Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.
FunkSec is a ransomware-as-a-service operation that surfaced in late 2024, notable for its apparent use of AI-assisted malware development and a rapid, high-volume stream of extortion claims.
Additional names this actor is known by across other vendors' naming schemes — cross-referenced from external crosswalk sources, not RaqibCTI's own curated aliases (shown at the top of this page). Each source is attributed to its own licence.
FunkSec emerged in late 2024 and quickly drew attention by claiming roughly 85 victims in December 2024, per Check Point Research. It presents as a RaaS using double extortion (data theft plus encryption) and mixes cybercrime with hacktivist messaging. Check Point assessed that some of its tooling — including a custom encryptor (FunkLocker), a DDoS tool, and utilities — was likely produced with AI assistance by a relatively inexperienced author assessed as likely based in Algeria, which may explain the group's rapid iteration.
By early 2025, FunkSec had been linked to 120+ claimed victims across government, defense, technology, financial services and higher education. Researchers have cautioned that the group's claim volume and low apparent sophistication mean many listings may be inflated, recycled, or partly fabricated.
FunkSec has claimed victims in Egypt among its listings. Given the noted reliability concerns, these leak-site claims should be treated as unverified allegations rather than confirmed breaches unless independently corroborated.