Tox
1 total457BB4E5DF0E650509322CA894758D925A568828090A3449D5AEEED30E9B8E18DDDFF71909ED
Ransomware group
PEAR
PEAR, also expanded as Pure Extraction and Ransom, is a data-theft and extortion threat actor that emerged in 2025.
Profile source: Mallory opens in a new tabPEAR
Family profile
PEAR, also expanded as Pure Extraction and Ransom, is a data-theft and extortion threat actor that emerged in 2025. The group is characterized by operating without routine file encryption, instead focusing on stealing large volumes of data and coercing victims through leak-site exposure and threats to publish exfiltrated information. This places PEAR among the newer extortion-only operations rather than traditional encrypt-and-ransom crews.
PEAR has been associated with attacks across multiple sectors, with especially notable activity against healthcare organizations and healthcare-adjacent service providers, including radiology practices, medical billing and revenue-cycle firms, and specialty clinics. Reported victimology also includes financial services, manufacturing, construction, logistics, education, nonprofits, and technology organizations in countries including the United States, Norway, and Singapore. Public reporting indicates the group was active through 2025 and 2026 and claimed substantial aggregate data theft volumes during that period.
The group’s tradecraft centers on network intrusion, data exfiltration, victim listing on a dedicated leak site, and extortion backed by publication threats. In multiple cases, PEAR publicly claimed to have infiltrated internal networks, copied confidential datasets, and threatened full release of stolen material unless ransom demands were met. Available high-confidence reporting supports PEAR’s use of double-extortion-style pressure without the encryption component, making it more accurately described as an extortion actor using ransomware ecosystem tactics than a purely locker-based ransomware operator.
PEAR is widely referred to as both Pear and PEAR, and the expansion Pure Extraction and Ransom has been used to describe the group’s operating model. No verified sub-groups are established in the available information. The actor has been repeatedly noted in reporting on healthcare breach trends as an example of the shift toward pure data theft and extortion operations.
Ransomware.live
Operational record
Ransomware.live
Published indicators
pear@onionmail.org
Ransomware.live
Recent claims
MITRE ATT&CK
PEAR in ATT&CK
20 distinct techniquesTechniques
20 techniques T1078 Valid Accounts T1566 Phishing T1059.001 Command and Scripting Interpreter: PowerShell T1204.002 User Execution: Malicious File T1204.004 User Execution: Malicious Copy and Paste T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1027.013 Obfuscated Files or Information: Encrypted/Encoded File T1055.001 Process Injection: DLL Injection T1056.001 Input Capture: Keylogging T1555.003 Credentials from Password Stores: Credentials from Web Browsers T1005 Data from Local System T1074 Data Staged T1114 Email Collection T1213 Data from Information Repositories T1560.001 Archive Collected Data: Archive via Utility T1041 Exfiltration Over C2 Channel T1567 Exfiltration Over Web Service T1567.004 Exfiltration Over Webhook T1071.001 Application Layer Protocol: Web Protocols T1090.003 Proxy: Multi-hop Proxy
