Claimed
Victim claimLEVEL listed by desolator
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimeddesolator
Desolator is a ransomware group that emerged in May 2025, targeting construction and engineering firms in Latin America and Europe and technology companies in Asia, actively recruiting pen testers, initial access brokers, and social engineers via dark web forums to build an affiliate program.
Activity timeline
A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.
Last observed
Indicator1 indicator cataloged
Types: onion.
Claimed
Victim claimConstruseñales S.A. listed by desolator
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedClaimed
Victim claimConstrucciones Sala listed by desolator
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedClaimed
Victim claimTri Thuc Software listed by desolator
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedIdentity and attribution
Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.
Name map
desolatorCanonical Name
Loading CVEs, techniques, indicators, malware, victims, and activity...