RansomedVC
RansomedVC is a data extortion and ransomware-branded cybercrime actor active in 2023 and later reported as reactivated after a period of inactivity. The content describes it as an extortion group that does not have its own encryptor, and as a fabulist operation that has posted fabricated attacks and fictitious stolen data on its leak site to deceive and extort victims. Reported 2023 claims included alleged theft of customers’ personally identifiable information from State Farm Insurance and data from NTT Docomo; reporting cited in the content states these datasets were fictitious. The actor is also referred to as RansomedSupport. Supporting reporting describes operational overlap and gradual alignment with the Stormous ecosystem rather than a simple direct rebrand, including shared infrastructure, repeated Telegram channel rebranding, and reuse of the same TOX identifier across RansomedVC, Stormous, and later GhostLocker-branded activity. Early RansomedVC activity focused on recruitment, announcements, and breach claims; later channel activity advertised a marketplace, sought partnerships with other cybercrime services, and promoted tiered affiliate access models. The content also notes a claimed Sony breach in which Ransomed.vc said it accessed more than 6,000 files and offered the data for sale for $2.5 million, while Sony said it was investigating. In 2025, RansomedVC was reported as reactivated, and another report states the group returned after a two-year absence and leaked internal chat transcripts of the Medusa ransomware group. Known aliases and related branding in the content include Ransomed.vc, RansomedSupport, Ransomed News, Ransomed_vc, Ransomed.vc Channel, and later channel rebrands associated with Stormous.X Store and Stm.X | GhostLocker.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Observables
9 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A ransomware/extortion brand that evolved through Telegram-based recruitment, breach announcements, marketplace promotion, DDoS offerings, and partnerships, later converging operationally with the Stormous ecosystem.
Referenced as a ransomware/extortion group known for listing fabricated attacks on leak sites to deceive/pressure victims.
Referenced as a ransomware group known (in this context) for listing fabricated attacks on leak sites to deceive/pressure victims.
Extortion scam actor cited for making fictitious data-theft claims against named organizations as part of attempted extortion.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.