Argonauts Group ransomware group
Argonauts Group is one of the extortion operations we watch continuously. This page covers what is known about the group and the current state of its leak site, which we last saw change 2y ago.
Who they are
Argonauts Group is a data extortion operation that surfaced around September–October 2024, primarily targeting organizations in Italy, as well as entities in Taiwan, Japan, Canada, and the U.S. It does not appear to use conventional file-encryption ransomware methods—instead, it steals data and operates a dedicated data leak site (DLS) to pressure victims into paying. Victims span sectors like technology, manufacturing, transportation/logistics, and healthcare. The group has claimed to steal substantial volumes of sensitive information—e.g., 200 GB from Ivy Life Sciences (Taiwan) and 140 GB from Japan’s Zacros—and publicly disclosed some samples on its leak site. Although some references imply prior activity back to October 2021, these appear to be less reliable and not substantiated by authoritative intel. As of now, there is no clear evidence of traditional ransomware encryption, ransom notes, or RaaS infrastructure.
Current status
Argonauts Group's leak site is not answering. Sites go dark for infrastructure trouble, a deliberate quiet period, or a takedown, and a good number return weeks later under the same name, so the entry stays on the list either way.
The last change we recorded on it was 2y ago (27 Mar 2025 20:04 UTC).
Which organisations this group has named, and when, is part of the SINON platform rather than this page. Create an account to search it, or to be told automatically if a name you care about turns up.
Sectors targeted
This group does not state an industry on its site, so we have nothing reliable to report. Most crews are opportunistic rather than sector-specific in any case — they hit what they can reach.
Watching for your name
If Argonauts Group posts your company, a supplier or a subsidiary, you want to hear it from us rather than from a journalist. SINON checks these sites continuously and alerts on the names you give it.
Start monitoring