0APT

Profile narrative

0APT operates as a ransomware group that develops malicious encryption tools and maintains a leak site for publishing stolen data. The group creates ransomware payloads, manages affiliate networks, and coordinates the distribution of the malware. Its core product is the ransomware itself, which it offers to associates for use in attacks.

0APT’s organisational structure includes administrators, affiliates and operational data that were exposed in a 2026 incident. On 2026-04-01 a rival ransomware group leaked logs, source code and system files from 0APT’s infrastructure, defaced its leak site and left a warning message. This exposure revealed the group’s internal communications and technical assets. The incident followed an earlier episode in which 0APT posted a fabricated victim list and claimed responsibility for attacks on other ransomware operators.

The group is distinguished by its involvement in public feuds with rival ransomware crews, using leaks and defacements as tactical weapons. Its willingness to fabricate victim lists and assert attacks on peers sets it apart from many ransomware actors that focus solely on extortion. No explicit information about ownership, parent or subsidiary relationships is available in the source material.

Incidents

1 incident linked to this organisation.