Search threats, CVEs… ⌘K
← Back to all threat actors

aware

Aware is a recently emerged ransomware group that operates a Tor-based data leak site with very limited public documentation and no publicly catalogued victims, tools, or TTPs in major threat intelligence databases.

How we source and review actor profiles
Motivation
ransomware
Status
Dormant

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

First observed
CVECVE-2026-85706 linked to this actor

CISA Adds One Known Exploited Vulnerability to Catalog

First observed
CVECVE-2026-67277 linked to this actor

CISA Adds Two Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-86060 linked to this actor

CISA Adds Two Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2025-25249 linked to this actor

CISA Adds Four Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-19490 linked to this actor

CISA Adds Four Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-87491 linked to this actor

CISA Adds Four Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-20079 linked to this actor

CISA Adds Four Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-75650 linked to this actor

CISA Adds Four Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-81963 linked to this actor

CISA Adds Four Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-85880 linked to this actor

CISA Adds Four Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-86218 linked to this actor

CISA Adds Four Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-85046 linked to this actor

CISA Adds One Known Exploited Vulnerability to Catalog

First observed
CVECVE-2026-9586 linked to this actor

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-48710 linked to this actor

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-49869 linked to this actor

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-59822 linked to this actor

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-82329 linked to this actor

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-83548 linked to this actor

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-83549 linked to this actor

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-81578 linked to this actor

CISA Adds Two Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-82078 linked to this actor

CISA Adds Two Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2023-49105 linked to this actor

CISA Adds Three Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-53362 linked to this actor

CISA Adds Three Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2026-66384 linked to this actor

CISA Adds Three Known Exploited Vulnerabilities to Catalog

First observed
CVECVE-2015-3246 linked to this actor

CISA Adds Six Known Exploited Vulnerabilities to Catalog

The interactive view includes 90 dated events with category filters and paging.

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

awareCanonical Name

Loading CVEs, techniques, indicators, malware, victims, and activity...