Search Ransomware Intelligence
Jump to a group, country, industry or search victims.
Obscura
As of Oct 19, 2026, Obscura has listed 26 confirmed victims on its leak site since Jul 16, 2025, 0.1% of all victims tracked by Brandefense. Its most targeted country is United States (26.9% of its victims) and its most targeted sector is Energy and Utilities.
Obscura is a ransomware strain observed in 2025, written in Go and specifically targeting Windows domain controllers via the SYSVOL/NETLOGON share, using Curve25519 + XChaCha20 encryption with double-extortion tactics and a 10-day payment deadline.
Follow and IOC feeds are part of the Brandefense platform.
- Confirmed Victims
- 26
- Rank By Victims
- #150
- Last Leak-Site Post
- Jan 11, 2026
- Top Country
- United States
- Top Sector
- Energy and Utilities
Victims Posted Per Month.
| Month | Confirmed victims |
|---|---|
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| November 2025 | 2 |
| December 2025 | 9 |
| January 2026 | 2 |
| February 2026 | 0 |
| March 2026 | 0 |
| April 2026 | 0 |
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| July 2025 | 1 |
| August 2025 | 5 |
| September 2025 | 3 |
| October 2025 | 4 |
| November 2025 | 2 |
| December 2025 | 9 |
| January 2026 | 2 |
| February 2026 | 0 |
| March 2026 | 0 |
| April 2026 | 0 |
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
Latest Obscura Victims.
Search all 26 →| Victim | Country | Industry | Data claimed | Posted |
|---|---|---|---|---|
| REDtone redtone.com | MYMalaysia | Telecommunications | Not stated | |
| STC Concrete Product stc.co.th | THThailand | Construction | Not stated | |
| Thai Petroleum & Trading thaipet.com | THThailand | Energy and Utilities | Not stated | |
| Revoil revoil.gr | GRGreece | Energy and Utilities | Not stated | |
| Trend Import Export trend.ro | RORomania | Media and Entertainment | Not stated | |
| CleverPower cleverpower.eu | CZCzechia | Energy and Utilities | Not stated |
How They Operate.
Obscura's threat actor profile lists 15 ATT&CK techniques, 26 malware and tools, with its targets and related actors.
TTPs, CVEs and malware →Who Obscura Targets.
Sectors
History.
First confirmed victim listed on its leak site
First seen in Brandefense data
Busiest month on record: 9 confirmed victims
Most recent leak-site post
Get Real-Time Alerts, IOC Feeds And Takedowns.
The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.