Ransomware Intelligence / Groups / emperador

Ransomware group

emperador

  • 4claims, 7 days
  • 23claims, 30 days
  • 63claims, 90 days
  • 2026-08-10first seen
  • 2026-10-31last seen

These are claims posted by the group on its leak site, counted when we first see them. They are not confirmed incidents, and we never name a victim.

Activity, last 26 weeks

New leak-site claims per week.

Week of 2026-05-11: 0Week of 2026-05-18: 0Week of 2026-05-25: 0Week of 2026-06-01: 0Week of 2026-06-08: 0Week of 2026-06-15: 0Week of 2026-06-22: 0Week of 2026-06-29: 0Week of 2026-07-06: 0Week of 2026-07-13: 0Week of 2026-07-20: 0Week of 2026-07-27: 0Week of 2026-08-03: 0Week of 2026-08-10: 3Week of 2026-08-17: 5Week of 2026-08-24: 4Week of 2026-08-31: 1Week of 2026-09-07: 6Week of 2026-09-14: 7Week of 2026-09-21: 4Week of 2026-09-28: 8Week of 2026-10-05: 4Week of 2026-10-12: 4Week of 2026-10-19: 9Week of 2026-10-26: 8Week of 2026-11-02: 0
Claims per week, oldest to newest. Each bar is a full Monday-to-Sunday week; the newest bar is the current week so far.

Sectors claimed, last 90 days

  1. Manufacturing 16
  2. Government 8
  3. Technology 8
  4. Professional services 7
  5. Retail 6
  6. Transportation and logistics 6
  7. Unclassified 3
  8. Construction 3
  9. Critical infrastructure 2
  10. Healthcare 2
  11. Higher education 2

Countries claimed, last 90 days

  1. United States 11
  2. Brazil 9
  3. Italy 4
  4. Unknown 3
  5. Argentina 3
  6. Germany 3
  7. Spain 3
  8. Sweden 3
  9. AL 2
  10. Colombia 2
  11. India 2
  12. Mexico 2
  13. Philippines 2
  14. Türkiye 2
  15. BA 1

Vulnerabilities emperador exploits

CVEs attributed to emperador by Ransomware.live, most severe first. Patch these first if this group is in your threat model.

CVE Vendor / product CVSS CISA KEV
CVE-2026-50751 Check Point Security Gateway (IKEv1 improper auth) 9.3 Critical Listed 2026-06-08, ransomware use
CVE-2026-48027 Nx Nx Console (embedded malicious code) 9.3 Critical Listed 2026-05-27, ransomware use
CVE-2023-21529 Microsoft Exchange (deserialization) 8.8 High Listed 2026-04-13, ransomware use
CVE-2024-1708 ConnectWise ScreenConnect (path traversal -> RCE) 8.4 High Listed 2026-04-28, ransomware use
CVE-2025-60710 Microsoft Windows (link following) 7.8 High Listed 2026-04-13, ransomware use

70% of successful ransomware attacks use remote encryption (Microsoft, 2024): files on protected servers are encrypted over the network from a device the attacker controls. Read our remote encryption briefing →

Newest vulnerabilities used by any ransomware group (CISA KEV)
Added CVE Vendor / product Vulnerability
2026-08-18 CVE-2026-59310 Broadcom VMware vCenter Broadcom VMware vCenter Path Traversal Vulnerability
2026-08-05 CVE-2026-63077 JetBrains TeamCity JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
2026-07-29 CVE-2026-20316 Cisco Secure Firewall Management Center (FMC) Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
2026-07-14 CVE-2026-15410 SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Code Injection Vulnerability
2026-07-14 CVE-2026-15409 SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
2026-07-01 CVE-2026-45659 Microsoft SharePoint Server Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability
2026-06-25 CVE-2026-12569 PTC Windchill and FlexPLM PTC Windchill and FlexPLM Improper Input Validation Vulnerability
2026-06-12 CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

Data sources: CISA KEV, Ransomchats, RansomLook, Ransomware.live, security news outlets · updated 14 hours ago

Sector, country and ransom-demand figures are SecuritySnares estimates made with a language model. Leak-site listings are claims by threat actors and are not independently verified; leak-site victims are never named unless they have disclosed the incident themselves. News headlines are the publishers' own reporting, shown as written and linked to the original. Methodology