ransomware

apt73

Provisional

Ransomware

Motivation

—

Attribution confidence

Provisional — not yet assessed

Provisional profile auto-created from leak-site claims — not analyst-vetted. A group's self-claim of a victim, not a confirmed breach.

Why it mattersRansomware actor, unrated confidence.

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Targets

dgcement.comtargetLeak-site claim · ransomware.live2026-07-06
aydeniz.comtargetLeak-site claim · ransomware.live2026-07-03
tkgm.gov.trtargetLeak-site claim · ransomware.live2026-05-22
haca.matargetLeak-site claim · ransomware.live2026-04-27
amtaar.comtargetLeak-site claim · ransomware.live2026-04-27
gedco.pstargetLeak-site claim · ransomware.live2026-04-27
moccae.gov.aetargetLeak-site claim · ransomware.live2026-04-27
shj.aetargetLeak-site claim · ransomware.live2026-04-27
2m.matargetLeak-site claim · ransomware.live2026-04-27
iam.matargetLeak-site claim · ransomware.live2026-04-27
banak.comtargetLeak-site claim · ransomware.live2026-04-27
arrawdah.org.satargetLeak-site claim · ransomware.live2026-04-27
ires.matargetLeak-site claim · ransomware.live2026-04-27
algosaibi-gtb.comtargetLeak-site claim · ransomware.live2026-04-27

External aliases

via 1 crosswalk source

Additional names this actor is known by across other vendors' naming schemes — cross-referenced from external crosswalk sources, not RaqibCTI's own curated aliases (shown at the top of this page). Each source is attributed to its own licence.

APTmap

APT73Eraleig

via APTmap (CC BY 4.0) ↗

History

History profile is being researched

Will appear here shortly. Tracker note: apt73 is a ransomware group auto-tracked from public leak-site victim claims. This is a provisional, lightweight profile created because the group cleared an activity threshold — it has not been analyst-vetted and makes no attribution claim.

Useful?