File · Emperador · Crime · ransomware.live · refreshed 2026-10-06 · on the wire
Emperador
sigil · no ATT&CK coverage stated
Last 30 days
last seen 8 d ago- seen against
- Brazil · Sweden · Turkey · United States · Germany
- sectors
- Manufacturing · Transportation · Government & Defense · Agriculture and Food Production · Healthcare
What changed
ledger · newest first- —10 d agovictimsvictim count 31 → 37 (+6)
- —17 d agovictimsvictim count 24 → 31 (+7)
- —24 d agovictimsvictim count 17 → 24 (+7)
- —1 mo agovictimsvictim count 11 → 17 (+6)
Analyst brief
ransomware.liveEmperador is an active ransomware/extortion group tracked on ransomware.live from the victims it lists on its public leak site.
Observed targets (as stated by the sources)
18 countries · 12 sectorsassessed originnot stated by sourcesobserved targets · 18
countries · 18
- Brazil
- United States
- Türkiye
- Sweden
- Italy
- India
- Trinidad and Tobago
- Mexico
- Germany
- Czechia
- Colombia
- Bosnia and Herzegovina
- Argentina
- South Korea
- Spain
- Vietnam
- Albania
- Philippines
sectors · 12
- Manufacturing
- Government & Defense
- Transportation
- Technology
- Agriculture and Food Production
- Other
- Professional Services
- Education
- Not Found
- Energy & Utilities
- Hospitality
- Healthcare
as stated by MISP galaxy / ransomware.live — not inferred
Victims
leak-site listings via ransomware.live| Victims observed | First observed | Last observed on leak site | Lifetime rate | Last 30 days |
|---|---|---|---|---|
| 37 | ≈ 18.5 / month | below the lifetime rate 18 |
- Victims observed
- 37
- First observed
- Last observed on leak site
- Lifetime rate
- ≈ 18.5 / month
- Last 30 days
- below the lifetime rate 18
lifetime rate = victims ÷ months from first to last observed · ▲ above that rate is worse · a quiet leak site says nothing about the crew
On the wire
4 dispatches · newest firstTake it with you
keyless · no signupReferences
1 sourceTrack Emperador on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.