Ms13089 / Ms13-089
| Active
MS13089 is a newly emerged ransomware group (first observed December 2025) that named itself after a 2013 Microsoft Security Bulletin, claiming a handful of victims including a law firm, operating primarily as a double-extortion actor.
Victims
5
First Victim
2025-12-18
(est. attack date)
Discovery Date
2025-12-18
Last Seen
2026-08-15
Inactive Since
4
days
Avg Delay
N/A
attack→claim
Infostealer
0.0%
victims with domain
Countries
5
hit
Uptime
97.6% avg (30d)
Attack Velocity — Last 12 months (based on attack estimated date if available)
1 victim this month
Known Locations (1)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
MS13-089 Blog | Yes | 2026-08-19T03:06:02 | nginx 1.24.0 |
msleakjir7pxbe6onlqe5uwgvdmy6nq4mnwfy7ojswbhnleenm77vgad.onion
|
Target
Top 5 Activity Sectors
- Professional Services 2
- Other 1
- Retail & E-Commerce 1
- Healthcare 1
Top 5 Countries
-
Chile
1
-
United States
1
-
Luxembourg
1
-
Italy
1
-
Germany
1
Heatmap
YARA Rules (1)
Indicators of Compromise (IoCs) (1)
Email
1
| Type | IOC |
|---|---|
Email
|
ms13@onionmail.org
|
Victims (5)
Empresa con más de 25 años de experiencia en el rubro marítimo, orientada a ejecutar operaciones con…
At Brittany Residential, Inc., we believe in creating a world where individuals with developmental d…
SJL is a high-end independent business law firm renowned for its savoir faire and reliability. The f…
Aree di specializzazione: contabilità, bilanci, dichiarazioni fiscali, incarichi di sindaco e reviso…
