Loading malware…
DataCarry is a ransomware-associated extortion operation that emerged in 2025 and has been observed targeting organizations across multiple countries and sectors. Reported victimology includes aviation, education, finance, insurance, and healthcare, with additional reporting placing it among ransomware variants frequently observed against European financial institutions. The operation has also been described as part of a broader wave of short-lived, rapidly branded ransomware groups that emphasize operational speed, shared criminal infrastructure, and leak-site driven coercion.
Available reporting indicates that DataCarry has, in some cases, relied on data theft and leak-based extortion without deploying a traditional file-encrypting locker. This places it within the broader 2025 trend of exfiltration-first or extortion-only ransomware activity, where public exposure of stolen data is used as the primary pressure mechanism. High-confidence attribution of a distinct custom malware payload, encryption routine, or unique technical tradecraft beyond extortion activity is currently not available.
DataCarry has been linked to abuse-resistant hosting infrastructure, including a bulletproof hosting provider identified in reporting as PFCloud. Such infrastructure is commonly used to support ransomware and extortion operations by providing resilient hosting for leak sites, command-and-control functions, and data staging. The group has been mentioned alongside other contemporary ransomware and extortion brands such as Akira, BlackLock, Dire Wolf, Silent Team, and J Group, reflecting its place in the fragmented 2025 ransomware ecosystem.
The operation appears financially motivated and focused on organizations whose data exposure can create regulatory, reputational, or operational pressure. Reporting also notes disclosure of victim organizations in eight countries and public leakage of personal records associated with one of its campaigns. While DataCarry is consistently referred to as a ransomware group, the strongest supported characterization is an extortion-focused ransomware operation centered on data exfiltration and public leak pressure.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware family mentioned as associated with PFCloud bulletproof hosting and targeting multiple sectors.
Ransomware variant observed targeting European financial institutions in 2025.
A ransomware family from 2025, exploiting cloud and SaaS misconfiguration, sometimes opting for data exposure over encryption.
Extortion group that focuses on data theft and public leaks as a means of extortion, rather than encrypting victim data.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.