Genesis
ObscureIQ Threat Intelligence · Actor Profile
GenesisConfidence: Medium
Ransomware
Also known as: Genesis (ransomware group)
Motivation: Financial
4Attributed Breaches Circulating
MediumAttribution Confidence
RansomwareActor Type
Overview
First observed late 2025 with double extortion against small-to-mid US organizations in business services, healthcare, manufacturing, financial services, and construction, claiming 90+ victims by mid-2026. Heavy data-exfiltration-and-leak focus with a Tor v3 leak site and Bitcoin ransom. Distinct from the Genesis Market credential marketplace seized in 2023.
Tactics, Targeting & TTPs
Heavy data-exfiltration-and-leak focus; Tor v3 leak site; Bitcoin ransom with ~48h first-contact window and ~10-day deadlines. DISTINCT from the Genesis Market credential marketplace (seized 2023).
Source
Attribution draws on public threat-intelligence reporting · Established (multi-source). Primary source →
Were you exposed in one of these breaches?
Check your exposure privately, or request a tailored exposure audit.