Skip to content
Leak-site post naming Deutsche Bank, captured by ThreatCluster
Back to victims

Deutsche Bank

unsafe

Ransomware leak-site victim intelligence

Files
3
Views
43,152
Posted
Jul 4, 2026
Country
DE
Industry
Financial Services

Summary

Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot, our reporting

Unsafe claims to have stolen data from Deutsche Bank, publishing sample PNG files named 12db.png, 6db.png and 2db.png. The leak page identifies the victim as Deutsche Bank and lists exfiltration channels as SFTP, GateKeeper and dbexchange, with the publication status shown as a countdown. ThreatCluster's reporting notes Unsafe claims to have published screenshots allegedly showing employee data in database extracts.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Platforms
SFTP GateKeeper

What was taken

cat cwd_history sftp://[email protected]:5022 1686218522:/inbox sftp://[email protected]:5022 1686217899:/inbox sftp://[email protected]:5022 1686218297:/inbox tail transfer_log 2026-06-17 23:30:06 sftp://[email protected]:5022/inbox/ICM_MD_VRX_MOVE_DBLOU_20260617020003.csv -> /home/db-lounge/dbexchange/ICM_MD_VRX_MOVE_DBLOU_20260617020003.csv 0-1521525 1.33 MiB/s 2026-06-17 23:30:05 sftp://[email protected]:5022/inbox/ICM_TD_VRX_MOVE_DBLOUNG_20260617210005.csv -> /home/db-lounge/dbexchange/ICM_TD_VRX_MOVE_DBLOUNG_20260617210005.csv 0-571534 1.24 MiB/s 2026-06-18 09:30:06 /home/db-lounge/GateKeeper/165720-1_20260618.csv -> sftp://[email protected]:5022/outbox/nonedi/AIMSGKPER/165720-1_20260618.csv 0-685840 866.8 KiB/s 2026-06-18 09:30:06 /home/db-lounge/GateKeeper/rd_165720-1_20260618.csv -> sftp://[email protected]:5022/outbox/nonedi/AIMSGKPER/rd_165720-1_20260618.csv 0-695 3.1 KiB/s 2026-06-18 09:40:03 /home/db-lounge/fibro/dblounge.csv -> sftp://[email protected]:5022/outbox/nonedi/ETLF/dblounge.csv 0-21595 24.8 KiB/s 2026-06-18 09:40:03 /home/db-lounge/fibro/dblounge.FTPOK -> sftp://[email protected]:5022/outbox/nonedi/ETLF/dblounge.FTPOK 0-0 2026-06-19 09:30:06 /home/db-lounge/GateKeeper/165720-1_20260619.csv -> sftp://[email protected]:5022/outbox/nonedi/AIMSGKPER/165720-1_20260619.csv 0-685840 779.6 KiB/s 2026-06-19 09:30:06 /home/db-lounge/GateKeeper/rd_165720-1_20260619.csv -> sftp://[email protected]:5022/outbox/nonedi/AIMSGKPER/rd_165720-1_20260619.csv 0-695 2.9 KiB/s 2026-06-19 09:40:06 /home/db-lounge/fibro/dblounge.csv -> sftp://[email protected]:5022/outbox/nonedi/ETLF/dblounge.csv 0-21594 66.3 KiB/s 2026-06-19 09:40:06 /home/db-lounge/fibro/dblounge.FTPOK -> sftp://[email protected]:5022/outbox/nonedi/ETLF/dblounge.FTPOK 0-0 ls dbexchange/ | tail -12 ICM_TD_VRX_MOVE_DBLOUNG_20260610210008.csv ICM_TD_VRX_MOVE_DBLOUNG_20260611210008.csv ICM_TD_VRX_MOVE_DBLOUNG_20260612210010.csv