Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Emperador

New Group | Active

This is an emerging group, so claims should be treated with caution until independently verified.
None

Victims
11
 
First Victim
2026-08-10
(est. attack date)
Discovery Date
2026-08-12
 
Last Seen
2026-09-05
 
Inactive Since
1
day
Avg Delay
1.5
days
Infostealer
100.0%
victims with domain
Countries
8
hit
Uptime
96.7% avg (30d)
View Victims on World Map View Group Statistics
Attack Velocity — Last 12 months (based on attack estimated date if available)
-90% vs last month

Known Locations (1)
Favicon Title Type Available Last Visit Server Info FQDN Status
favicon EMPERADOR Yes 2026-09-06T15:02:26 NGINX nginx emprdr4p7iwlhpky33tswt3k2qdeljyjcdpoysabudmmrz4z32laexad.onion

Target
Top 5 Activity Sectors
  • Government & Defense 3
  • Energy & Utilities 2
  • Technology 2
  • Other 1
  • Transportation 1
Top 5 Countries
  • BR flag Brazil 2
  • AR flag Argentina 1
  • KR flag Korea, Republic of 1
  • US flag United States 1
  • ES flag Spain 1

Heatmap

Vulnerabilities Exploited (5)
This information is provided by Ransomware-Vulnerability-Matrix & Ransomware.live
Vendor Product CVE Source
Check Point Security Gateway (IKEv1 improper auth) CVE-2026-50751
ConnectWise ScreenConnect (path traversal -> RCE) CVE-2024-1708
Microsoft Exchange (deserialization) CVE-2023-21529
Microsoft Windows (link following) CVE-2025-60710
Nx Nx Console (embedded malicious code) CVE-2026-48027

KQL Query (1)

Victims (11)
Logo
Discovered: 2026-09-05 (Yesterday)
The official website of the Judicial Branch of Jujuy, Argentina. It provides court information, digi…
Logo
Discovered: 2026-08-29 (8d ago)
full commitment of the network having full access to infrastructure, thus ensuring access to the dat…
Logo
Discovered: 2026-08-28 (9d ago)
The data contains really sensitive information from 4 PV projects looking for investment/financing o…
Logo
Discovered: 2026-08-27 (9d ago)
Yes, this data has been posted before by ME under a different alias, yes the individual that posted …
Logo
Discovered: 2026-08-27 (10d ago)
Capitol Mechanics , fresh databases, important docs [Size: 120.9 MB | Sector: Finance, Transportatio…
Logo
Discovered: 2026-08-23 (14d ago)
Recent databases, important documents [Size: 540.1 MB | Sector: Manufacturing]…
Logo
Discovered: 2026-08-22 (14d ago)
Vietnam Electricity (EVN), legally known as Tập đoàn Điện lực Việt Nam, is the largest power company…
Logo
Discovered: 2026-08-20 (16d ago)
NetExam (netexam.com) — the website of NetExam LMS+, a US-based SaaS learning management system buil…
Logo
Discovered: 2026-08-18 (19d ago)
We hold complete, unrestricted access to your internal infrastructure. All servers, databases, email…
Logo
Discovered: 2026-08-17 (20d ago)  ·  Attack est.: 2026-08-16
Albania’s official national teacher training portal provides centralized professional development re…
Logo
Discovered: 2026-08-12 (25d ago)  ·  Attack est.: 2026-08-10
The City Government of Baguio stands as one of the wealthiest and most prominent local governments i…