ms13089

Executive Summary

MS13089, also known as ms13-089, is a newly emerged ransomware group first observed in December 2025. The group operates primarily as a double extortion actor, targeting victims with both data encryption and exfiltration. Their activities have been limited to a few incidents, including the compromise of a law firm, suggesting an emerging threat that organizations should monitor closely.

Goals & Targeting

The strategic objectives of MS13089 appear to be driven by the pursuit of financial gain through ransom payments. Their targeting profile suggests a focus on sectors or organizations where data value is high, such as law firms, which may possess sensitive client information. The group's geographic targeting remains unclear, but their limited activity indicates they may still be developing their operational playbook.

MS13089 is a relatively new ransomware group that surfaced in December 2025. The group's name appears to be a nod to Microsoft Security Bulletin MS13-089, possibly reflecting an interest in leveraging or targeting Microsoft-related vulnerabilities or services. Operating as a double extortion actor, the group encrypts victims' data and demands ransoms for decryption keys while also threatening to release stolen information unless paid. Their primary focus has been on financial gain through ransom payments, with known victims including a law firm. The group's operational timeline is short, with activity observed between December 2025 and May 2026.

Key Capabilities

• Ransomware deployment
• Double extortion tactics (ransom and data exfiltration)
• Use of anonymous communication channels for extortion demands

MITRE ATT&CK Tactics

Campaigns & Victims

MS13089 has been linked to a limited number of campaigns, with one notable example involving the compromise of Brittany Residential. The group's short lifespan and limited victim count suggest they are either in an active development phase or undergoing operational maturation.

IOC Patterns

• Spear-phishing emails with extortion demands
• Use of onion-based email accounts for communication
• Encrypted data exfiltration from targeted systems

Recommended Actions

• Implement robust email filtering and anti-phishing solutions to detect and block suspicious messages.
• Educate employees on recognizing phishing attempts and double extortion tactics.
• Monitor network traffic for signs of data exfiltration or unauthorized communication channels.
• Deploy endpoint detection and response (EDR) tools to catch ransomware activity early.
• Regularly back up critical systems and store backups offline to mitigate the impact of ransomware attacks.

Suggested Tags