Actor Profile

🏹 apos — Ransomware

Apos is a data-broker extortion group that surfaced in April 2024, focusing on data exfiltration and threatening to publish or sell stolen information rather than encrypting files, targeting technology, healthcare, manufacturing, telecom, and government sectors across multiple countries.

🔄 Pivot:🌎 BR 🏹 apos

Classification

Ransomware

Leak-site victims

Ransomware.live

Associated IoCs

local intel

MITRE techniques

—

ATT&CK

Tracked

Yes

Ransomware.live

PIVOT🔍 Advanced Search 🕵 OSINT Pivot 🔗 Link Analysis 🕑 Timeline 📤 Export STIX/MISP

🔥 Leak-Site Victims (16)

Victim	Country	Published	Domain
ACMARK		2025-08-15T14:14:48.552958+00:00	`acmark.com`
wow pictures	AU	2025-06-12T09:07:55.421959+00:00	`wow pictures.com.au`
Ha******.us		2025-06-12T09:07:30.402430+00:00	`Ha******.us`
infraestructures.cat	ES	2025-06-12T09:07:07.258954+00:00	`infraestructures.cat`
Lawton Partners	CA	2025-06-12T09:06:42.635618+00:00	`lawtonpartners.ca`
RH	GB	2025-06-12T09:08:22.372491+00:00	—
KIU System Solutions	AR	2025-03-17T08:38:38.580426+00:00	`kiusys.com`
InternetWay	BR	2025-03-04T04:48:48.035995+00:00	`internetway.com.br`
Netcom-World	US	2025-03-04T04:50:16.055135+00:00	`netcom-world.com`
M-1 TOOLWORKS	US	2025-02-20T10:19:08.713606+00:00	`m1toolworks.com`
Auxis	US	2025-01-04T11:38:30.401632+00:00	`auxis.com`
Drogarias Preço Bom	BR	2024-10-27T19:22:18.189288+00:00	`bomprecodrogarias.com.br`
Sunlux Group	FR	2024-04-29T15:38:11.611229+00:00	`sunlux-group.com`
Algen Healthcare	IN	2024-04-29T15:38:10.479687+00:00	`algenhealthcare.co`
Bitz Softwares	BR	2024-04-29T15:38:09.214545+00:00	`bitzsoftwares.com.br`
Drogaria Preco Bom	BR	2024-04-29T15:38:12.897021+00:00	`bomprecodrogaria.com.br`

Source: Ransomware.live leak-site monitoring (cached, offline-safe).

MITRE ATT&CK Groups ↗ Ransomware.live ↗ APT Theater →

📁 Case Management

Attach to case

Role

+ New case from this

🏹 Campaigns & malware

Campaigns →Malware families →Nation-State theater →Sanctions →Wanted & Rewards →

🏹 Add to case

Attach apos (Actor / APT) and pull all linked entities: pull linked

🗃 Data Management

+ Case + Campaign Watchlist Tag Save search Whitelist Export STIX/MISP Report

🧩 Advanced Capabilities

Link Analysis Pivot Explorer Timeline Threat Hunting Analytics Detection Rules Blockchain OSINT Pivot Passive DNS TAXII 2.1 MISP Feed Create Alert Rule NetFlow Coverage & Gaps

🧭 Intelligence disciplines

CYBINT →OSINT →HUMINT →GEOINT →

Live group profile & victims via Ransomware.live; ATT&CK technique hints are a static reference for well-known groups. All network calls cached & offline-safe.

Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook