Ransomware group profile · #179 by claimed victims

Redransomware ransomware

Red Ransomware (Red CryptoApp) emerged in early 2024, debuting its "Wall of Shame" data leak site with 11 victims across IT, legal, hospitality, manufacturing, and education sectors predominantly in the US, using phishing and vulnerability exploitation with double-extortion tactics.

Active First seen Mar 2024

16Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

9Countries hit

0Leak-site URLs tracked

12 Jun 2024Latest claim recorded

Victimology

Who Redransomware claims to have breached, from 16 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Technology5

Professional Services4

Manufacturing3

Financial Services1

Hospitality1

Healthcare1

Retail & E-Commerce1

Top countries

United States7

Mexico2

Spain1

Belgium1

Antigua & Barbuda1

Denmark1

Canada1

Singapore1

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
Kutes.com kutes.com	Retail & E-Commerce	TR	12 Jun 2024
Aircod.com aircod.com	Technology	MX	28 May 2024
Sullairargentina.com sullairargentina.com	Manufacturing	AG	17 May 2024
Targus.com targus.com	Professional Services	US	19 Apr 2024
K2systems.ca k2systems.ca	Technology	CA	28 Mar 2024
Sfi-wfc.com sfi-wfc.com	Financial Services	US	28 Mar 2024
Bendallmednick	Professional Services	US	28 Mar 2024
Comohotels.com comohotels.com	Hospitality	SG	28 Mar 2024
Aluminumtrailer.com aluminumtrailer.com	Manufacturing	US	28 Mar 2024
Southcoindustries.com southcoindustries.com	Manufacturing	US	28 Mar 2024
Kogok.com kogok.com	Professional Services	US	28 Mar 2024
Baystate.edu baystate.edu	Healthcare	US	28 Mar 2024

All 16 Redransomware victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Redransomware is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Redransomware ransomware still active?

Redransomware is tracked as active. The most recent leak-site claim VULONE recorded is dated 12 June 2024.

How many victims has Redransomware claimed?

VULONE has recorded 16 leak-site victim claims attributed to Redransomware since March 2024, across 9 countries and 7 sectors.

Which industries does Redransomware target?

The sectors most often named on the Redransomware leak site are Technology, Professional Services, Manufacturing.

Which countries are most affected by Redransomware?

Most Redransomware victims recorded by VULONE are located in United States, Mexico, Spain.

Where does VULONE get Redransomware victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].