Skip to content
brandefense.io
Request A Demo

Search Ransomware Intelligence

Jump to a group, country, industry or search victims.

Inactive · #132 by victimsRansomware group

SunCrypt

As of Oct 19, 2026, SunCrypt has listed 33 confirmed victims on its leak site since Jul 11, 2025, 0.1% of all victims tracked by Brandefense. Its most targeted country is United States (12.1% of its victims) and its most targeted sector is Construction.

SunCrypt is a RaaS operation first observed in October 2019, notable for pioneering triple extortion (encryption, data publication threats, and DDoS attacks on non-paying victims), operating a closed small affiliate program and partnering with TrickBot for initial access.

Also known asSun
Is My Company Listed?Follow SunCryptRequest IOC FeedTTPs, CVEs and malware →

Follow and IOC feeds are part of the Brandefense platform.

Confirmed Victims
33
Rank By Victims
#132
Last Leak-Site Post
Jul 11, 2025
Top Country
United States
Top Sector
Construction

Victims Posted Per Month.

SunCrypt confirmed victims per month
MonthConfirmed victims
July 202533
August 20250
September 20250
October 20250
November 20250
December 20250
January 20260
February 20260
March 20260
April 20260
May 20260
June 20260
July 20260
August 20260
September 20260
October 2026 (month in progress)0
Updated continuously · figures as of Oct 19, 2026

Latest SunCrypt Victims.

Search all 33 →
Latest confirmed leak-site victims claimed by SunCrypt
VictimCountryIndustryData claimedPosted
netc
netc.edu
USUnited StatesEducation and Research200 GB
Socotec
socotec.us
USUnited StatesManufacturing, ConstructionNot stated
University Hospital New JerseyUSUnited StatesUnknownNot stated
Haywood County School DistrictUSUnited StatesUnknownNot stated
Outdoor Venture Corporation (OVC)UnknownUnknownNot stated
Tri-signal IntergrationUnknownUnknownNot stated

How They Operate.

SunCrypt's threat actor profile lists 1 malware and tools, with its targets and related actors.

TTPs, CVEs and malware →

Who SunCrypt Targets.

Sectors

  1. Construction13.0%
  2. Education and Research13.0%
  3. Manufacturing13.0%

Countries

  1. USUnited States412.1%
Shares are of this group's confirmed victims.

History.


  1. First seen in Brandefense data

  2. Busiest month on record: 33 confirmed victims

  3. First confirmed victim listed on its leak site

  4. Most recent leak-site post

Get Real-Time Alerts, IOC Feeds And Takedowns.

The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.

Request A Demo

Figures as of Oct 19, 2026. Confirmed leak-site claims collected by Brandefense technologies and validated by Brandefense analysts.

Listed on a leak site means a ransomware group has claimed the company; it is not a confirmed breach. To request a correction or removal, contact Brandefense.