019ff696 8b71 76be Ae3b 5a37071ca975
Emperador is a financially motivated ransomware and data-extortion group publicly active by September 2026. Its extortion campaigns target organizations across multiple countries and sectors, including industrial services, information technology, construction materials, food and beverages, energy, healthcare, and retail. Named targets include AB InBev, SEVENOAKS, SitePro Rentals, and Frommann Energie. The group demands cryptocurrency payments and threatens to publish sensitive corporate, employee, and customer information unless victims pay or enter negotiations. Public demands have included $150,000 payable in Monero and $1 million payable in Bitcoin. Its extortion messages also threaten employees, customers, and business partners to increase pressure on targeted organizations. Emperador has claimed both data theft and file or server encryption, although those technical claims have not been independently established. Its initial-access methods, ransomware tooling, organizational structure, and country of origin remain unestablished.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Government & Administration
Commercial & Professional Services
Consumer Discretionary Distribution & Retail
Food, Beverage & Tobacco
Health Care Equipment & Services
Geographies tied to known operations.
🇧🇦 Bosnia & Herzegovina
🇭🇰 Hong Kong SAR China
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
6 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The version that knows your environment.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
