Ransomware group profile · #190 by claimed victims

Weyhro ransomware

Weyhro is a data-extortion group (relying on data theft and leak threats without file encryption) that launched a Tor leak site in March 2025, focusing on manufacturing, financial services, and real estate sectors with victims in the US, Italy, and Canada.

Active First seen Mar 2025

14Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

5Countries hit

4Leak-site URLs tracked, 1 online

11 Aug 2025Latest claim recorded

Victimology

Who Weyhro claims to have breached, from 14 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Manufacturing5

Professional Services4

Financial Services2

Technology1

Government & Defense1

Top countries

United States10

Barbados1

Canada1

Germany1

Italy1

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
Community Services of Missouri dwiprograms.com	Government & Defense	US	11 Aug 2025
Chemtron RiverBend crbwater.com	Manufacturing	US	11 Aug 2025
Synergy Investments synergyboston.com	Financial Services	US	31 May 2025
Terra Caribbean terracaribbean.com	Professional Services	BB	31 May 2025
Adriatic Glass & Mirrors adriaticglass.com	Manufacturing	CA	31 May 2025
101 Arch Street 101archstreet.info	Not Found	US	8 May 2025
Valens Bank/Pay/Exchange valens-exchange.com	Financial Services	DE	31 Mar 2025
McMillan James Equipment Company (MJEC) mjec.com	Manufacturing	US	25 Mar 2025
Montgomery Little & Soran, PC montgomerylittle.com	Professional Services	US	25 Mar 2025
Central Electropolishing Company, Inc. celcoinc.com	Manufacturing	US	6 Mar 2025
Resnick & Caffrey, PC resnickandcaffreypc.com	Professional Services	US	6 Mar 2025
Avantune Corporation avantune.com	Technology	US	6 Mar 2025

All 14 Weyhro victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Weyhro is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Weyhro ransomware still active?

Weyhro is tracked as active. The most recent leak-site claim VULONE recorded is dated 11 August 2025.

How many victims has Weyhro claimed?

VULONE has recorded 14 leak-site victim claims attributed to Weyhro since March 2025, across 5 countries and 6 sectors.

Which industries does Weyhro target?

The sectors most often named on the Weyhro leak site are Manufacturing, Professional Services, Financial Services.

Which countries are most affected by Weyhro?

Most Weyhro victims recorded by VULONE are located in United States, Barbados, Canada.

Where does VULONE get Weyhro victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].