Back to Threat Groups

united legion

ACTIVE

ransomware group

联合军团 UL / United Legion <br/>SNOWSOUL (claimed RSA-2048/AES-256 encryption) and QINGLONG (claimed Kyber plus AES-256, written in Go). <br/>It says affiliates pay a 10% commission and lists email and qTox contact options. <br/>

Victims
1
records
First Discovered
Nov 5, 2026
victim
Last Discovered
Nov 5, 2026
victim
Inactive Since
0
days
Countries
0
hit
Avg Discount
—
no settlements

Group Activity

Last 12 months
Dec
2025
Jan
2026
Feb
2026
Mar
2026
Apr
2026
May
2026
Jun
2026
Jul
2026
Aug
2026
Sep
2026
Oct
2026
1
Nov
2026

Victims (1)

我们是SnowSoul

united legion
2h ago
Published

Infrastructure

leak site
ONLINE
http://torpje7g4vkxiqgc473dro7onbpkgmryhj6jd67anwy5jh7jknsjuzid.onion:88/

1868ms

42m ago