Skip to content
Leak-site post naming Gilbert, captured by ThreatCluster

Gilbert

runsomewares

Ransomware leak-site victim intelligence

Files
11
Posted
Feb 27, 2025
Industry
supply-chain services for the retail sector

Summary

Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot

The group runsomewares claims to have published 11 sample files named batch_1 through batch_11 from The Gilbert Company. The leak page identifies the victim as The Gilbert Company, a logistics provider with domain gilbertusa.com. The leak post states the publication status is published and provides onion-hosted links for listing and for the batch downloads.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

People named
Gilbert

What was taken

For over 32 years The Gilbert Company has specialized in supply-chain services for the retail sector. With special emphasis on the apparel, footwear, and electronics segment, we have positioned ourselves as one of the premier 3rd Party Logistics providers in the industry…and for two major reasons…we understand the demanding dynamics and sense of urgency required to excel in this arena…and we have the knowledge, experience, and people to deliver results that allow our customers to succeed in such a challenging environment.

Sample files (11)
batch_1
batch_2
batch_3
batch_4
batch_5
batch_6
batch_7
batch_8
batch_9
batch_10
batch_11

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

list_url
http://lmsxwm6hrd5osuefl6uia3wwnxxnlav2ce4d4nkjvuonb3426pwdmcad.onion/gilbertusa/list
batch_1_url
http://lmsxwm6hrd5osuefl6uia3wwnxxnlav2ce4d4nkjvuonb3426pwdmcad.onion/gilbertusa/batch_1
batch_2_url
http://lmsxwm6hrd5osuefl6uia3wwnxxnlav2ce4d4nkjvuonb3426pwdmcad.onion/gilbertusa/batch_2
batch_3_url
http://lmsxwm6hrd5osuefl6uia3wwnxxnlav2ce4d4nkjvuonb3426pwdmcad.onion/gilbertusa/batch_3
batch_4_url
http://lmsxwm6hrd5osuefl6uia3wwnxxnlav2ce4d4nkjvuonb3426pwdmcad.onion/gilbertusa/batch_4
batch_5_url
http://lmsxwm6hrd5osuefl6uia3wwnxxnlav2ce4d4nkjvuonb3426pwdmcad.onion/gilbertusa/batch_5
batch_6_url
http://lmsxwm6hrd5osuefl6uia3wwnxxnlav2ce4d4nkjvuonb3426pwdmcad.onion/gilbertusa/batch_6
batch_7_url
http://lmsxwm6hrd5osuefl6uia3wwnxxnlav2ce4d4nkjvuonb3426pwdmcad.onion/gilbertusa/batch_7
batch_8_url
http://lmsxwm6hrd5osuefl6uia3wwnxxnlav2ce4d4nkjvuonb3426pwdmcad.onion/gilbertusa/batch_8
batch_9_url
http://lmsxwm6hrd5osuefl6uia3wwnxxnlav2ce4d4nkjvuonb3426pwdmcad.onion/gilbertusa/batch_9
batch_10_url
http://lmsxwm6hrd5osuefl6uia3wwnxxnlav2ce4d4nkjvuonb3426pwdmcad.onion/gilbertusa/batch_10
batch_11_url
http://lmsxwm6hrd5osuefl6uia3wwnxxnlav2ce4d4nkjvuonb3426pwdmcad.onion/gilbertusa/batch_11
files_listing_url
http://lmsxwm6hrd5osuefl6uia3wwnxxnlav2ce4d4nkjvuonb3426pwdmcad.onion/gilbertusa/list
download_links_root
http://lmsxwm6hrd5osuefl6uia3wwnxxnlav2ce4d4nkjvuonb3426pwdmcad.onion/gilbertusa/batch_1

Leak-site images (1)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture