Wallstreet — Ransomware Profile

Wallstreet is a data-theft extortion group that runs a Tor-based leak site and lists a Tox ID for victim contact. WatchGuard tracks it as a data broker using direct extortion, double extortion and re-leaks, and dates its first observed extortion, a listing of Indian manufacturer Omax Autos, to 13 April 2026, about two months before the group appeared on other ransomware-tracking platforms in late June 2026. That Omax Autos listing recycled a victim originally claimed by LockBit in March 2026 and re-listed by the LeakBazaar site in May 2026. SOCRadar reports that the group gains access through compromised credentials and remote-access services such as VPN and RDP, and its leak site has claimed more than 25 victims, mainly in the United States, with the pace of claims rising sharply from September 2026.

IntelFusions coverage (2)

Recent claimed victims

Vendor research

Read the full analysis on IntelFusions