Loading threat actor…
PEAR, also expanded as Pure Extraction and Ransom, is a ransomware and extortion threat group that emerged in 2025. The group is characterized by data-theft-led operations and has been described as focusing on exfiltration and extortion rather than relying on file encryption as its primary pressure mechanism. PEAR operates a leak site where it names victims and threatens publication of stolen data to coerce payment. Observed victimology indicates broad opportunistic targeting across multiple sectors, with repeated activity against healthcare and healthcare-adjacent organizations, including medical billing and radiology providers. Additional reported victims span financial services, information technology, industrial and manufacturing-related businesses, construction, transportation and logistics, consumer-facing organizations, and nonprofit entities. Reported victim geography includes the United States, Norway, and Singapore, with the United States appearing most prominently. Publicly attributed PEAR incidents include claims against Medical Computer Business Services, Expert MRI, Optimum First Mortgage, and other organizations. In these cases, PEAR publicly asserted that it had infiltrated internal networks, exfiltrated large volumes of sensitive data, and would release the information unless ransom demands were met. Reporting also associates the group with numerous alleged victims on its leak site and unusually large claimed aggregate data theft volumes. PEAR should be understood primarily as a data-theft extortion actor within the ransomware ecosystem. Its known tradecraft, as directly supported, centers on unauthorized network access, data exfiltration, post-compromise extortion, and leak-site publication. High-confidence reporting does not establish a specific national sponsor or country of origin.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Claimed responsibility for the cyber attack on MCBS, allegedly exfiltrated 3.3 TB of confidential data, and threatened to publish the stolen database unless ransom demands were met.
Claimed responsibility for the MCBS breach and alleged exfiltration of 3.3 terabytes of data, later stating the data was fully leaked online.
Ransomware and data theft/extortion operations targeting organizations including healthcare-related entities; claimed the MCBS intrusion and publication of allegedly stolen data.
Claimed responsibility for the cyber attack on MCBS, allegedly exfiltrated 3.3 TB of confidential data, and used data leak site extortion by threatening to publish the stolen database unless ransom demands were met.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.