PEAR, also known as Pure Extraction And Ransom, is a cyber extortion group that emerged in June 2025, although it publicly listed its first victims in early August 2025. This group distinguishes itself from traditional ransomware operators by primarily focusing on data theft and extortion rather than file encryption. PEAR operates with a non-encryption model, allowing it to bypass some endpoint detection mechanisms that are designed to identify encryption activities. The group utilizes Tor servers for its storage, communication, and data leak site operations, a tactic that mirrors those employed by other data-extortion groups like Karakurt and BianLian. PEAR describes itself as a private and highly disciplined team, explicitly stating that it has no affiliation with other threat actors. Its primary motivation is financial gain, achieved through the exfiltration and subsequent leveraging of sensitive data.

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker