Ransomware Intelligence / Groups / metaencryptor
Ransomware group
metaencryptor
We are a group of young people who identify themselves as specialists in the field of network security with at least 15 years of experience. This blog and this work are ONLY commercial use, besides not the main one. We have nothing to do with politics, intelligence agencies and the NSB. If you are a hunter of other people's data, then download any files and (or) wait until the time expires for others and the files will be available here. If you have any personal suggestions, we are ready to consider them. Contact us on the "contacts" page. There are a lot of other data, for various reasons, not posted here and we can discuss their sale or transfer under certain conditions. Also, every incident is notified to all possible press in the region and data not intended for sale is transmitted to breached and similar forums. Subscribe to RSS, add to favorites, visit us more often.
- 2claims, 7 days
- 18claims, 30 days
- 18claims, 90 days
- 2026-09-26first seen
- 2026-10-12last seen
These are claims posted by the group on its leak site, counted when we first see them. They are not confirmed incidents, and we never name a victim.
Activity, last 26 weeks
New leak-site claims per week.
Sectors claimed, last 90 days
- Unclassified 18
Countries claimed, last 90 days
- Unknown 18
Vulnerabilities with known ransomware use
From CISA's Known Exploited Vulnerabilities catalog, newest first. The catalog does not attribute entries to a specific group; this is the current patch list for any ransomware operator.
| Added | CVE | Vendor / product | Vulnerability |
|---|---|---|---|
| 2026-08-18 | CVE-2026-59310 | Broadcom VMware vCenter | Broadcom VMware vCenter Path Traversal Vulnerability |
| 2026-08-05 | CVE-2026-63077 | JetBrains TeamCity | JetBrains TeamCity Deserialization of Untrusted Data Vulnerability |
| 2026-07-29 | CVE-2026-20316 | Cisco Secure Firewall Management Center (FMC) | Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability |
| 2026-07-14 | CVE-2026-15410 | SonicWall SMA1000 Appliances | SonicWall SMA1000 Appliances Code Injection Vulnerability |
| 2026-07-14 | CVE-2026-15409 | SonicWall SMA1000 Appliances | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability |
| 2026-07-01 | CVE-2026-45659 | Microsoft SharePoint Server | Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability |
| 2026-06-25 | CVE-2026-12569 | PTC Windchill and FlexPLM | PTC Windchill and FlexPLM Improper Input Validation Vulnerability |
| 2026-06-12 | CVE-2026-35273 | Oracle PeopleSoft Enterprise PeopleTools | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability |
Track metaencryptor in the weekly brief
One email a week: which groups are active in your sector, what they are exploiting, and what to patch. Drafted from the data on this site and read by a human before it goes out. No sales follow-up.
Data sources
- Source: CISA KEVupdated 3 hours ago
- Source: RansomLookupdated 3 hours ago
- Sector, country and region labels are inferred by SecuritySnares from the published organisation name using Claude; treat them as estimates.not yet synced
Leak-site listings reflect claims by threat actors and are not independently verified. Victims are never named on this site unless they have disclosed the incident themselves. Read the methodology.