End Zone — Ransomware Profile
End Zone, which brands itself EndZone on its data-leak site, is an emerging extortion crew that WatchGuard's ransomware tracker classifies as a data broker operation combining direct extortion, double extortion and free data leaks, and records as first seen in September 2026. WatchGuard also lists the group's contact channels on Telegram, Tor, Session and Tox, and its earliest tracked victims in the telecommunications and information technology sectors, both in the United States. The group was first observed on its own leak site in September 2026, when it listed at least three American organizations, among them the government software vendor Accela and the carrier AT&T. The dark web monitoring firm DeXpose recorded the Accela post, in which the crew claimed more than 50 GB of data. Those listings are extortion claims rather than confirmed breaches.
Recent claimed victims
Read the full analysis on IntelFusions