Metaencryptor
Attribution profile
- Type
- Undetermined
- Location
- -
- Known incidents
- 3 incidents
- Sources
- 0 sources
- First seen
- 2023-07-25
- Last seen
- 2026-09-17
- Updated
- 2026-10-03 02:08
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Metaencryptor (also seen as Metaencrypter) is a threat actor that has claimed responsibility for a ransomware attack on a Munich‑based non‑fiction publishing group in July 2023, encrypting and deleting most of the victim’s data while stealing author personal and financial information and demanding a ransom that was refused. The same alias appeared in a September 2026 claim of intrusion against AECOM, asserting the theft of about 1.22 TB of data, although that incident remains unconfirmed. Observed tactics include ransomware deployment, data exfiltration, and extortion attempts; no specific malware families or initial‑access vectors are described in the public reports. No state affiliation or criminal‑consortium links have been publicly established. The actor's known activity is limited to these two reported operations, with the Munich publishing attack representing a confirmed financially motivated campaign.
Incidents
Attributed incidents are available to members.
3 incidentsSources
Sources available to members: 0 sources.