Ransomware group
WorldLeaks
WorldLeaks is a ransomware threat group/malware name referenced as part of ransomware alliances active in 2025.
Profile source: Mallory opens in a new tabWorldLeaks
Family profile
WorldLeaks is a ransomware threat group/malware name referenced as part of ransomware alliances active in 2025. The provided content places WorldLeaks alongside Qilin and SafePay as central to alliances targeting business services, manufacturing, and healthcare. The context identifies it within broader ransomware activity characterized by extortion operations and collaboration among groups, but does not provide specific technical details on WorldLeaks’ malware functionality, infection chain, payload behavior, or indicators of compromise. Based on the available content, the high-confidence assessment is that WorldLeaks is associated with ransomware operations targeting business services, manufacturing, and healthcare sectors as part of cooperative criminal alliances.
Ransomware.live
Operational record
Ransomware.live
Recent claims
MITRE ATT&CK
WorldLeaks in ATT&CK
3 distinct techniquesReporting
Research mentioning WorldLeaks
Nov 27
Cio Security
10월 랜섬웨어 공격 41% 급증…연합 확대가 증가세 이끌어
래피드7은 칠린, 세이프페이(SafePay), 월드릭스(WorldLeaks) 등이 비즈니스 서비스·제조·헬스케어 산업을 집중 공격한 연합의 중심에 있었다고 밝혔다.
Nov 26
Cso Online
Alliances between ransomware groups tied to recent surge in cybercrime
Groups such as Qilin, SafePay, and WorldLeaks led a wave of alliances targeting industries like business services, manufacturing, and healthcare, Rapid7 reports.
