Search threats, CVEs… ⌘K
← Back to all threat actors

netrunner

NetRunner is a ransomware group active from at least 2025 targeting diverse sectors including healthcare, telecommunications, manufacturing, and agriculture across Japan, Italy, the US, and Jordan, notably demanding a $100M ransom from Nippon Medical School Musashi Kosugi Hospital.

How we source and review actor profiles
Motivation
ransomware
Last seen
2026-10-08
Sectors
healthcare, retail-e-commerce, technology, agriculture-and-food-production, manufacturing, transportation
Status
Active

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

First listed
Victim claimMid Atlantic Gynecologic Oncology and Pelvic Surgery Associates listed by netrunner

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Last observed
Indicator1 indicator cataloged

Types: onion.

First listed
Victim claimM** A******* G********** O******* a** P***** S****** A********* listed by netrunner

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimPrecon Marine Inc listed by netrunner

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimMain Place Mall listed by netrunner

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimP***** M***** I** listed by netrunner

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimM*** P**** M*** listed by netrunner

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimJordan India Fertilizer Company listed by netrunner

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimHarman Fitness listed by netrunner

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimNippon Medical School Musashi Kosugi Hospital listed by netrunner

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimShiraume Hospital listed by netrunner

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimGEG Telecomunicazioni listed by netrunner

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimSeoyon E-Hwa Summit listed by netrunner

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

netrunnerCanonical Name

Loading CVEs, techniques, indicators, malware, victims, and activity...