Skip to content
Cyber Threat
CTI Academy Sponsor CTI Academy
Ransomware group

Flocker ransomware

59 victims listed on the Flocker leak site across 16 countries. Most recent disclosure .

Victims
59
0.2% of all tracked
Countries
16
Most: United States
Sectors
9
Most: Technology
First seen
May 2024
In this database

ThreatAI analysis

Compiled from the ransomware.live profile for Flocker and from this database. Figures and technique mappings are quoted from the source data, not inferred.

Ransomware-as-a-Service group Flocker has targeted over half a dozen nations across seventeen countries, with its attacks recorded on 59 victims.

Who Flocker is

Flocker (also linked to the FSociety brand) is a ransomware-as-a-service group active since 2023–2024, targeting Windows and Linux systems via phishing, compromised RDP, and exploit kits using a double extortion model, and observed collaborating with FunkSec.

Recorded activity

Disclosures attributed to Flocker in this database run from May 2024 to July 2025, totalling 59 victims — 0.2% of everything tracked here. Flocker has listed victims in 16 countries in this database, most often United States, followed by UAE and Taiwan. The sectors appearing most in its listings are Technology, Business Services, Financial Services.

YARA detection rules

flocker.yar 
/*
flocker ransomware
*/

rule flocker_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.flocker"
        description = "Detects flocker ransomware ransom note or artifact"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $name1 = "flocker" ascii nocase
        $name2 = "FLOCKER" ascii
        $onion  = "flocker.onion" ascii nocase

    condition:
        any of them
}

Community-contributed rules for Flocker, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.

Threat actor analysis

Flocker has disclosed 59 victims on its leak site, 0.2% of all ransomware listings tracked in this database. Its earliest disclosure here dates to May 2024.

The group has listed organisations in 16 countries, most often in United States (6 victims), followed by UAE, Taiwan, Canada.

By industry, its listings concentrate in Technology, Business Services, Financial Services — sectors that hold sensitive data or cannot tolerate long outages, both of which raise the pressure to pay.

Like most current ransomware operations, Flocker is likely to use double extortion: data is stolen before files are encrypted, and organisations that refuse to pay are named on the leak site with the stolen data as leverage.

Generated from public leak-site disclosures aggregated via the ransomware.live API and updated automatically.

Flocker victims 59

Organization Disclosed
G*****n.com
H**u.i*v.tw
TWTaiwan
Ieee-apscon.org
USUnited States
T***********p.com
G*********************y.org
Idgcayman.com
KYCayman Islands
S******h.com
I*******n.com
Ajmanre.gov.ae
AEUAE
A*****e.gov.ae
Lts.com.vn
VNVietnam
Dcsdev.org
USUnited States
Trustgrp.ae
AEUAE
l*s.com.vn
D****v.org
T******p.ae
AEUAE
Z****a.com
W*******w.com
Salemerode.com
DEGermany
K**d.edu
S********e.com
Eservices.gov.zm
ZMZambia
A*u.edu.au
AUAustralia
Gpstech2007.com
THThailand
Mervis.info
CZCzech Republic
Realtime.tw
TWTaiwan
E*******s.gov.zm
ZMZambia
G*********7.com
M****s.info
R******e.tw
TWTaiwan
A2b-cargo.com
USUnited States
Toshapp.com
TZTanzania
A**-****o.com
Punjab.gov.pk
PKPakistan
T*****p.com
W*****e.com
K****S CORP
d****I
C**********M
B****A
F*******M Corp
Q***M
USUnited States
K***N Corp
KRSouth Korea
Y*********I
USUnited States
A****N
A*****D
O***M
F*****H
K*****S
CACanada
H*******Y
D*****S
SBC Global, Bitfinex, Coinmama, and Rutgers University Part 2 Leak
Coinmama
SBC Global, Bitfinex, Coinmama, and Rutgers University Part 2
SBC Global, Bitfinex, Coinmom, and Rutgers University Part 2
Bitfinex
VGBritish Virgin Islands
Coinmoma
CACanada
Rutgers University
USUnited States
SBC Global
TKTokelau

Frequently asked questions

What is Flocker ransomware?

Flocker is a ransomware threat group that has claimed 59 victims since its first known activity in May 2024. The group operates by infiltrating target networks, exfiltrating data, encrypting files, and threatening to publish stolen data on a dark web leak site if the ransom is not paid.

How many victims has Flocker attacked?

Flocker has claimed 59 victims in our database, representing 0.2% of all tracked ransomware attacks. The most targeted countries are United States, UAE, Taiwan, Canada.

Which countries does Flocker target?

Flocker has attacked organizations in 16 countries. The top targeted countries are: United States, UAE, Taiwan, Canada.

Which industries does Flocker target?

Flocker most frequently targets the Technology, Business Services, Financial Services sectors based on victim disclosures in our database.

Is Flocker still active?

Flocker's most recent victim disclosure in our database was on July 31, 2025. Ransomware groups frequently rebrand or go dormant; monitor this page and our ransomware map for the latest activity.