File · metaencryptor · Crime · ransomware.live · refreshed 2026-10-06 · on the wire
metaencryptor
sigil · no ATT&CK coverage stated
Last 30 days
last seen 21 d ago- seen against
- United States · Indonesia · Japan · South Korea
- sectors
- Manufacturing · Healthcare · Technology · Energy & Utilities · Professional Services
What changed
ledger · newest first- —17 d agovictimsvictim count 22 → 24 (+2)
- —24 d agovictimsvictim count 11 → 22 (+11)
- —1 mo agovictimsvictim count 7 → 11 (+4)
- —1 mo agoresurfacedback on the wire after 15 quiet days
Analyst brief
ransomware.liveMetaEncryptor is a ransomware group first observed in mid-2023, targeting medium-to-large enterprises in legal, technology, logistics, manufacturing, and finance sectors primarily in the UK, Europe, and Southeast Asia, using AES-256/RSA-2048 encryption and double extortion.
Observed targets (as stated by the sources)
7 countries · 9 sectorsassessed originnot stated by sourcesobserved targets · 7
countries · 7
- United States
- Japan
- South Korea
- Canada
- Indonesia
- Singapore
- Germany
sectors · 9
- Manufacturing
- Healthcare
- Professional Services
- Technology
- Energy & Utilities
- Other
- Government & Defense
- Agriculture and Food Production
- Transportation
as stated by MISP galaxy / ransomware.live — not inferred
Victims
leak-site listings via ransomware.live| Victims observed | First observed | Last observed on leak site | Lifetime rate | Last 30 days |
|---|---|---|---|---|
| 24 | ≈ 24.0 / month | below the lifetime rate 10 |
- Victims observed
- 24
- First observed
- Last observed on leak site
- Lifetime rate
- ≈ 24.0 / month
- Last 30 days
- below the lifetime rate 10
lifetime rate = victims ÷ months from first to last observed · ▲ above that rate is worse · a quiet leak site says nothing about the crew
On the wire
1 dispatch · newest firstTake it with you
keyless · no signupReferences
1 sourceTrack metaencryptor on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.