Search threats, CVEs… ⌘K
← Back to all threat actors

aware

Aware is a recently emerged ransomware group that operates a Tor-based data leak site with very limited public documentation and no publicly catalogued victims, tools, or TTPs in major threat intelligence databases.

How we source and review actor profiles
Motivation
ransomware
Status
Dormant

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

First observed
CVECVE-2026-114625 linked to this actor

CISA Adds One Known Exploited Vulnerability to Catalog

First observed
CVECVE-2026-110447 linked to this actor

CISA Adds One Known Exploited Vulnerability to Catalog

First observed
CVECVE-2026-96652 linked to this actor

CISA Adds Six Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-96654 linked to this actor

CISA Adds Six Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-96655 linked to this actor

CISA Adds Six Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-96656 linked to this actor

CISA Adds Six Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-106931 linked to this actor

CISA Adds Six Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-110936 linked to this actor

CISA Adds Six Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2025-61624 linked to this actor

CISA Adds Two Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-102764 linked to this actor

CISA Adds Two Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-21589 linked to this actor

CISA Adds One Known Exploited Vulnerability to Catalog

First observed
CVECVE-2026-0322 linked to this actor

CISA Adds Four Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-76519 linked to this actor

CISA Adds Four Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-105133 linked to this actor

CISA Adds Four Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-105134 linked to this actor

CISA Adds Four Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-96951 linked to this actor

CISA Adds Two Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-104935 linked to this actor

CISA Adds Two Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-88779 linked to this actor

CISA Adds One Known Exploited Vulnerability to Catalog

First observed
CVECVE-2026-102489 linked to this actor

CISA Adds Two Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-102490 linked to this actor

CISA Adds Two Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-104286 linked to this actor

CISA Adds One Known Exploited Vulnerability to Catalog

First observed
CVECVE-2026-76504 linked to this actor

CISA Adds One Known Exploited Vulnerability to Catalog

First observed
CVECVE-2026-86950 linked to this actor

CISA Adds One Known Exploited Vulnerability to Catalog

First observed
CVECVE-2026-88771 linked to this actor

CISA Adds Two Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-88772 linked to this actor

CISA Adds Two Known Exploited Vulnerabilities to Catalog

The interactive view includes 101 dated events with category filters and paging.

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

awareCanonical Name

Loading CVEs, techniques, indicators, malware, victims, and activity...