Back to Threat Groups

icefire

INACTIVE

ransomware group

IceFire is a ransomware group first observed in 2022 that expanded to Linux in early 2023 by exploiting a vulnerability

Victims
11
records
First Discovered
Aug 20, 2022
victim
Last Discovered
Aug 20, 2022
victim
Inactive Since
1,457
days
Countries
3
hit
Avg Discount
—
no settlements

Group Activity

Last 12 months
Sep
2025
Oct
2025
Nov
2025
Dec
2025
Jan
2026
Feb
2026
Mar
2026
Apr
2026
May
2026
Jun
2026
Jul
2026
Aug
2026

Victims (11)

*.algotrader.com

icefire
Aug 20, 2022
Technology1.0Published
algotrader.com

*.bestservers.pro

icefire
Aug 20, 2022
Technology1.0Published
bestservers.pro

*.iperactive.com.ar

icefire🇦🇷 AR
Aug 20, 2022
Technology1.0Published
iperactive.com.ar

*.cco1.com

icefire
Aug 20, 2022
Technology1.0Published
cco1.com

*.vps-vds.com

icefire
Aug 20, 2022
Technology1.0Published
vps-vds.com

*.guneshosting.com

icefire
Aug 20, 2022
Technology1.0Published
guneshosting.com

*.kodhosting.com

icefire
Aug 20, 2022
Technology1.0Published
kodhosting.com

*.kru.ac.th

icefire🇹🇭 TH
Aug 20, 2022
Education1.0Published
kru.ac.th

*.directfn.net

icefire
Aug 20, 2022
Financial Services1.0Published
directfn.net

*.feesh.ch

icefire🇨🇭 CH
Aug 20, 2022
Consumer Services1.0Published
feesh.ch

*.skifgroup.com

icefire
Aug 20, 2022
Manufacturing1.0Published
skifgroup.com

Infrastructure

leak site
OFFLINE

unreachable

http://nxx3cy6aee2s53v7v5pxrfv7crfssw7hmgejbj47cv6xuak3bgncllqd.onion/

3827ms

5d ago

leak site
OFFLINE

unreachable

http://7kstc545azxeahkduxmefgwqkrrhq3mzohkzqvrv7aekob7z3iwkqvyd.onion/board/victim_list/

8106ms

5d ago

leak site
OFFLINE

unreachable

http://kf6x3mjeqljqxjznaw65jixin7dpcunfxbbakwuitizytcpzn4iy5bad.onion/board/leak_list/

2506ms

10d ago