Cyber Threat Actor: Hotarus Corp

Hotarus Corp, alsoknown as Hotarus Corp, is a threat actor that has been linked to ransomware operations originating from Russia. The group has targeted governmental and financial institutions, specifically compromising Ecuador's Ministry of Finance and the country's largest private bank, Banco Pichincha. Their stated objective is financial gain, as they have publicly declared that the attacks are conducted solely for money.

In the Ecuador incidents Hotarus Corp employed a PHP‑based ransomware strain identified as Ronggolawe (also referred to as AwesomeWare) to encrypt online training platforms and other systems. Initial access to the bank’s network was achieved through a compromised marketing firm, which served as a launchpad for moving laterally into the bank’s internal environment. After gaining entry, the actors exfiltrated data, released a text file containing 6,632 login names and hashed password combinations on a hacker forum, and deployed ransomware to encrypt devices. They also claimed to have stolen large volumes of customer records, including credit‑card information, which they said they were selling or preparing for auction. The actors communicated their claims and negotiations directly to BleepingComputer, providing details about the alleged sales and pricing of the stolen data.

The group’s most publicly documented operation is the February 2026 attack on Ecuador’s Ministry of Finance and Banco Pichincha, during which they asserted the theft of 31,636,026 million customer records and 58,456 sensitive system records. Hotarus Corp told reporters that they had already sold about 37 thousand of the purported credit‑card numbers to a dedicated carding group and that the remaining data would be auctioned or sold for an initial price of 250,000. While the actors claimed financial motivation, independent verification of the alleged data theft has not been confirmed. No public linkage to a state sponsor or larger criminal consortium has been established beyond the actor’s reported Russian location.