Overview
Umbra is a leak-site extortion brand that the tracker first lists on 6 October 2026. Its first entries in our data are four Egyptian organizations in one week, three universities and an IT services firm, with claimed volumes from 163 GB to 6 TB. We hold no public technical reporting on its tooling or intrusion methods.
- First tracked: 2026-10-06
- Discussed in our reports: Egypt
Geography: origin and targets
No public attribution of origin. Lines are drawn only where public reporting places the operators; flags show where the group has claimed victims, sized by number of claims.
Egypt3
South Africa1
Exploited vulnerabilities
None recorded in the sources we reviewed.
ATT&CK techniques
None recorded in the sources we reviewed.
Tools
None recorded in the sources we reviewed.
Leak-site infrastructure
| Title | Type | Address (defanged) | Seen online at snapshot |
|---|---|---|---|
| UmBra | DLS | umbra7isogjsgdcndz3uu6qvl5zftjptt6s3iiuecjlwbt4yqyvrhcid[.]onion | Yes |
Sources and caveats
Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.
Data snapshot: 2026-10-17