Ransomware group profile · #77 by claimed victims

Settra ransomware

Settra is a ransomware operation tracked by VULONE since June 2026. Its leak site has named 94 victims since June 2026, 16 of them in the last 30 days. The group most often targets Technology, Professional Services, Manufacturing.

Active First seen Jun 2026

94Victims claimed on leak sites

16Victims in the last 30 days

63Victims in the last 90 days

24Countries hit

5Leak-site URLs tracked, 1 online

18 Oct 2026Latest claim recorded

Victimology

Who Settra claims to have breached, from 94 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Technology17

Professional Services16

Manufacturing12

Retail & E-Commerce11

Other7

Transportation7

Hospitality5

Healthcare4

Top countries

United States40

Germany8

United Kingdom6

Canada4

Brazil3

Australia3

Netherlands2

Norway2

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
www.marvinpac.com marvinpac.com	Manufacturing	US	18 Oct 2026
passavant-ee.com passavant-ee.com	Healthcare	EE	18 Oct 2026
acclaimcompanies.com acclaimcompanies.com	Professional Services	US	18 Oct 2026
binsky.com binsky.com	Not Found	-	18 Oct 2026
konsis.no konsis.no	Professional Services	NO	18 Oct 2026
monroeroadways.com monroeroadways.com	Transportation	US	18 Oct 2026
adapt-global.com adapt-global.com	Professional Services	-	18 Oct 2026
exo.inc exo.inc	Technology	US	18 Oct 2026
northshoresun.timesreview.com northshoresun.timesreview.com	Other	US	9 Oct 2026
windor.com windor.com	Not Found	-	5 Oct 2026
hollypoultry.com hollypoultry.com	Agriculture and Food Production	GB	2 Oct 2026
www.windor.com windor.com	Not Found	-	2 Oct 2026

All 94 Settra victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Settra is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Settra ransomware still active?

Settra is tracked as active. The most recent leak-site claim VULONE recorded is dated 18 October 2026. 16 victims were claimed in the last 30 days.

How many victims has Settra claimed?

VULONE has recorded 94 leak-site victim claims attributed to Settra since June 2026, across 24 countries and 12 sectors.

Which industries does Settra target?

The sectors most often named on the Settra leak site are Technology, Professional Services, Manufacturing.

Which countries are most affected by Settra?

Most Settra victims recorded by VULONE are located in United States, Germany, United Kingdom.

Where does VULONE get Settra victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 31 October 2026. Questions or corrections: research@vulone.com.