DataCarry

DataCarry is a ransomware-associated extortion operation that emerged in 2025 and has been observed targeting organizations across multiple countries and sectors. Reported victimology includes aviation, education, finance, insurance, and healthcare, with additional reporting placing it among ransomware variants frequently observed against European financial institutions. The operation has also been described as part of a broader wave of short-lived, rapidly branded ransomware groups that emphasize operational speed, shared criminal infrastructure, and leak-site driven coercion.

Available reporting indicates that DataCarry has, in some cases, relied on data theft and leak-based extortion without deploying a traditional file-encrypting locker. This places it within the broader 2025 trend of exfiltration-first or extortion-only ransomware activity, where public exposure of stolen data is used as the primary pressure mechanism. High-confidence attribution of a distinct custom malware payload, encryption routine, or unique technical tradecraft beyond extortion activity is currently not available.

DataCarry has been linked to abuse-resistant hosting infrastructure, including a bulletproof hosting provider identified in reporting as PFCloud. Such infrastructure is commonly used to support ransomware and extortion operations by providing resilient hosting for leak sites, command-and-control functions, and data staging. The group has been mentioned alongside other contemporary ransomware and extortion brands such as Akira, BlackLock, Dire Wolf, Silent Team, and J Group, reflecting its place in the fragmented 2025 ransomware ecosystem.

The operation appears financially motivated and focused on organizations whose data exposure can create regulatory, reputational, or operational pressure. Reporting also notes disclosure of victim organizations in eight countries and public leakage of personal records associated with one of its campaigns. While DataCarry is consistently referred to as a ransomware group, the strongest supported characterization is an extortion-focused ransomware operation centered on data exfiltration and public leak pressure.