Overview
A new ransomware group is said to have emerged in mid-April 2024, under the name 'APT73.' It's worth noting that the group reportedly self-proclaimed as an APT, which stands for 'Advanced Persistent Threat' in the cybersecurity field. According to research, much of the available information about the aforementioned group came from another ransomware group known as LockBit.
- First tracked: 2024-04-22
- Also known as: bashe
- Discussed in our reports: Gulf summary · Maghreb · Saudi Arabia · Türkiye · UAE
Geography: origin and targets
No public attribution of origin. Lines are drawn only where public reporting places the operators; flags show where the group has claimed victims, sized by number of claims.
United States of America20
United Kingdom19
Brazil9
France7
India7
Germany6
Austria6
Indonesia5
Switzerland5
Türkiye4
Exploited vulnerabilities
None recorded in the sources we reviewed.
ATT&CK techniques
None recorded in the sources we reviewed.
Tools
None recorded in the sources we reviewed.
Leak-site infrastructure
| Title | Type | Address (defanged) | Seen online at snapshot |
|---|---|---|---|
| APT73 | DLS | eraleignews[.]com | No |
| — | DLS | qcgv5tfer4f46ns6ohh72zeyyh5uavoiybypzpt3lmwk5ecyqykptgqd[.]onion | No |
| APT73 | DLS | fleqwmg7xnanypt5km2m75l72q7nlcvlp2m4sdmgjxorsn6tb3zyp3qd[.]onion | No |
| BASHE | DLS | bashex7mokreyoxl6wlswxl4foi7okgs7or7aergnuiockuoq35yt3ad[.]onion | Yes |
| APT73 | DLS | wn6vonooq6fggjdgyocp7bioykmfjket7sbp47cwhgubvowwd7ws5pyd[.]onion | No |
| BASHE | DLS | basheqtvzqwz4vp6ks5lm2ocq7i6tozqgf6vjcasj4ezmsy4bkpshhyd[.]onion | Yes |
| APT73 | DLS | apt73grpjgjwykrenq7vnjejue76vosdzptdvmonv7vyqnsyokrw57ad[.]onion | No |
| BASHE | DLS | basherq53eniermxovo3bkduw5qqq5bkqcml3qictfmamgvmzovykyqd[.]onion | Yes |
| BASHE | DLS | basherykagbxoaiaxkgqhmhd5gbmedwb3di4ig3ouovziagosv4n77qd[.]onion | Yes |
| — | Files | bashe4aec32kr6zbifwd5x6xgjsmhg4tbowrbx4pneqhc5mqooyifpid[.]onion | Yes |
| BASHE | DLS | bashete63b3gcijfofpw6fmn3rwnmyi5aclp55n6awcfbexivexbhyad[.]onion | Yes |
Sources and caveats
Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.
Data snapshot: 2026-10-11