Skip to content
Leak-site post naming Evosys Laser GmbH, captured by ThreatCluster
Back to victims

Evosys Laser GmbH

aurora

Ransomware leak-site victim intelligence · DE

Data size
326 GB of customer project data
Files
7
Views
78,115
Posted
Jul 30, 2026
Country
Germany
Industry
manufacturer

Summary

Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot

The group claims Evosys Laser GmbH, an Erlangen-based industrial laser welding systems manufacturer with about 130 employees, had 326 GB of customer project data exfiltrated, in seven files. The data categories claimed include HR records, financial history, attorney-client privileged communications, whistleblower reports, industrial control data, robot SRS source code, PLC programs, nginx private keys, VPN configurations, KeePass vault data, and customer portal credentials. The leak page states a valid SSL wildcard private key for *.evosys-laser.com is present (valid 2025–2026), and the publication status on the leak site is listed.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Employees
0
Domains
evosys-laser.com
Platforms
KeePass mRemoteNG Citrix Nginx VPN

What was taken

Evosys Laser GmbH — an Erlangen-based industrial laser welding systems manufacturer with ~130 employees, subsidiaries in the US, China, and a string of Tier 1 automotive customers.

Data categories
HR recordsKeePass vault contentscustomer portal credentialsSSL wildcard private keyserver credentials and internal IPscustomer project datafinancial historyattorney-client privileged communicationswhistleblower reportsindustrial control data (robot SRS source code, PLC programs, nginx private keys, VPN configurations)
File types seen
key × 1pdf × 1txt × 4xml × 1
Sample files (7)
Zugangsdaten Roche Supplierplattform.txt
Siemens_CEBH.txt
ZugangsdatenMOVEit.txt
Verbindungen.xml
Citrix Share.txt
star.evosys-laser.com_2025-2026.key
20240702_SCAN-KEEPASS.pdf

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

email
[email protected]
phone
+49 9131 4088-0
Address
Felix-Klein-Str. 75 91058 Erlangen
address
Felix-Klein-Str. 75 91058 Erlangen
Server Link 1
http://fofss3tzlhqgr3zpitf4ucbjlyj6ia6czuyjxqweo6o5c7iwwd5vdoad.onion/data/EVOSYS
Server Link 2
https://sapurnale.io/data/EVOSYS
notes_on_data
Complete financial history — Jahresabschlüsse (2015–2025), P&L forecasts through 2028, cash positions, investor documents, executive compensation.
KeePass_pdf_description
A photographed KeePass vault — scanned password manager contents as PDF
ssl_wildcard_private_key_validity
2025–2026
The SSL wildcard private key for *.evosys-laser.com — valid 2025–2026, enabling
present

Leak-site images (2)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
The image features a circular logo with a stylized letter "E" in a beige color, incorporating horizontal lines.
onion leak page31 KB

Negotiation
Email [email protected]