Tracked intelligence for the OBSOFT ransomware group: victim-claim volume, leak-site availability, and activity status.
Last observed activity is the newest of this group’s claim record times and the leak-site dates (last scrape, or else last update) in the tracker’s pinned group list, a fixed copy that the tracker does not refresh, so it can be later than the group’s newest claim.
Related: the group dossier profiles a group's 365-day publishing rhythm and co-claims, group comparison puts two groups side by side, and the victim-claim directory lists the individual observed claims.
How to cite: Dragons Eye Ransomware Tracker, “OBSOFT ransomware group”, provider-observed ransomware claim data as of 2026-11-03, this page's URL. Keep the observed-claim caveat with any reused figures; the methodology documents the evidence model and the data-quality dashboard quantifies screening and exclusions.
Source: reconciled leak-site victim claims aggregated from documented public monitoring providers. Independent providers are distinguished from mirrors, and no provider count verifies an underlying allegation. Definitions for every term used here are in the glossary.
All ransomware groups · Intelligence overview
Victim records are provider-reported allegations, not independently verified breaches. Published for research, defense, and educational use.
How to cite: Dragons Eye Ransomware Tracker, “OBSOFT ransomware group”, entity page, dataset version sig-d0d410384abb6ac67c69bf461d2951281eb6bf394a796384ec0094a30e518a0c, data as of 2026-11-03 07:08 UTC, https://ransomware-tracker.com/groups/OBSOFT (add the date you accessed it).
The figures on this page change as new data arrives; quote the figures you use together with the dataset version and the data-as-of time above.
Data as of (the observed time of the newest claim record in this page's prerender data snapshot; snapshot built ; dataset version sig-d0d410384abb6ac67c69bf461d2951281eb6bf394a796384ec0094a30e518a0c).