RADAR

Radar is a cybercriminal threat actor identified in the provided reporting as both a ransomware group and an initial access broker (IAB). Reporting cited in the content states that four new ransomware groups emerged in 2025, including Radar. Separate reporting describes RADAR as a known IAB that listed RDP access to a Swiss company for sale in mid-October; that victim reportedly appeared on RansomHub’s leak site just over a month later, indicating a likely handoff of access to a downstream ransomware operator. The content also states that the RADAR group carried out a cluster of attacks against the real estate sector. Based on the provided material, Radar’s observed activity includes brokering or selling compromised remote access, specifically RDP access, and conducting attacks associated with the real estate sector. No nation-state attribution is provided in the content, and no additional aliases or sub-groups are mentioned beyond the name RADAR/Radar.