Classic Brechas Mapa Actores TTP Matrix Analitica Alertas CyberNews Arsenal Exploits KillChain Origen SSLBL RansomLook Ransomwhere

onyx

2 incidentes 1 paises 0 sectores threat-actor KP Ultimo: 2026-06-29

Aliases: PLUTONIUM o Onyx Sleet en fuentes no verificadas, APT ONYXSLEET, apt-45, apt45, onyx sleet, silent chollima

Ver en IntelTracker → APTTrail →

Onyx is a ransomware group that first appeared in April 2022, operating with the primary motivation of financial profit through file encryption and data exfiltration for ransom. The group is notable for consistently employing double extortion tactics, threatening public release of sensitive victim data if ransom demands are not fulfilled. Onyx has shown an evolving operational posture, moving towards incorporating zero-day vulnerabilities into its campaigns and refining its attack methods to avoid detection.

Aliases del actor

PLUTONIUM o Onyx Sleet en fuentes no verificadas APT ONYXSLEET apt-45 apt45 onyx sleet silent chollima

Actores similares

apt-onyxsleetactor · 1 Pearl Sleetapt · 0 Silent Chollimaapt · 0 Opal Sleetapt · 0 Ruby Sleetapt · 0 apt-c-01actor · 2 apt-c-27actor · 2 apt-45actor · 2 apt-c-37actor · 1 apt-c-23actor · 1

Canales, DLS e infraestructura asociada

Clasificacion automatica desde IntelTracker/APTTrail/OSINT. Estado real solo si viene indicado por la fuente.

Tipo	Estado	Host / enlace	Title / ultimo titulo
DLS / leak site	unknown	ransomware.anggipradana.com	Ransomware Group: onyx
DLS / leak site	unknown	otx.alienvault.com	APT ONYXSLEET indicators and references
DLS / leak site	unknown	www.microsoft.com	APT ONYXSLEET indicators and references
Repositorio	unknown	github.com	APT ONYXSLEET indicators and references
DLS / leak site	unknown	raw.githubusercontent.com	APT ONYXSLEET indicators and references
DLS / leak site	unknown	otx.alienvault.com	APT ONYXSLEET indicators and references
DLS / onion	offline	mrdxtxy6vqeqbmb4rvbvueh2kukb3e3mhu3wdothqn7242gztxyzycid.onion	CTI.FYI

Tecnicas MITRE

T1070.004, T1486, T1059.001, T1047, T1566.001

Victimas

TTPs unicas

Info robada historica

N/D

Rescates reclamados

N/D

Pagos detectados

N/D

Paises afectados

United States (1)

Paises objetivo (OSINT)

Brazil

Germany

Estonia

Guatemala

India

JapanKorea, Republic of

Mexico

United States

Sectores objetivo (OSINT)

Construction of BuildingsFood ManufacturingSoftware PublishersEnterprises & HoldingManufacturingConstructionPublic AdministrationOil & GasBeverag & Tobacco ManufacturingEducational Services

URLs nuevas detectadas en IntelTracker

ransomware.anggipradana.com