Search Ransomware Intelligence
Jump to a group, country, industry or search victims.
Mad Liberator
As of Oct 19, 2026, Mad Liberator has listed 14 confirmed victims on its leak site since Jun 13, 2024, 0.0% of all victims tracked by Brandefense. Its most targeted country is Spain (21.4% of its victims) and its most targeted sector is Consulting.
MadLiberator is a ransomware group that emerged in mid-2024, known for erratic behavior including randomized ransom demands and unpredictable encryption patterns, targeting government entities including the Italian Ministry of Culture and using a data leak site to post exfiltrated files.
Follow and IOC feeds are part of the Brandefense platform.
- Confirmed Victims
- 14
- Rank By Victims
- #199
- Last Leak-Site Post
- Oct 1, 2024
- Top Country
- Spain
- Top Sector
- Consulting
Victims Posted Per Month.
| Month | Confirmed victims |
|---|---|
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| November 2025 | 0 |
| December 2025 | 0 |
| January 2026 | 0 |
| February 2026 | 0 |
| March 2026 | 0 |
| April 2026 | 0 |
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| June 2024 | 2 |
| July 2024 | 6 |
| August 2024 | 3 |
| September 2024 | 2 |
| October 2024 | 1 |
| November 2024 | 0 |
| December 2024 | 0 |
| January 2025 | 0 |
| February 2025 | 0 |
| March 2025 | 0 |
| April 2025 | 0 |
| May 2025 | 0 |
| June 2025 | 0 |
| July 2025 | 0 |
| August 2025 | 0 |
| September 2025 | 0 |
| October 2025 | 0 |
| November 2025 | 0 |
| December 2025 | 0 |
| January 2026 | 0 |
| February 2026 | 0 |
| March 2026 | 0 |
| April 2026 | 0 |
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
Latest Mad Liberator Victims.
Search all 14 →| Victim | Country | Industry | Data claimed | Posted |
|---|---|---|---|---|
| marthamedeiros.com.br marthamedeiros.com.br | BRBrazil | Retail | Not stated | |
| ctelift.com ctelift.com | ITItaly | Manufacturing, Construction | Not stated | |
| ych.com ych.com | INIndia | Consulting | Not stated | |
| awsag.com awsag.com | CHSwitzerland | Unknown | Not stated | |
| suandco.com suandco.com | ESSpain | Unknown | Not stated | |
| coinbv.nl coinbv.nl | NLNetherlands | Unknown | Not stated |
How They Operate.
Mad Liberator's threat actor profile lists 1 malware and tools, with its targets and related actors.
TTPs, CVEs and malware →Who Mad Liberator Targets.
History.
First confirmed victim listed on its leak site
Busiest month on record: 6 confirmed victims
Most recent leak-site post
First seen in Brandefense data
Get Real-Time Alerts, IOC Feeds And Takedowns.
The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.