Loading threat actor…
Meow is a ransomware and data-extortion threat actor active by late 2022 and observed through 2024–2025. The name is used for both a ransomware strain and a leak operation, with aliases including MeowLeaks, Meow Leaks, MeowCorp, and meow_ransomware. Reporting consistently places Meow among active ransomware groups targeting organizations in the United States, and characterizes it as increasingly focused on data-extortion operations via a leak site. Meow has been described in two related ways: as a Conti-derived ransomware variant that encrypts files and as a leak-focused extortion group that publishes or offers stolen data. The ransomware component has been reported to append a distinctive extension to encrypted files and to use ChaCha20 encryption. Initial access has been associated with exposed or weakly protected remote access services, email spam, and malicious downloads. Broader reporting on Meow’s activity also links the group to leak-site operations involving compromised websites and data taken from web servers or databases, indicating a strong exfiltration-and-extortion component in addition to any encryption capability. Operationally, Meow appears in multiple 2024 ransomware activity rankings as one of the more active groups, including among the top groups affecting U.S. organizations and among the leading actors by leak-site victim postings. It has been specifically described as targeting small and mid-sized U.S. organizations. Public reporting also notes Meow-related data exposure involving energy-sector and nuclear-adjacent entities, including data later reposted by other criminal brands, which is consistent with the broader ransomware ecosystem’s practice of recycling or reselling stolen datasets. Known behaviors attributed to Meow include initial access, credential attacks against weakly protected remote access, brute-force-style intrusion paths where MFA is absent, data theft, leak-site publication, and extortion. The actor is best characterized as financially motivated cybercrime rather than a state-sponsored espionage group.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a ransomware group whose victim listings were allegedly copied by an impersonator; no direct activity described in this content.
Referenced as a group whose victim listings were allegedly copied by a Babuk impersonator to fabricate victims.
A data extortion group (no encryption) believed to be a Conti spinoff, targeting healthcare, financial services, professional services, and education, especially small and mid-sized US organizations.
Ransomware/data-leak actor referenced as previously offering stolen nuclear-company data for sale.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.