Skip to content
Leak-site post naming Morguard, captured by ThreatCluster
Back to victims

Morguard

helix

Ransomware leak-site victim intelligence

Data size
Tier data sizes: T1 4.02 GB, T2 58.58 GB, T3 192.27 GB, T4 1
Files
733,018
Posted
Aug 7, 2026
Countdown
Countdown until T1 releases; later stages unlock on schedule.
Country
US
Industry
Not Found

Summary

Written by ThreatClusterfrom site fields, file listing, leak post, screenshot

The group helix claims Morguard data totaling 421.38 GB across 733,018 files was stolen. They describe the taken material as including legal and property-related documents, emails and attachments, and internal records. The post states Morguard engaged in negotiations, took extensions, but did not present a real offer; deadlines stand, and the leak is published.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Platforms
GoFile

What was taken

Morguard reached out, took extensions, then ignored the negotiation with no real offer. Contacting us and stalling is not a strategy. Deadlines stand. Silence after outreach gets a private board and a countdown then publication.

Data categories
Legal / Virtual Minute BooksLegal / Citrix DocumentsMGRP-Sudbury SC Disposition / DocumentsLegal / National Programs Building ReportsLegal / Property AgreementsLegal / Transaction Record BooksLegal-PropertyOwnerMeetings / DocumentsMailbox / emailsMailbox / attachmentsGRP-MW-LII / Lease ProfilesGRP-MW-LII / ArchiveOther small sites
File types seen
7z × 4
Sample files (4)
Morguard_T1.7z
Morguard_T2.7z
Morguard_T3.7z
Morguard_T4.7z

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

GoFile passwords
Morguard_T1.7z; Morguard_T2.7z; Morguard_T3.7z; Morguard_T4.7z
GoFile_passwords
["Morguard_T1.7z", "Morguard_T2.7z", "Morguard_T3.7z", "Morguard_T4.7z"]
GoFile download links
[{"tier": "T1", "link": "https://gofile.io/d/7071254a-623a-44cb-be76-b62ff2685175", "password": "Morguard_T1.7z · 4.02 GB · passworded .7z"}, {"tier": "T2", "link": "https://gofile.io/d/6b509f06-c781-4d9e-80ca-0b0b5e07a8db", "password": "Morguard_T2.7z · 58.58 GB · passworded .7z"}, {"tier": "T3", "link": "https://gofile.io/d/070a63c4-0895-4f09-a4cc-7efa770f0d43", "password": "Morguard_T3.7z · 192.27 GB · passworded .7z"}, {"tier": "T4", "link": "https://gofile.io/d/6eed9504-12be-4e97-8a57-395377c531cf", "password": "Morguard_T4.7z · 166.51 GB · passworded .7z"}]
Download from GoFile (Faster) links
["https://gofile.io/d/7071254a-623a-44cb-be76-b62ff2685175", "https://gofile.io/d/6b509f06-c781-4d9e-80ca-0b0b5e07a8db", "https://gofile.io/d/070a63c4-0895-4f09-a4cc-7efa770f0d43", "https://gofile.io/d/6eed9504-12be-4e97-8a57-395377c531cf"]

Leak-site images (1)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture