// RANSOMWARE INTELLIGENCE

During routine hunting, I identified a newly emerged website presenting itself as a “vetted platform” operating under a Ransomware-as-a-Service (RaaS) model. Based on its structure and messaging, the operation appears to be in an early launch phase, attempting to position itself within the ransomware ecosystem.

Platform Overview

The site contains the following primary sections:

• About
• Login
• Signup
• Victim Leak Portal

The messaging in the “About” section promotes the platform as structured and affiliate-ready, suggesting recruitment intentions rather than a single-operator campaign.

Funding Activity

Interestingly, the operators are requesting approximately $5 in donations to keep the platform operational. Review of the publicly posted Bitcoin wallet indicates small-value transactions, including transfers of roughly $7 on February 16, 2026.

The low transaction volume suggests limited traction at this stage, potentially reflecting early testing or initial affiliate onboarding efforts.

Victim Leak Section

At the time of analysis, the leak portal listed a single victim. The data archive is advertised as approximately 1.2 GB in size, reportedly associated with a university entity, and marked as available for download.

Operational Assessment

The combination of:

• Basic affiliate portal structure
• Minimal financial activity
• Limited victim listings
• Low donation request threshold

strongly indicates an early-stage RaaS operation attempting to establish legitimacy and attract affiliates. While currently limited in scale, the structured layout and public leak portal suggest intent to expand operations if recruitment proves successful.

Links