Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started
Threat Actors abyss

abyss

TLP:CLEAR
Active
Kill Chain Analysis Generate Graph Hunt Package

Description

Abyss (also known as Abyss Locker) is a ransomware operation first identified in March 2023, derived from the Babuk source code, that targets Windows and Linux/VMware ESXi systems using double-extortion tactics across healthcare, manufacturing, finance, and technology sectors — predominantly in North America. Known victims: 87

Goals & Targeting

Objectives

Ransomware
Financial Gain

AI Analysis

No AI analysis yet.

ATT&CK Techniques

No techniques linked yet.

Software / Tooling

No tools linked yet.

Campaigns / Victims

All campaigns →
Inactive

abyss: School Facility Consultants

Ransomware attack attributed to abyss. | Sector: Business Services | School Facility Consultants (SFC) is a full-service company that provides expert guidance in school facility planning and funding for School Districts, County Offices of Education, and Charter Schools across California. | Source: https://www.ransomware.live/id/U2Nob29sIEZhY2lsaXR5IENvbnN1bHRhbnRzQGFieXNz

Jun 1, 2026

TLP:CLEAR
Inactive

abyss: landkreis-limburg-weilburg.de

Ransomware attack attributed to abyss. | Country: DE | Sector: Public Sector | Website: landkreis-limburg-weilburg.de | Infostealer data confirmed. | The district administration of Limburg-Weilburg County in the state of Hesse, Germany. The organization performs local government functions and is responsible for a wide range of public services for the district's residents. | Source: https://www.ransomware.live/id/bGFuZGtyZWlzLWxpbWJ1cmctd2VpbGJ1cmcuZGVAYWJ5c3M=

Jun 1, 2026

TLP:CLEAR
Inactive

abyss: technic.com

Ransomware attack attributed to abyss. | Country: US | Sector: Technology | Website: technic.com | Infostealer data confirmed. | Founded in 1944 and headquartered in Woonsocket, Rhode Island, Technic Inc. is an international supplier of electroplating chemicals and equipment. | Source: https://www.ransomware.live/id/dGVjaG5pYy5jb21AYWJ5c3M=

May 14, 2026

TLP:CLEAR

Observed Data

No observed data linked yet.

Indicators of Compromise

No IOCs linked yet.

References

No references recorded yet.

Intel Summary

0

Techniques

0

Tools

3

Campaigns

0

IOCs

0

Observed Data

0

Tactics

Tags

Ransomware
Healthcare Targeting
Critical Infrastructure

Details

Type
Criminal
Sophistication
Medium
Primary Motivation
Organizational gain
Confidence
80%
First Seen
Mar 21, 2023
Last Seen
Jun 1, 2026
Added
May 4, 2026
Notes
0
Log in to add a note
No notes yet. Click "Add Note" to create the first analysis note.
Opinions
0
Log in to add an opinion
No opinions yet. Be the first to assess this intelligence.
Leaving Threaticon

This link opens an external site that isn't part of the platform.