Bl00dy Ransomware Gang

Profile narrative

The Bl00dy Ransomware Gang, also tracked as the Everest Ransomware Gang, is a threat actor that has been observed operating from a base in Russia. The group uses the alias Bl00dy Ransomware Gang in its public communications and has been linked to the Everest Ransomware Gang moniker in some reporting. Public statements from the group indicate a financial motive, as they demand payment for decryption tools, threaten to sell stolen data, and offer custom malware builds for a fee while recruiting affiliates with an 80/20 profit split. Their activity has been directed at sectors that include healthcare, education, manufacturing, and textiles, with observed victims located in the United States (New York and North Carolina), Venezuela, and Italy. Technical details shared by the gang reveal that they encrypt files with a .bl00dy extension and claim to have derived their ransomware strain from the Lockbit builder, describing themselves as a 'son of Lockbit'. They advertise custom builds for Linux, Windows, NAS, and ESXI platforms for $800 and promote the sale of decryptors after ransom payment. The gang primarily communicates through a Telegram channel where they post proof of claims, recruit penetration testers, and negotiate with victims.

One of the earliest documented campaigns involved a New York medical practice, Primary Care of Long Island, and its associated vendor OnCallPractice, where the gang asserted unauthorized access and exfiltration of patient data including names, addresses, Social Security numbers, and dates of birth, while threatening to sell approximately 900 GB of the stolen information. In a separate incident, the Bl00dy Ransomware Gang claimed responsibility for intrusions into two North Carolina schools, Socrates Academy and Movement School, posting screenshots on Twitter as proof of the alleged breach. The group also announced an attack on the Venezuelan textile company Telas Palo Grande, sharing alleged screenshots and CSV files on its Telegram channel, although the victim did not confirm the incident. Additionally, the gang publicized a ransomware operation against the Italian metal producer Lucchini Group, stating in a Telegram message that the company’s servers were encrypted, providing a seven‑day window for negotiation, and warning that any independent recovery attempts would permanently damage files. These publicly reported actions illustrate the gang’s pattern of claiming data theft and encryption, offering ransom‑based decryption, and leveraging multiple communication platforms to pressure victims.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 4 sources.