First listed
Victim claimwww.bbadmin.com listed by redalert
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimedredalert
RedAlert (also called N13V) is a ransomware group first observed in July 2022 that targets both Windows and Linux VMware ESXi servers, encrypting virtual machine files using the NTRUEncrypt algorithm and accepting only Monero for payment, conducting double-extortion attacks against corporate networks.
Activity timeline
A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.
Last observed
Indicator2 indicators cataloged
Types: onion.
First listed
Victim claimgroupg4.com listed by redalert
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedFirst listed
Victim claimcoarc.org listed by redalert
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedFirst listed
Victim claimkeystonelegal.co.uk listed by redalert
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedFirst listed
Victim claimvahanen.com listed by redalert
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedFirst listed
Victim claimsyredis.fr listed by redalert
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedIdentity and attribution
Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.
Name map
redalertCanonical Name
Loading CVEs, techniques, indicators, malware, victims, and activity...