Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · frag · Crime · ransomware.live · refreshed 2026-10-06 · on the wire

frag

sigil · no ATT&CK coverage stated

Last 30 days

last seen 11 d ago
dispatch1
victims0
CVE seen1

What changed

ledger · newest first
  1. —10 d agoresurfacedback on the wire — nothing in the previous 30 days

Analyst brief

ransomware.live

Frag is a ransomware group that emerged in late 2024, exploiting a critical Veeam Backup & Replication vulnerability (CVE-2024-40711) to compromise targets in industrial sectors, with blockchain analysis linking it to a shared wallet cluster with the Akira group.

On the wire

1 dispatch · newest first
  1. GHSA-pqg4-j6r4-53mv: shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token

Take it with you

keyless · no signup

References

1 source
  1. 1.ransomware.live

Track frag on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.