Actor Profile

🏹 Icarus — Ransomware

🔄 Pivot:🌎 US 🏹 Icarus

Classification

Ransomware

Leak-site victims

Ransomware.live

Associated IoCs

local intel

MITRE techniques

—

ATT&CK

Tracked

Yes

Ransomware.live

PIVOT🔍 Advanced Search 🕵 OSINT Pivot 🔗 Link Analysis 🕑 Timeline 📤 Export STIX/MISP

🔥 Leak-Site Victims (12)

Victim	Country	Published	Domain
H*		2026-06-23T11:21:11.952095+00:00	—
H**		2026-06-23T11:20:53.116730+00:00	—
G*		2026-06-23T11:20:33.074222+00:00	—
C*		2026-06-23T11:20:13.855196+00:00	—
Huntress	US	2026-06-22T21:21:56.304797+00:00	—
HDS (Hdscorp)		2026-06-22T21:21:35.847205+00:00	—
Gms-net		2026-06-22T21:21:16.000368+00:00	—
Cqcrm		2026-06-22T21:20:55.241001+00:00	—
Cbassociations		2026-06-22T21:20:34.415723+00:00	—
Klue.com	CA	2026-06-19T10:50:16.523284+00:00	`Klue.com`
thecreditpros.com	US	2026-06-16T09:50:17.769164+00:00	`thecreditpros.com`
Cazh.id	ID	2026-05-05T20:10:06.946129+00:00	`bkdp.cazh.id`

Source: Ransomware.live leak-site monitoring (cached, offline-safe).

MITRE ATT&CK Groups ↗ Ransomware.live ↗ APT Theater →

📁 Case Management

Attach to case

Role

+ New case from this

🏹 Campaigns & malware

Campaigns →Malware families →Nation-State theater →Sanctions →Wanted & Rewards →

🏹 Add to case

Attach Icarus (Actor / APT) and pull all linked entities: pull linked

🗃 Data Management

+ Case + Campaign Watchlist Tag Save search Whitelist Export STIX/MISP Report

🧩 Advanced Capabilities

Link Analysis Pivot Explorer Timeline Threat Hunting Analytics Detection Rules Blockchain OSINT Pivot Passive DNS TAXII 2.1 MISP Feed Create Alert Rule NetFlow Coverage & Gaps

🧭 Intelligence disciplines

CYBINT →OSINT →HUMINT →GEOINT →

Live group profile & victims via Ransomware.live; ATT&CK technique hints are a static reference for well-known groups. All network calls cached & offline-safe.

Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook