Leak site not responding

Hotarus ransomware group

Hotarus is one of the extortion operations we watch continuously. This page covers what is known about the group and the current state of its leak site, which we last saw change 5y ago.

Leak site statusOfflinenot answering

Tracked since—no dated record

Last activity5y ago22 Oct 2021 04:52 UTC

Sectors observed—none stated

Who they are

Hotarus is a ransomware and data extortion group first observed in March 2021, believed to be linked to threat actors of Latin American origin. The group has targeted entities in South America and the United States, including financial institutions, government agencies, and private companies. Hotarus is known for deploying both custom ransomware and publicly available tools, alongside stealing sensitive information for double-extortion purposes. The group has been observed exploiting vulnerable web services, using stolen credentials, and leveraging publicly available post-exploitation frameworks to gain persistence in victim networks. Encrypted files are typically appended with extensions such as .hotarus or campaign-specific identifiers, and ransom notes direct victims to communicate via encrypted email services. Notably, in some campaigns, Hotarus deployed data leak threats without encrypting files, focusing solely on exposure as a pressure tactic.

Descriptions are compiled from public reporting and vendor research. They describe how a group has historically operated and can lag its current behaviour; the status and timings above are our own.

Current status

Hotarus's leak site is not answering. Sites go dark for infrastructure trouble, a deliberate quiet period, or a takedown, and a good number return weeks later under the same name, so the entry stays on the list either way.

The last change we recorded on it was 5y ago (22 Oct 2021 04:52 UTC).

Which organisations this group has named, and when, is part of the SINON platform rather than this page. Create an account to search it, or to be told automatically if a name you care about turns up.

Sectors targeted

Industries this group has been observed going after, most common first.

This group does not state an industry on its site, so we have nothing reliable to report. Most crews are opportunistic rather than sector-specific in any case — they hit what they can reach.

Watching for your name

If Hotarus posts your company, a supplier or a subsidiary, you want to hear it from us rather than from a journalist. SINON checks these sites continuously and alerts on the names you give it.

Start monitoring