

16Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

11Countries hit

0Leak-site URLs tracked

1 Oct 2024Latest claim recorded

Victimology

Who Madliberator claims to have breached, from 16 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Professional Services7

Technology2

Manufacturing2

Government & Defense2

Healthcare1

Financial Services1

Transportation1

Top countries

Spain4

Italy2

Netherlands1

Belgium1

United States1

United Kingdom1

Germany1

South Africa1

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
marthamedeiros.com.br marthamedeiros.com.br	Professional Services	BR	1 Oct 2024
ctelift.com ctelift.com	Professional Services	IT	6 Sep 2024
ych.com ych.com	Transportation	US	4 Sep 2024
awsag.com awsag.com	Technology	DE	17 Aug 2024
suandco.com suandco.com	Professional Services	KR	7 Aug 2024
msprocuradores.es msprocuradores.es	Professional Services	ES	6 Aug 2024
coinbv.nl coinbv.nl	Technology	NL	2 Aug 2024
orbinox.com orbinox.com	Manufacturing	—	25 Jul 2024
ORBINOX orbinox.com	Manufacturing	ES	24 Jul 2024
vrd.be vrd.be	Professional Services	BE	24 Jul 2024
VITALDENT vitaldent.com	Healthcare	ES	17 Jul 2024
BENICULTURALI.IT beniculturali.it	Government & Defense	IT	17 Jul 2024

All 16 Madliberator victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Madliberator is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Madliberator ransomware still active?

Madliberator is tracked as active. The most recent leak-site claim VULONE recorded is dated 1 October 2024.

How many victims has Madliberator claimed?

VULONE has recorded 16 leak-site victim claims attributed to Madliberator since July 2024, across 11 countries and 7 sectors.

Which industries does Madliberator target?

The sectors most often named on the Madliberator leak site are Professional Services, Technology, Manufacturing.

Which countries are most affected by Madliberator?

Most Madliberator victims recorded by VULONE are located in Spain, Italy, Netherlands.

Where does VULONE get Madliberator victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].