Raznatovic ransomware

RANSOMED.VC aka Raznatovic

Active First seen Dec 2023

5Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

1Countries hit

2Leak-site URLs tracked, 0 online

7 Jan 2024Latest claim recorded

Victimology

Who Raznatovic claims to have breached, from 5 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Education1

Energy & Utilities1

Transportation1

Professional Services1

Manufacturing1

Top countries

Cyprus2

Latest claimed victims 5 most recent

Victim	Sector	Country	Claimed
Flash-Motors Last Warning	Transportation	CY	7 Jan 2024
Regarding FM	Professional Services	CY	26 Dec 2023
TechKids aka MindX	Education	-	17 Dec 2023
SKF.com skf.com	Manufacturing	-	17 Dec 2023
Colonial Pipeline colonialpipeline.com	Energy & Utilities	-	17 Dec 2023

All 5 Raznatovic victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Raznatovic is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Raznatovic ransomware still active?

Raznatovic is tracked as active. The most recent leak-site claim VULONE recorded is dated 7 January 2024.

How many victims has Raznatovic claimed?

VULONE has recorded 5 leak-site victim claims attributed to Raznatovic since December 2023, across 1 countries and 5 sectors.

Which industries does Raznatovic target?

The sectors most often named on the Raznatovic leak site are Education, Energy & Utilities, Transportation.

Which countries are most affected by Raznatovic?

Most Raznatovic victims recorded by VULONE are located in Cyprus.

Where does VULONE get Raznatovic victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 31 October 2026. Questions or corrections: research@vulone.com.