Group profile15 claimed in last 30d42 total tracked

Pure Extraction And Ransom

Forward this

Pure Extraction And Ransom (PEAR) has posted 28 claimed victims since surfacing in mid-May 2026, with a steady cadence that has produced at least eight postings across construction, healthcare, electronics, and beverage manufacturing firms in the past month alone. Targeting skews heavily toward the United States, with additional claims against organizations in Singapore, Norway, and Canada, suggesting an opportunistic rather than sector-specific hunting pattern spanning transportation, technology, manufacturing, financial services, and consumer services. The group describes itself as a small, disciplined, independent operation, though this framing is unverified attacker self-description rather than confirmed structure or capability. No MITRE ATT&CK technique set has been catalogued for this group yet, leaving its intrusion and encryption tooling unconfirmed. The recent victim cluster, several announced within days of each other in July, indicates an active, ongoing campaign rather than a dormant or wind-down phase.

Brief by The Nexus · Aug 15 · 15:07 UTC

Pure Extraction And Ransom (PEAR) Team is the community of highly responsible and strictly disciplined members. We are a private team and have nothing common with any other threat actors. We've been monitoring this field for a long-long time. So, we understand all the processes and know well how it all works.

First seen: May 19 · 00:00 UTCLast seen: Aug 22 · 10:27 UTCTracked since: 2025-08-05

Sectors hit

Technology2
Healthcare2
Transportation/Logistics1
Professional Services1
Other1
Unspecified1
Manufacturing1
Hospitality1

Countries hit

United States10
Singapore1
Norway1
Jamaica1
Canada1

MITRE ATT&CK · observed TTPs8 tactics

Tactics and techniques attributed to PURE EXTRACTION AND RANSOM by ransomware.live's curated TTP catalog. Identifiers link to the canonical MITRE ATT&CK reference for each tactic or sub-technique.

TA0001Initial Access
- T1078Valid Accounts
- T1566Phishing
TA0002Execution
- T1059.001Command and Scripting Interpreter: PowerShell
- T1204.002User Execution: Malicious File
- T1204.004User Execution: Malicious Copy and Paste
TA0003Persistence
- T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
TA0005Defense Evasion
- T1027.013Obfuscated Files or Information: Encrypted/Encoded File
- T1055.001Process Injection: DLL Injection
TA0006Credential Access
- T1056.001Input Capture: Keylogging
- T1555.003Credentials from Password Stores: Credentials from Web Browsers
TA0009Collection
- T1005Data from Local System
- T1074Data Staged
- T1114Email Collection
- T1213Data from Information Repositories
- T1560.001Archive Collected Data: Archive via Utility
TA0010Exfiltration
- T1041Exfiltration Over C2 Channel
- T1567Exfiltration Over Web Service
- T1567.004Exfiltration Over Webhook
TA0011Command and Control
- T1071.001Application Layer Protocol: Web Protocols
- T1090.003Proxy: Multi-hop Proxy

Recent claimed victims

Aug 22 · 10:27 UTC

Island Networks

Mogren, Glessner & Ahrens, P.S.

Island Networks

Mogren, Glessner & Ahrens, P.S.

Clifton Architectural Glass & Metal

First Commerce LLC

Medical Arts Chemists and Surgicals

Club One Casino

Practi-Cal

Austin Plastic Surgery Institute

Medical Arts Chemists and Surgicals

Club One Casino

Practi-Cal

Austin Plastic Surgery Institute

Sonitor Technologies

Metropolitan Construction Systems

Carient Heart & Vascular

South Plains Rural Health Services, Inc.

Faro Products Inc.

Tostrud & Temp, S.C.

AC Beverage, Inc.

CNW Electronics Pte Ltd

AC Beverage, Inc.

CNW Electronics Pte Ltd

Spector and Lenz, PC

ORA Group Information

Sociedad Latina

Sociedad Latina

Optimum First Mortgage

Optimum First Mortgage

B & B Trading

Release Marine, Inc.

Kirbor Homes

K & E Distributing

Bayou Electrical Services

National Health Fund

Alpha IT

K & E Distributing

Bayou Electrical Services

Alpha IT

Plexsupply Inc

Kinsmen TeleMiracle