DebrisGang Active

Ransomware group first observed in 2025. Uses ngrok for deployment.
PDF Report Back to Groups
2
Total Victims
2025-10-01
First Seen
2026-03-07
Last Seen
0
Known TTPs
17.0d
Avg Delay
0
Negotiations
ONION URLS
7mgo3ixq3nd34rkqhp546u5pnvoevhl2uphhcjnb2plfuv465yjyvzgw.onion
TOOLS
ngrok PsExec
FILE EXTENSIONS
.doom
ACTIVITY TIMELINE
TOP SECTORS
TOP COUNTRIES
ACTIVITY HEATMAP
Date Victim Name Country Sector Status
2026-03-07 Sapphire Capital Israel Technology Published
2026-03-06 Horizon Global Germany Media Published

No TTPs data

No YARA rules

TypeValueDescriptionCopy
sha256 d7e8e3a810dd5ce612c678f740c446d9ca847b897200cb65518202d10998d11e Ransomware binary hash observed in DebrisGang attacks
btc bc1qujw6upbxikzx11zzsmylrz9a4ruayg90nu7e8o Bitcoin ransom address - DebrisGang campaign
sha1 acad24bf6b8b2407c6dade5225bec7cd5ad6c4e6 Associated with DebrisGang ransomware
sha1 db0351939c75b4dbc345b9241bbab96cc3132010 Associated with DebrisGang ransomware
email decrypt262@firemail.cc Contact email observed in DebrisGang attacks

No ransom notes