RansomedVC announced on October 30, 2023, that it was ending its operation and later advertised parts of its infrastructure for sale. That announcement marked a reported shutdown, not proof that every associated person stopped, that the listed assets were sold, or that all the group’s attack claims were genuine.
When did RansomedVC shut down?
ZeroFox Intelligence said RansomedVC was engaging in extortion by the end of August 2023. On October 30, the group posted on its Telegram channel that it no longer wanted to run the project. It subsequently offered infrastructure for sale. By ZeroFox’s November 10 analysis, one leak site had closed, another displayed a closing note, and the forum remained active, apparently to support the sale. ZeroFox’s November 2023 analysis and SecurityWeek’s report describe the sequence.
What did the group offer for sale?
RansomedVC advertised a package that reportedly included two leak sites, a forum, social accounts and a Telegram channel, ransomware builder and source code, affiliate-group access, VPN access to 11 alleged victims, 37 databases, and a malware control panel. These were items on the group’s advertised inventory; the reporting does not establish that each item was genuine, functional, or actually sold. SecurityWeek and ZeroFox covered the offer.
Why did RansomedVC say it was closing?
A November 8 message attributed to the group said that six people associated with the operation may have been arrested and that all 98 affiliates had been fired. Those are claims from the group, not verified counts: ZeroFox said it had not independently confirmed them. Unit 42 later characterized the arrests as alleged and said the shutdown was likely related to law-enforcement intervention, but that assessment does not establish the arrests as fact. Unit 42’s analysis and ZeroFox’s contemporaneous report explain the limits of what was known.
Recommended Free Tools
#1 Best Overall
- World’s First 6TB 2.5” Portable Hard Drive
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
How large was the group’s reported activity?
The counts depend on what was being measured. ZeroFox identified more than 40 extortion victims since August 2023, nearly 60 percent of them based in Europe. NCC Group recorded 44 RansomedVC entries in its September 2023 leak-site dataset, equal to 9 percent of the 514 total leak-site victims it counted that month. Those figures describe monitored or posted claims, not independently confirmed successful intrusions. ZeroFox and NCC Group’s September threat pulse state their respective scopes.
How reliable were RansomedVC’s claims?
Some organizations listed by the group said they had not been hacked, according to Recorded Future News. The outlet quoted ransomware expert Allan Liska saying Ransomed.vc was “more about seeking attention than they are carrying out actual attacks.” That is an expert’s characterization, not a finding that every listed incident was false; individual claims require case-by-case verification.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Did the shutdown end the wider ransomware threat?
ZeroFox expected little effect on ransomware overall: affiliates could move to other ransomware-as-a-service operations, while other actors could buy or repurpose infrastructure. That was a threat-intelligence forecast, not confirmation of a buyer, successor group, or specific migration.
There was also a later possible name change. Analyst1’s 2024 report recounts a December 5, 2023 message on Ransomed[.]vc announcing operations under the name Raznatovic. The report describes communications with a person claiming to lead the operation, but the available account does not independently establish that Raznatovic was run by the same people. A new name announcement alone is not evidence of operator continuity. Analyst1’s report recounts the claim.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Best Value
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Rank #4
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Rank #3
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
