eraleign (apt73)

ransomware group

Rebrand to Bashe in October 2024. <br/>Eraliegn, self-styled as APT73 and formerly known as Bashe, surfaced in April 2024. Rather than conducting real ransomware campaigns, the group specializes in fabricating data breach narratives, curating or reusing existing leaked data (often from years-old breaches) and presenting it on a Tor-hosted leak site to project credibility. They claim to have breached organizations across sectors—such as banking, travel, manufacturing, and IT—targeting entities in countries including the United Kingdom, India, Indonesia, France, and Canada. However, threat analysis shows these claims are deceptive in nature rather than demonstrative of technical prowess or active network compromise.