Emperador — Ransomware Profile

Emperador is a double-extortion crew whose data-leak site began listing victims in August 2026; among its earliest claims was the City Government of Baguio in the Philippines, from which it said it exfiltrated 2.9 GB of contracts, permits and financial records per DeXpose. WatchGuard's ransomware tracker places its first known activity in July 2026 and describes a ransomware-as-a-service operation that encrypts files with ChaCha20, appends 15 random characters to file extensions, and negotiates over Tor, Session and Tox. Ransomware.live tracked at least ten claimed victims across seven countries within the group's first weeks, including Vietnam Electricity's Hanoi utility, Hanwha Renewables, Spain's FRUCASTRO SL and Brazil's Uniguacu, spanning government, energy, education and technology. All listings are leak-site claims rather than independently confirmed breaches.

IntelFusions coverage (4)

Recent claimed victims

Read the full analysis on IntelFusions