Skip to content

Search Ransomware Intelligence

Jump to a group, country, industry or search victims.

InactiveRansomware group

0apt

As of Oct 19, 2026, 0apt lists 183 claims on its leak site. Many of the listed organisations could not be matched to a real incident, so these claims are shown for reference and left out of Brandefense statistics.

Unverified claims. This group's own description says the organisations on its leak site are chosen at random. Its claims are not counted in Brandefense statistics or rankings.

The group appears unreliable. Most, if not all, of its alleged victims cannot be verified and appear to be randomly selected organizations. WE HAVE DECIDED TO REMOVE ENTRIES FOR THIS GROUP

Is My Company Listed?Follow 0aptRequest IOC FeedTTPs, CVEs and malware →

Follow and IOC feeds are part of the Brandefense platform.

Claims Listed
183
Rank By Victims
Unranked
Last Leak-Site Post
Feb 4, 2026
Top Country
Unknown
Top Sector
Unknown

Victims Posted Per Month.

No data for this window right now.

Updated continuously · figures as of Oct 19, 2026

Latest 0apt Victims.

Search all 183 →
Latest confirmed leak-site victims claimed by 0apt
VictimCountryIndustryData claimedPosted
HCA Healthcare UK (Private Division)
hcahealthcare.co.uk
GBUnited KingdomHealthcareNot stated
Vestas Wind Systems (Denmark)
vestas.com
DKDenmarkEnergy and UtilitiesNot stated
Edwards Lifesciences (USA)
edwards.com
USUnited StatesHealthcareNot stated
Keysight Technologies (USA)
keysight.com
USUnited StatesTechnologyNot stated
Hologic, Inc. (USA)
hologic.com
USUnited StatesHealthcareNot stated
Galderma Pharma (Switzerland)
galderma.com
CHSwitzerlandHealthcareNot stated

How They Operate.

0apt's threat actor profile lists 6 ATT&CK techniques, 1 malware and tools, with its targets and related actors.

TTPs, CVEs and malware →

History.


  1. First seen in Brandefense data

  2. First confirmed victim listed on its leak site

  3. Most recent leak-site post

Get Real-Time Alerts, IOC Feeds And Takedowns.

The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.

Figures as of Oct 19, 2026. Confirmed leak-site claims collected by Brandefense technologies and validated by Brandefense analysts.

Listed on a leak site means a ransomware group has claimed the company; it is not a confirmed breach. To request a correction or removal, contact Brandefense.