Settra — Ransomware Profile

Settra is a data-theft extortion group whose dark web leak site was first observed in late June 2026, claiming 22 victims across 11 countries within its first days of activity. The group posts victim names and claimed data volumes on its Tor leak site and communicates via Tox messenger; no encryptor attributed to Settra has been publicly analyzed, and trackers classify it as an exfiltration-only, data-broker-style extortion operation. Initial access is associated with credentials harvested by infostealer malware, and roughly a third of its listed victims show prior infostealer data exposure. Its claims appear original rather than recycled from other leak sites, and its claimed breach of Taiwan's PChome Online prompted incident response at subsidiary Pi Mobile and a Personal Data Protection Act inquiry by Taiwan's Ministry of Digital Affairs, though PChome states no compromise of its core systems has been detected. Settra describes itself as purely financially motivated with no country or industry restrictions, and its victims to date are concentrated in United States manufacturing, consumer services, and business services organizations.

IntelFusions coverage (10)

Tools & malware

Recent claimed victims

Vendor research

Read the full analysis on IntelFusions