Search Ransomware Intelligence
Jump to a group, country, industry or search victims.
Ms13089
As of Oct 19, 2026, Ms13089 has listed 5 confirmed victims on its leak site since Dec 18, 2025, 0.0% of all victims tracked by Brandefense. Its most targeted country is Chile (20.0% of its victims) and its most targeted sector is Consulting.
MS13089 is a newly emerged ransomware group (first observed December 2025) that named itself after a 2013 Microsoft Security Bulletin, claiming a handful of victims including a law firm, operating primarily as a double-extortion actor.
Follow and IOC feeds are part of the Brandefense platform.
- Confirmed Victims
- 5
- Rank By Victims
- #273
- Last Leak-Site Post
- Aug 15, 2026
- Top Country
- Chile
- Top Sector
- Consulting
Victims Posted Per Month.
| Month | Confirmed victims |
|---|---|
| May 2026 | 1 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 1 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| December 2025 | 2 |
| January 2026 | 1 |
| February 2026 | 0 |
| March 2026 | 0 |
| April 2026 | 0 |
| May 2026 | 1 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 1 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| December 2025 | 2 |
| January 2026 | 1 |
| February 2026 | 0 |
| March 2026 | 0 |
| April 2026 | 0 |
| May 2026 | 1 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 1 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
Latest Ms13089 Victims.
Search all 5 →| Victim | Country | Industry | Data claimed | Posted |
|---|---|---|---|---|
| servmarmg.cl servmarmg.cl | CLChile | Education and Research | Not stated | |
| brittanyresidential.com brittanyresidential.com | USUnited States | Consulting | Not stated | |
| sjl-legal.com sjl-legal.com | LULuxembourg | Unknown | Not stated | |
| dgpcommercialisti.it dgpcommercialisti.it | ITItaly | Unknown | Not stated | |
| uro.com uro.com | DEGermany | Unknown | Not stated |
How They Operate.
Ms13089's threat actor profile lists 1 malware and tools, with its targets and related actors.
TTPs, CVEs and malware →Who Ms13089 Targets.
History.
Busiest month on record: 2 confirmed victims
First seen in Brandefense data
First confirmed victim listed on its leak site
Most recent leak-site post
Get Real-Time Alerts, IOC Feeds And Takedowns.
The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.