ICM_TD_VRX_MOVE_DBLOUNG_20260615210006.csv ICM_TD_VRX_MOVE_DBLOUNG_20260616210014.csv ICM_TD_VRX_MOVE_DBLOUNG_20260617210018.csv ICM_TD_VRX_MOVE_DBLOUNG_20260618210018.csv ICM_TD_VRX_MOVE_DBLOUNG_20260619210018.csv ICM_TD_VRX_MOVE_DBLOUNG_20260622210009.csv ICM_TD_VRX_MOVE_DBLOUNG_20260623210010.csv ICM_TD_VRX_MOVE_DBLOUNG_20260624210008.csv ls dbexchange/ | wc -l 2999 ls GateKeeper/processed/ | tail -12 rd_165720-1_20260613.csv rd_165720-1_20260614.csv rd_165720-1_20260615.csv rd_165720-1_20260617.csv rd_165720-1_20260618.csv rd_165720-1_20260619.csv rd_165720-1_20260620.csv rd_165720-1_20260621.csv rd_165720-1_20260622.csv rd_165720-1_20260623.csv rd_165720-1_20260624.csv rd_165720-1_20260625.csv ls GateKeeper/processed/ | wc -l 3426 ls sapgv/processed/ | tail -12 I.B.NBS.I30DBL20.PRAEMIE.D.202509 I.B.NBS.I30DBL20.PRAEMIE.D.202510 I.B.NBS.I30DBL20.PRAEMIE.D.202511 I.B.NBS.I30DBL20.PRAEMIE.D.202512 I.B.NBS.I30DBL20.PRAEMIE.D.202601 I.B.NBS.I30DBL20.PRAEMIE.D.202602 I.B.NBS.I30DBL20.PRAEMIE.D.202603 I.B.NBS.I30DBL20.PRAEMIE.D.202604 I.B.NBS.I30DBL20.PRAEMIE.D.202605 I.B.NBS.I30DBL20.PRAEMIE.D.202606 I.B.NBS.I30DBL20.PRAEMIE.zip.2 I.B.NBS.I30DBL20.PRAEMIE.zip.wrong ls sapgv/processed/ | wc -l 89 ls file-storage/ | tail -10 fibro_account_balance_2022_01_24_05_02_05.csv I.B.NBS.I30DBL20.PRAEMIE.20201031 I.B.NBS.I30DBL20.PRAEMIE.202101.zip I.B.NBS.I30DBL20.PRAEMIE.D.202011 I.B.NBS.I30DBL20.PRAEMIE.D.202011.zip I.B.NBS.I30DBL20.PRAEMIE.D.202012.zip I.B.NBS.I30DBL20.PRAEMIE.D.202101 sap-report-0511_1.zip zurich_logo.png ls user-report/ | tail -10 rd_165720-1_20210201.csv rd_165720-1_20210202.csv rd_165720-1_20210203.csv rd_165720-1_20210204.csv rd_165720-1_20210205.csv rd_165720-1_20210206.csv rd_165720-1_20210207.csv rd_165720-1_20210208.csv rd_165720-1_20210209.csv rd_165720-1_20210211.csv d u -h 178.77.77.152_csv_db 1.7G 178.77.77.152_csv_db/sapgv/processed 1.7G 178.77.77.152_csv_db/sapgv 8.5K 178.77.77.152_csv_db/dbexchange/.working 3.4G

File types seen
png × 3
Sample files (3)
12db.png
6db.png
2db.png

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

onion_site
http://c7mzgfsbyajfassqm7txbiw3ooqpchbzsd6doyhle5emmrhhdcfeuvyd.onion/
Download Source Code
Visit (http://c7mzgfsbyajfassqm7txbiw3ooqpchbzsd6doyhle5emmrhhdcfeuvyd.onion/)

Leak-site images (4)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
Screenshot of a table displaying usernames, passwords, subscriber domains, and status information.
onion leak page264 KB
Screenshot of a data table containing email addresses, user descriptions, and associated numerical identifiers.
onion leak page355 KB
Screenshot of a database query result displaying columns for ID, first name, last name, email, city, zipcode, mobile, street, and approval status.
onion leak page222 KB