runsomewares
Active since 2024-06-22
Unverified threat-actor claim — not a regulatory filing
Attribution, victim identity, and counts shown here derive from runsomewares's public extortion-blog claims, aggregated by ransomware.live. They have not been validated by the victim or any regulator. Treat them as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
According to ransomware.live, the group claims:
RunSomeWares is an emerging ransomware group that surfaced in February 2025 with initial victims across supply-chain services, financial services, accounting, and manufacturing, with unclear deployment of an encryptor vs. pure data-theft extortion.
Source: Ransomware.live