emperador

Emperador, also styled EMPERADOR, is a financially motivated ransomware and data-extortion group active in 2026. Its victim claims span government entities and commercial organizations, including retailers, professional services firms, building-materials suppliers, transportation companies, and technology providers. Named targets include organizations in the United States, Italy, France, and Switzerland, with additional activity reported in Latin America. Its geographic origin is not established. Emperador operates a data-leak site and pressures targets through publication countdowns, purported data samples, cryptocurrency payment demands, and threats to disclose customer and corporate information. Its extortion messages have demanded $1 million in Bitcoin or Monero. The group has threatened to contact victims’ clients directly, release documents incrementally, and target employees and business partners to increase pressure. Some messages also claim server encryption and threaten permanent loss of recoverability, but these claims do not independently establish encryption capability or deployment. The group listed French optical retailer Alain Afflelou and displayed purported customer records containing identity, contact, purchase, and subscription information. It also claimed to have stolen approximately 3.9 GB from AB InBev and demanded $1 million, but that alleged compromise remained unverified and lacked company confirmation. Multiple other attributed incidents likewise lack independent confirmation of data theft or encryption. Initial-access methods, exploited vulnerabilities, and a distinct ransomware payload have not been established.