Siegedsec ransomware

Not a ransomware group but a hacktivist group that appeared coincidentally days before Russia’s invasion of Ukraine

Active First seen Dec 2023

19Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

2Countries hit

1Leak-site URLs tracked, 0 online

9 Dec 2023Latest claim recorded

Victimology

Who Siegedsec claims to have breached, from 19 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Government & Defense8

Technology4

Retail & E-Commerce2

Healthcare2

Education1

Energy & Utilities1

Hospitality1

Top countries

Israel1

Kenya1

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
OpTransRights - 2	Healthcare	—	9 Dec 2023
Telerad	Healthcare	—	9 Dec 2023
Technical University of Mombasa tum.ac.ke	Education	KE	9 Dec 2023
National Office for centralized procurement	Government & Defense	—	9 Dec 2023
Portland Government & United states government portlandoregon.gov	Government & Defense	—	9 Dec 2023
Staples staples.com	Retail & E-Commerce	—	9 Dec 2023
Deqing County	Government & Defense	—	9 Dec 2023
Colombian National Registry	Government & Defense	—	9 Dec 2023
Idaho National Laboratory inl.gov	Energy & Utilities	—	8 Dec 2023
Operation Israel - 1	Government & Defense	—	8 Dec 2023
Cellcom cellcom.com	Technology	—	8 Dec 2023
Bezeq bezeq.co.il	Technology	IL	8 Dec 2023

All 19 Siegedsec victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Siegedsec is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Siegedsec ransomware still active?

Siegedsec is tracked as active. The most recent leak-site claim VULONE recorded is dated 9 December 2023.

How many victims has Siegedsec claimed?

VULONE has recorded 19 leak-site victim claims attributed to Siegedsec since December 2023, across 2 countries and 7 sectors.

Which industries does Siegedsec target?

The sectors most often named on the Siegedsec leak site are Government & Defense, Technology, Retail & E-Commerce.

Which countries are most affected by Siegedsec?

Most Siegedsec victims recorded by VULONE are located in Israel, Kenya.

Where does VULONE get Siegedsec victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].