Group profile8 claimed in last 30d38 total tracked

m3rx

Forward this

M3rx has posted 17 claimed victims in the past 30 days, a sharp acceleration for a group first tracked in mid-May 2026, with activity concentrated against Business Services and Professional Services targets and a footprint spanning the US, Germany, Canada, and smaller postings in South Africa and Portugal. Its claimed listings often duplicate the same target across different sector and country tags (as seen with tecnoabi.com and hydraulic-components.net), suggesting either data churn on its leak site or opportunistic re-listing of victims. The group is described in open-source writeups as using AES-CTR/AES-GCM encryption and claims a prior run of roughly eight victims across England, the US, Australia, Germany, Italy, and Switzerland, though these self-reported figures cannot be independently verified. No MITRE ATT&CK technique set has been catalogued for M3rx to date, leaving its intrusion and encryption tradecraft undocumented beyond the group's own claims. Current output points to a small but increasingly active operation favoring mid-tier business and professional service

Brief by The Nexus · Aug 15 · 15:02 UTC

M3rx is a small ransomware group first observed in 2025, using AES-CTR/AES-GCM encryption and targeting organizations in England, the US, Australia, Germany, Italy, and Switzerland, with around eight claimed victims including a Sydney-based property firm.

First seen: May 17 · 14:53 UTCLast seen: Aug 14 · 07:55 UTCTracked since: 2026-04-29

Sectors hit

Business Services6
Unspecified5
Professional Services3
Technology2
Manufacturing2
Transportation/Logistics1
Transportation1
Consumer Services1

Countries hit

United States4
Germany2
Canada2
South Africa1
Portugal1
New Zealand1
Norway1
Mexico1
Japan1
Ireland1

Recent claimed victims

Aug 14 · 13:37 UTC

tecnoabi.com

TechnologyBrazilAug 14 · 07:56 UTC

tecnoabi.com

tecnoabi.com

hydraulic-components.net

createinfor.pt

servicebypremier.com

hydraulic-components.net

createinfor.pt

servicebypremier.com

ausproof.com.au

ausproof.com.au

ubfreight.com

ubfreight.com

ubfreight.com

suppcentersa.com

arambol.co.uk

suppcentersa.com

arambol.co.uk

eclective.ie

foreconinc.com

wrtworld.com

eclective.ie

foreconinc.com

wrtworld.com

hbexperts-conseils.ca

werkstoff-service.de

fasadeconsult.no

ktwhs.com

maringoodman.com

suppcenter.global / suppcentersa.com

maringoodman.com

suppcenter.global / suppcentersa.com

hbexperts-conseils.ca

werkstoff-service.de

fasadeconsult.no

ktwhs.com

jichasa.com

dosocho.es

soft-inc.com