Skip to content
brandefense.io
Request A Demo
RansomwareFinancialOrganisation

Underground

Underground is a ransomware group with a financial motive, tracked by Brandefense. It targets 9 sectors, including Technology and Manufacturing, in 12 countries, including the United States and France. It uses 11 MITRE ATT&CK techniques.

Request IOC feedRequest ATT&CK export
Techniques
11
Exploited CVEs
No CVE data
First seen
Jul 1, 2023
Last seen
Dec 31, 2024
Record updated

Who They Target.

Sectors · 9
Countries · 12
Labelsransomware

About Underground.

Underground ransomware is deployed by the Russia-based RomCom group (Storm-0978) and has victimized companies across multiple industries since July 2023 by exploiting CVE-, encrypting files without changing extensions and deleting Volume Shadow Copies and Windows event logs in double-extortion campaigns.

Last updated Oct 1, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.