Weyhro is a data-extortion group targeting manufacturing, financial services, and real estate without encryption.
Weyhro is a data-extortion crime group that emerged in March 2025, relying solely on data theft and leak threats without file encryption. The group primarily targets the manufacturing, financial services, and real estate sectors, with observed victims in the US, Italy, and Canada. Its main TTPs involve data exfiltration and public exposure threats via a Tor leak site, with no ransomware deployment. Defenders should focus on data loss prevention systems, network monitoring for exfiltration anomalies, and heightened vigilance in the targeted verticals.
Weyhro is a data-extortion group (relying on data theft and leak threats without file encryption) that launched a Tor leak site in March 2025, focusing on manufacturing, financial services, and real estate sectors with victims in the US, Italy, and Canada.
Weyhro is a data-extortion group that does not deploy ransomware tools, relying solely on data theft and leak threats without any file encryption.
The group primarily targets the manufacturing, financial services, and real estate sectors, with observed victims in the US, Italy, and Canada.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.