Ransomware group profile ยท #153 by claimed victims
Netwalker ransomware
NetWalker ransomware group operates by the threat actor known as "CIRCUS SPIDER". The NetWalker ransomware was discovered in 2019. The group mainly targeting the Asia Pacific region but can attack globally. The group uses common attacking tools like Mimikatz and other legitimate tools (LOLBINS) like PSTools, AnyDesk, TeamViewer, NLBrute, and more. The group knowing by targeting the healthcare sector. Finally, in January 2021, Netwalker was takedown by the authorities, the police have confiscated hundreds of thousands of dollars in ransom payments collected by the Netwalker group, and they seized servers and disrupted the infrastructure and the darknet websites of the Netwalker ransomware group.
Victimology
Who Netwalker claims to have breached, from 26 leak-site posts recorded by VULONE.
Claims per month last 12 months
Top sectors
Top countries
Latest claimed victims 12 most recent
| Victim | Sector | Country | Claimed |
|---|---|---|---|
| Nygard International | Retail & E-Commerce | CA | 12 Dec 2020 |
| CSAT Solutions | Technology | - | 1 Dec 2020 |
| Enel Group | Energy & Utilities | - | 19 Oct 2020 |
| KYB Corporation | Manufacturing | US | 1 Oct 2020 |
| Wilmington Surgical Associates | Healthcare | US | 1 Oct 2020 |
| Equinix | Technology | US | 7 Sep 2020 |
| K-Electric (electric utility supplier) | Energy & Utilities | PK | 7 Sep 2020 |
| Cygilant (threat detection cybersecurity company) | Technology | - | 1 Sep 2020 |
| Jands | Manufacturing | AU | 1 Sep 2020 |
| Direccion Nacional de Migraciones (Argentina's official immigration agency) | Government & Defense | AR | 27 Aug 2020 |
| Entrust Energy | Energy & Utilities | US | 5 Aug 2020 |
| Olympia House (Petaluma) | Healthcare | US | 1 Aug 2020 |
All 26 Netwalker victims, searchable
Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.
Tactics, techniques and procedures
ATT&CK technique mapping for Netwalker is in progress. Victimology, infrastructure status and leak-site tracking are live above.
Indicators, detections and the full playbook
Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.
Frequently asked
Is Netwalker ransomware still active?
How many victims has Netwalker claimed?
Which industries does Netwalker target?
Which countries are most affected by Netwalker?
Where does VULONE get Netwalker victim data?
Other ransomware groups
Qilin
Lockbit3
Akira
ClopVictim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 31 October 2026. Questions or corrections: research@vulone.com.
