Pear Ransomware Group: CVEs, Techniques and Tools

Overview

PEAR, short for Pure Extraction And Ransom, is an extortion team the tracker first lists on 5 August 2025. It describes itself as a private team unconnected to other threat actors. The tracker maps it to phishing, malicious copy-and-paste user execution, PowerShell, browser credential theft, data staging, and exfiltration over web services and webhooks. Its Egyptian entry in our data is an IT services firm listed on 6 March 2026.

First tracked: 2025-08-05
Also known as: Pure Extraction And Ransom
Discussed in our reports: Egypt

Geography: origin and targets

No public attribution of origin. Lines are drawn only where public reporting places the operators; flags show where the group has claimed victims, sized by number of claims.

France1
Norway1
Egypt1
Switzerland1
Germany1

Exploited vulnerabilities

None recorded in the sources we reviewed.

ATT&CK techniques

Columns are ATT&CK tactics; each cell is a technique reported for this group in public sources. A technique appearing here means it has been reported for the group, not that it was used in any particular incident, and an empty cell is not evidence that the group does not use it.

Initial Access	Execution	Persistence	Defense Evasion	Credential Access	Collection	Exfiltration	Command and Control
Valid Accounts	Command and Scripting Interpreter: PowerShell	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	Obfuscated Files or Information: Encrypted/Encoded File	Input Capture: Keylogging	Data from Local System	Exfiltration Over C2 Channel	Application Layer Protocol: Web Protocols
Phishing	User Execution: Malicious File		Process Injection: DLL Injection	Credentials from Password Stores: Credentials from Web Browsers	Data Staged	Exfiltration Over Web Service	Proxy: Multi-hop Proxy
	User Execution: Malicious Copy and Paste				Email Collection	Exfiltration Over Webhook
					Data from Information Repositories
					Archive Collected Data: Archive via Utility

Technique details

Tools

None recorded in the sources we reviewed.

Leak-site infrastructure

Title	Type	Address (defanged)	Seen online at snapshot
403 Forbidden	Files	`psvrn6ahevi6dgf55bzc26q3gjc7s6n7vcth34rmkl2y7e7dijhjfiqd[.]onion`	No
PEAR	DLS	`pearsmob5sn44ismokiusuld34pnfwi6ctgin3qbvonpoob4lh3rmtqd[.]onion`	Yes
403 Forbidden	Files	`glheoet37vdimgho57tqj76v7fnebnbqxn65bounxyt6hduilkso4yyd[.]onion`	Yes
403 Forbidden	Files	`757ylxaeemidrhrmmuz6rkxw5jlk65oqou3lvi6evxtrr2nhm5ytmrqd[.]onion`	Yes
403 Forbidden	Files	`aw6wb6lmqbtp5po7qrmvmujulbxw4eeeolpg3byva2bgoj44psdugmid[.]onion`	Yes
403 Forbidden	Files	`5qynbyjl4u6vbtnmpokslaxaknyicdvty7vn2qgxmaty3lb7wwxpkbid[.]onion`	Yes
403 Forbidden	Files	`q2bg7ljsrpmy6736qqmpwsnqqm3w6d3hhrokohytnmldbom7sthp4sad[.]onion`	Yes
403 Forbidden	Files	`zvacnemrrluposfmwgp4bqvb34ipoorgh7yyqoozu6gcmh5z32wjgsad[.]onion`	Yes
403 Forbidden	Files	`e7a6zgqfijn2ko6lzkz53tysjpnf22fxj4h2f3saufrmsts5pbul5eid[.]onion`	Yes
PEAR	DLS	`peargxn3oki34c4savcbcfqofjjwjnnyrlrbszfv6ujlx36mhrh57did[.]onion`	Yes
403 Forbidden	Files	`m3wwhkus4dxbnxbtihexlyd2cv63qrvex6jiebc4vqe22kg2z3udebid[.]onion`	Yes
403 Forbidden	Files	`3hzi7qjklm632atxj5k67p3bxdie5aipvf6tsbtc2xlfbcellujyxryd[.]onion`	Yes
403 Forbidden	Files	`smnalvhqecyjf7reptunoevh6jd6x7ofpz4tj2plyg5a4q667givgqyd[.]onion`	Yes
403 Forbidden	Files	`diyr2bnty7iktyxfd4kz65uigcfappjvux73dpgkkeocp3fmlgnuzyyd[.]onion`	Yes
403 Forbidden	Files	`wu22mxmkgd4hgs7j3x7aqurgzhwzy3gf5qpwngpobpnet4i6myebutyd[.]onion`	Yes
403 Forbidden	Files	`csxilwnl7orv6rwfjen5ye3tefk5shjtr4tysuykgxjsyngpvoqrvbid[.]onion`	Yes
403 Forbidden	Files	`njqaowdto3tfbbco575fkmhahszxfw7fiprbfmt6y6kfy5fntt45akyd[.]onion`	Yes
403 Forbidden	Files	`xsomiaq5awxh3zkzn334s3dgwuvngy6z2to7265exgovnkwk66hjypid[.]onion`	Yes
403 Forbidden	Files	`etus2tmakckdlkyjpevoyciuao7er5fj3qm26aev3nch4fusptefiayd[.]onion`	Yes
403 Forbidden	Files	`xq5m6ofel63h57by46algju25g37zkdwoxxt7ij45b6obo4mxzc3h6id[.]onion`	Yes
403 Forbidden	Files	`shtobqdovtbat7fvnoq6lqwi3rqirel6l2r6sqxiidfq5g33tqms6kyd[.]onion`	Yes
403 Forbidden	Files	`yxwomyfmexm3bfcuumnugrzwluol5qwsw6pmne7jklgmzthkp35l2jqd[.]onion`	Yes

Sources and caveats

Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.

Data snapshot: 2026-10-17