Morpheus — Ransomware Profile

Morpheus emerged in late 2024 as a semi-private RaaS operation whose affiliates share identical payloads with the HellCat ransomware group, targeting pharmaceutical, manufacturing, legal, and Italian ESXi environments with ransom demands reaching up to 32 BTC (~$3M USD).

Recent claimed victims

Yue Ki Industrial 2026-07-30
Kyowa Singapore Pte Ltd 2026-07-21
Hansa Research Group Pvt. Ltd 2026-07-06
Delegal Poindexter & Underkofler, P.A. 2026-06-25
HDFC FUND 2026-06-10
3I INFOTECH 2026-06-08
BAYTECH A/S 2026-05-14
GGI 2026-04-21
SBCTANZANIA 2026-03-30

Vendor research

HellCat and Morpheus | Two Brands, One Payload as Ransomware Affiliates Drop Identical Code SentinelOne
TRACKING RANSOMWARE : JANUARY 2025 CYFIRMA
Technical Analysis of TransferLoader Zscaler ThreatLabz
Last Year in Ransomware: Top Ransomware Groups and Emerging Threat Actors Halcyon

Read the full analysis on IntelFusions