onepercent Ransomware
0
victims recorded
0
in the last 30 days
0
CVEs
—
Last activity
OnePercent Group is a cybercriminal operation active since at least November 2020 that targeted US organizations using phishing with IcedID trojans, Cobalt Strike, and double-extortion, threatening a "one percent leak" of data before escalating to a full dump or sale to REvil; the FBI issued a formal flash advisory in August 2021.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
No CVE associated with this group in the sources.
Observed tools
Credential Theft
BetterSafetyKatz · Mimikatz · SharpKatz
Exfiltration
RClone
Offsec
Cobalt Strike · SharpSploit
Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live