Skip to content
Leak-site post naming Dharma Group, captured by ThreatCluster

Dharma Group

everest

Ransomware leak-site victim intelligence

Data size
133 GB
Files
157,000
Views
68,000
Posted
Aug 5, 2026
Country
IT
Industry
Manufacturing

Summary

Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot, ransom note

Threat actors claiming to be Everest’s Dharma group state they exfiltrated 133 GB of data from PT Dharma (Dharma Group), a manufacturing company at dharmagroup.co.id, consisting of about 157,000 files. The archive is described as covering General Document and Operations data and a range of manufacturing records, including delivery, kanban, forecast, stock and attendance/overtime data, plus engineering drawings, SolidWorks data, and related software development, web, and database materials. The leak page shows a countdown timer and indicates the data will be published after the countdown, with the latest post dated July 17 and about 29,394 views and 32,822 opens.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Platforms
Python PHP JavaScript Bootstrap SQL SolidWorks

What was taken

The PT Dharma archive contains over 157,000 detailed file records with 133 GB of data. The archive is organized around manufacturing operations, delivery administration, PPC and PPIC planning, customer delivery workflows, ADM delivery records, TMMIN records, Hyundai PPC/PPIC data, HPM barcode and part-tag data, Suzuki part-tag data, preparation sheets, delivery notes, kanban documents, manifests, production planning records, loading-capacity records, AR delivery records, forecast records, stock reports, attendance and overtime records, engineering drawings, SolidWorks data, welding jig materials, digital transformation records, INDI 4.0 training materials, Python/Dx workspaces, PHP web-application data, SQL/database materials and operational reporting datasets.

Data categories
General Document and Operations AreaADM and Delivery Administration AreaHyundai AreaPPC 2W AreaPPIC TMMIN AreaDigital, Web Application and Database AreaADM / ADM SAP / ADM KAPTMMINHyundaiHPM
File types seen
js × 2,132doc × 1,233jpg × 4,001pdf × 60,315php × 1,947png × 4,629svg × 1,482txt × 3,892xls × 17,490xml × 1,530docx × 1,218jpeg × 1,039pptx × 1,235xlsm × 847xlsx × 38,124sldprt × 2,900no_extension × 8,374

Ransom note

Published by the group on their leak site, reproduced verbatim.

The files will be published after the timer counts down. The company still has time to get in touch with us

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

latest_post
Jul 17
opens_count
32822
views_count
29394
domain_in_text
dharmagroup.co.id
archive_description
The PT Dharma archive contains over 157,000 detailed file records with 133 GB of data.

Leak-site images (11)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
onion leak page11 KB
Logo of Keysight Technologies featuring a red waveform graphic and the company name in white text.
onion leak page128 KB
onion leak page11 KB
Logo featuring the text "mansfield" in a stylized font, with "FAMILY DENTISTRY" below it.
onion leak page1.4 KB
Logo featuring a stylized letter "P" in orange with a black play button icon integrated into the design.
onion leak page7.5 KB
onion leak page5.8 KB
Logo featuring the text "Al-Futtaim" in blue, with "automotive" in a smaller font below it, accompanied by a geometric symbol.
onion leak page5.6 KB
The image features a logo with stylized figures in orange and blue, representing people, alongside the text "ALZONE" in a bold blue font.
onion leak page7.0 KB
Logo of Emirates Flight Catering, featuring stylized text in gold and red.
onion leak page6.8 KB
Logo of Dharma Group featuring a stylized design with blue and green colors, accompanied by the text "DHARMA GROUP" below it.
onion leak page7.7 KB