Ransomware group profile · #200 by claimed victims

Teamxxx ransomware

TeamXXX is an emerging ransomware group that launched its leak site in June 2025, claiming victims across healthcare, agriculture, hospitality, financial services, and shipping sectors in the US, UK, Norway, Ireland, and Europe within its first months.

Active First seen Jun 2025

12Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

8Countries hit

1Leak-site URLs tracked, 0 online

4 Aug 2025Latest claim recorded

Victimology

Who Teamxxx claims to have breached, from 12 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Healthcare4

Retail & E-Commerce2

Transportation2

Professional Services1

Financial Services1

Hospitality1

Agriculture and Food Production1

Top countries

United States3

United Kingdom2

Czechia1

Germany1

Hong Kong1

Ireland1

Norway1

Sweden1

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
Scania.com scania.com	Transportation	SE	4 Aug 2025
Intercommunityct.org intercommunityct.org	Healthcare	US	12 Jul 2025
Websterhenry.com websterhenry.com	Professional Services	US	11 Jul 2025
Nationwidecare.org nationwidecare.org	Healthcare	GB	25 Jun 2025
aetoscapitalasia.com aetoscapitalasia.com	Financial Services	HK	22 Jun 2025
peterpauper peterpauper.com	Retail & E-Commerce	US	10 Jun 2025
interiorsgroup.ie interiorsgroup.ie	Retail & E-Commerce	IE	10 Jun 2025
narvikhavn.no narvikhavn.no	Transportation	NO	10 Jun 2025
event-medical.com event-medical.com	Healthcare	CZ	10 Jun 2025
ationwidecare.org ationwidecare.org	Healthcare	GB	10 Jun 2025
webberrestaurantgroup.com webberrestaurantgroup.com	Hospitality	—	10 Jun 2025
BelkorpAg.com belkorpag.com	Agriculture and Food Production	DE	10 Jun 2025

All 12 Teamxxx victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Teamxxx is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Teamxxx ransomware still active?

Teamxxx is tracked as active. The most recent leak-site claim VULONE recorded is dated 4 August 2025.

How many victims has Teamxxx claimed?

VULONE has recorded 12 leak-site victim claims attributed to Teamxxx since June 2025, across 8 countries and 7 sectors.

Which industries does Teamxxx target?

The sectors most often named on the Teamxxx leak site are Healthcare, Retail & E-Commerce, Transportation.

Which countries are most affected by Teamxxx?

Most Teamxxx victims recorded by VULONE are located in United States, United Kingdom, Czechia.

Where does VULONE get Teamxxx victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].