Search threats, CVEs… ⌘K
← Back to all threat actors

cicada3301

Cicada3301 is a ransomware-as-a-service group (tracked as Repellent Scorpius by Palo Alto) that emerged in mid-2024 using Rust-based ransomware targeting Windows, Linux, and ESXi systems, suspected to be a successor of BlackCat/ALPHV and running an affiliate program with 20% commissions.

How we source and review actor profiles
Motivation
ransomware
Last seen
2025-08-05
Sectors
professional-services, manufacturing, technology, hospitality, transportation, retail-e-commerce, healthcare, financial-services, education, government-defense, energy-utilities, agriculture-and-food-production
Status
Dormant

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

Claimed
Victim claimCI Engineering listed by cicada3301

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Last observed
Indicator1 indicator cataloged

Types: onion.

Claimed
Victim claimdiasdeprimavera.com.br listed by cicada3301

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimgatlogistica.com.br listed by cicada3301

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimB&M - Expertise - Audit listed by cicada3301

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimBurnham Nationwide listed by cicada3301

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimSensical listed by cicada3301

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimСonasa listed by cicada3301

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimPACIFIC BIOLABS listed by cicada3301

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimMack Energy Corp listed by cicada3301

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimAsesoría Bieito listed by cicada3301

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimNatilait listed by cicada3301

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimAmazon Transportes listed by cicada3301

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimSpráva služeb hlavního města Prahy listed by cicada3301

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimEagle Distilleries listed by cicada3301

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimI.A.T.S.E. Local 667/669 listed by cicada3301

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimMinebeaMitsumi Inc listed by cicada3301

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimBenjamin Consulting Services listed by cicada3301

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimExecutive Agenda listed by cicada3301

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimBirdsall Muller LLC listed by cicada3301

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimJohnson's Nursery listed by cicada3301

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimDigital Technology Co., Ltd. listed by cicada3301

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimGoldstein Law Group, S.C. listed by cicada3301

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimNorthern Management listed by cicada3301

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimThe Northwestern Illinois Association listed by cicada3301

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

The interactive view includes 76 dated events with category filters and paging.

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

cicada3301Canonical Name

Loading CVEs, techniques, indicators, malware, victims, and activity...