Ransomware Intelligence / Groups / metaencryptor
Ransomware group
metaencryptor
We are a group of young people who identify themselves as specialists in the field of network security with at least 15 years of experience. This blog and this work are ONLY commercial use, besides not the main one. We have nothing to do with politics, intelligence agencies and the NSB. If you are a hunter of other people's data, then download any files and (or) wait until the time expires for others and the files will be available here. If you have any personal suggestions, we are ready to consider them. Contact us on the "contacts" page. There are a lot of other data, for various reasons, not posted here and we can discuss their sale or transfer under certain conditions. Also, every incident is notified to all possible press in the region and data not intended for sale is transmitted to breached and similar forums. Subscribe to RSS, add to favorites, visit us more often.
- 0claims, 7 days
- 4claims, 30 days
- 41claims, 90 days
- 2026-08-23first seen
- 2026-10-26last seen
These are claims posted by the group on its leak site, counted when we first see them. They are not confirmed incidents, and we never name a victim.
Activity, last 26 weeks
New leak-site claims per week.
Sectors claimed, last 90 days
Countries claimed, last 90 days
- United States 24
- Japan 6
- Canada 3
- South Korea 3
- Singapore 2
- Unknown 1
- Germany 1
- Indonesia 1
Vulnerabilities metaencryptor exploits
Our sources do not attribute specific vulnerabilities to metaencryptor yet.
70% of successful ransomware attacks use remote encryption (Microsoft, 2024): files on protected servers are encrypted over the network from a device the attacker controls. Read our remote encryption briefing →
Newest vulnerabilities used by any ransomware group (CISA KEV)
| Added | CVE | Vendor / product | Vulnerability |
|---|---|---|---|
| 2026-08-18 | CVE-2026-59310 | Broadcom VMware vCenter | Broadcom VMware vCenter Path Traversal Vulnerability |
| 2026-08-05 | CVE-2026-63077 | JetBrains TeamCity | JetBrains TeamCity Deserialization of Untrusted Data Vulnerability |
| 2026-07-29 | CVE-2026-20316 | Cisco Secure Firewall Management Center (FMC) | Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability |
| 2026-07-14 | CVE-2026-15410 | SonicWall SMA1000 Appliances | SonicWall SMA1000 Appliances Code Injection Vulnerability |
| 2026-07-14 | CVE-2026-15409 | SonicWall SMA1000 Appliances | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability |
| 2026-07-01 | CVE-2026-45659 | Microsoft SharePoint Server | Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability |
| 2026-06-25 | CVE-2026-12569 | PTC Windchill and FlexPLM | PTC Windchill and FlexPLM Improper Input Validation Vulnerability |
| 2026-06-12 | CVE-2026-35273 | Oracle PeopleSoft Enterprise PeopleTools | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability |
Track metaencryptor in the weekly brief
One email a week: which groups are active in your sector, what they are exploiting, and what to patch. Drafted from the data on this site and read by a human before it goes out. No sales follow-up.
Data sources: CISA KEV, Ransomchats, RansomLook, Ransomware.live, security news outlets · updated 14 hours ago
Sector, country and ransom-demand figures are SecuritySnares estimates made with a language model. Leak-site listings are claims by threat actors and are not independently verified; leak-site victims are never named unless they have disclosed the incident themselves. News headlines are the publishers' own reporting, shown as written and linked to the original. Methodology