Search threats, CVEs… ⌘K
← Back to all threat actors

Redact

How we source and review actor profiles
Motivation
ransomware
First seen
2026-06-28
Last seen
2026-10-20
Sectors
healthcare, manufacturing, financial-services
Status
Active

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

First listed
Victim claimBaker Donelson listed by Redact

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Last observed
Indicator3 indicators cataloged

Types: onion.

First listed
Victim claimParker-Hannifin Corporation listed by Redact

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimONEOK, Inc. listed by Redact

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimEversource Energy listed by Redact

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimDexCom listed by Redact

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimGraybar Electric Company, Inc. listed by Redact

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Cataloged
RelationshipRebrand of relationship with Pink

Pink is assessed as a likely rebrand of Redact. The assessment is shown as a relationship because it is not an exact-name equivalence.

Medium
Cataloged
RelationshipRebrand of relationship with blackfile

Redact is assessed as a previous rebrand of BlackFile.

High
First listed
Victim claimHologic listed by Redact

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimFCCI Insurance Group listed by Redact

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Last observed
Indicator1 indicator cataloged

Types: url.

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

RedactCanonical Name
Rebrand of: Pink Rebrand of: blackfile

Loading CVEs, techniques, indicators, malware, victims, and activity...