Skip to content
Leak-site post naming Kwg, captured by ThreatCluster

Kwg

sarcoma

Ransomware leak-site victim intelligence

Data size
989 GB Archive
Files
10
Views
67,521
Posted
Sep 17, 2025
Country
Germany
Industry
Business Services

Summary

Written by ThreatClusterfrom victim profile, leak post

The Sarcoma group claims to have stolen and published a 989 GB archive from Kwg, associated with the domain kwg-senftenberg.de. Victim profile on the leak page lists Kwg as a Germany-based business services firm. The leak post states the publication status as published.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

What was taken

Index of /

File types seen
zip × 10
Sample files (10)
KWG-sfb.local_20250912_050926_part001.zip
KWG-sfb.local_20250912_050926_part002.zip
KWG-sfb.local_20250912_050926_part003.zip
KWG-sfb.local_20250912_050926_part004.zip
KWG-sfb.local_20250912_050926_part005.zip
KWG-sfb.local_20250912_050926_part006.zip
KWG-sfb.local_20250912_050926_part007.zip
KWG-sfb.local_20250912_050926_part008.zip
KWG-sfb.local_20250912_050926_part009.zip
KWG-sfb.local_20250912_050926_part010.zip

Leak-site images (1)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture