Back to Threat Groups

freecivilian

INACTIVE

ransomware group

FreeCivilian is a data extortion group with suspected ties to Russian GRU military intelligence, known for targeting Ukr

Victims
14
records
First Discovered
Dec 31, 2022
victim
Last Discovered
Dec 31, 2022
victim
Inactive Since
1,324
days
Countries
1
hit
Avg Discount
—
no settlements

Group Activity

Last 12 months
Sep
2025
Oct
2025
Nov
2025
Dec
2025
Jan
2026
Feb
2026
Mar
2026
Apr
2026
May
2026
Jun
2026
Jul
2026
Aug
2026

Victims (14)

mfa.gov.ua

freecivilian🇺🇦 UA
Dec 31, 2022
Public Sector1.0Published
mfa.gov.ua

minagro.gov.ua

freecivilian🇺🇦 UA
Dec 31, 2022
Public Sector1.0Published
minagro.gov.ua

mon.gov.ua

freecivilian🇺🇦 UA
Dec 31, 2022
Public Sector1.0Published
mon.gov.ua

kmu.gov.ua

freecivilian🇺🇦 UA
Dec 31, 2022
Public Sector1.0Published
kmu.gov.ua

gkh.in.ua

freecivilian🇺🇦 UA
Dec 31, 2022
Public Sector1.0Published
gkh.in.ua

bdr.mvs.gov.ua

freecivilian🇺🇦 UA
Dec 31, 2022
Public Sector1.0Published
bdr.mvs.gov.ua

kyivcity.com

freecivilian
Dec 31, 2022
Public Sector1.0Published
kyivcity.com

motorsich.com

freecivilian
Dec 31, 2022
Manufacturing1.0Published
motorsich.com

mtsbu.ua

freecivilian🇺🇦 UA
Dec 31, 2022
Telecommunication1.0Published
mtsbu.ua

health.mia

freecivilian
Dec 31, 2022
Healthcare1.0Published
health.mia

minregion.gov.ua

freecivilian🇺🇦 UA
Dec 31, 2022
Public Sector1.0Published
minregion.gov.ua

wanted.mvs.gov.ua

freecivilian🇺🇦 UA
Dec 31, 2022
Public Sector1.0Published
wanted.mvs.gov.ua

e-driver.hsc.gov.ua

freecivilian🇺🇦 UA
Dec 31, 2022
Public Sector1.0Published
e-driver.hsc.gov.ua

diia.gov.ua

freecivilian🇺🇦 UA
Dec 31, 2022
Public Sector1.0Published
diia.gov.ua

Infrastructure

leak site
OFFLINE

unreachable

http://gcbejm2rcjftouqbxuhimj5oroouqcuxb2my4raxqa7efkz5bd5464id.onion/

8484ms

3d ago