pear Ransomware
Also known as: Pure Extraction And Ransom · Tracked since Aug 5, 2025
0
victims recorded
0
in the last 30 days
0
CVEs
—
Last activity
Pure Extraction And Ransom (PEAR) Team is the community of highly responsible and strictly disciplined members. We are a private team and have nothing common with any other threat actors. We've been monitoring this field for a long-long time. So, we understand all the processes and know well how it all works.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
No CVE associated with this group in the sources.
Tactics and techniques (MITRE ATT&CK)
Initial Access
T1078 Valid AccountsT1566 Phishing Execution
T1059.001 Command and Scripting Interpreter: PowerShellT1204.002 User Execution: Malicious FileT1204.004 User Execution: Malicious Copy and Paste Persistence
T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder Defense Evasion
T1027.013 Obfuscated Files or Information: Encrypted/Encoded FileT1055.001 Process Injection: DLL Injection Credential Access
T1056.001 Input Capture: KeyloggingT1555.003 Credentials from Password Stores: Credentials from Web Browsers Collection
T1005 Data from Local SystemT1074 Data StagedT1114 Email CollectionT1213 Data from Information RepositoriesT1560.001 Archive Collected Data: Archive via Utility Exfiltration
T1041 Exfiltration Over C2 ChannelT1567 Exfiltration Over Web ServiceT1567.004 Exfiltration Over Webhook Command and Control
T1071.001 Application Layer Protocol: Web ProtocolsT1090.003 Proxy: Multi-hop Proxy Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live