File · aware · Crime · ransomware.live · refreshed 2026-10-06 · on the wire
aware
sigil · no ATT&CK coverage stated
Last 30 days
last seen 11 d agoWhat changed
ledger · newest first- —16 d agonew CVE2 new CVEs: CVE-2026-88771, CVE-2026-88772
- —1 mo agonew CVE1 new CVE: CVE-2026-87491
Analyst brief
ransomware.liveAware is a recently emerged ransomware group that operates a Tor-based data leak site with very limited public documentation and no publicly catalogued victims, tools, or TTPs in major threat intelligence databases.
CVEs reports attribute to aware
2 on CISA KEV- CVE-2026-88771KEVEPSS 1.3% · 2026-09-30
“CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30) Unit 42 is aware”
attributed by a report · named nearby · source: our dispatch · 2026-09-30
- CVE-2026-88772KEVEPSS 1.3% · 2026-09-30
“CVE-2026-88772 Exploited in the Wild (Updated September 30) Unit 42 is aware”
attributed by a report · named nearby · source: our dispatch · 2026-09-30
Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.
Named alongside aware only
| CVE | Status | EPSS |
|---|---|---|
| CVE-2026-87491 | named |
These CVEs appeared in the same dispatches as aware. That is an association in reporting, not a claim that this group used them — read the dispatch, then the vendor advisory, before you treat it as either.
On the wire
1 dispatch · newest firstTake it with you
keyless · no signupReferences
1 sourceTrack aware on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.