Skip to content
Cyber Threat
CTI Academy Sponsor CTI Academy
Ransomware group

Icarus ransomware

12 victims listed on the Icarus leak site across 3 countries. Most recent disclosure .

Victims
12
0.1% of all tracked
Countries
3
Most: United States
Sectors
3
Most: Technology
First seen
May 2026
In this database

ThreatAI analysis

Compiled from the ransomware.live profile for Icarus and from this database. Figures and technique mappings are quoted from the source data, not inferred.

Icarus is a threat actor responsible for attacks on 12 systems across three countries including United States, Canada, and Indonesia in sectors like technology, business services, and financial services.

Recorded activity

Disclosures attributed to Icarus in this database run from May 2026 to June 2026, totalling 12 victims — 0.1% of everything tracked here. Icarus has listed victims in 3 countries in this database, most often United States, followed by Canada and Indonesia. The sectors appearing most in its listings are Technology, Business Services, Financial Services.

Threat actor analysis

Icarus has disclosed 12 victims on its leak site, 0.1% of all ransomware listings tracked in this database. Its earliest disclosure here dates to May 2026.

The group has listed organisations in 3 countries, most often in United States (2 victims), followed by Canada, Indonesia.

By industry, its listings concentrate in Technology, Business Services, Financial Services — sectors that hold sensitive data or cannot tolerate long outages, both of which raise the pressure to pay.

Like most current ransomware operations, Icarus is likely to use double extortion: data is stolen before files are encrypted, and organisations that refuse to pay are named on the leak site with the stolen data as leverage.

Generated from public leak-site disclosures aggregated via the ransomware.live API and updated automatically.

Icarus victims 12

Organization Disclosed
C*
G*
H*
H**
Cbassociations
Cqcrm
Gms-net
HDS (Hdscorp)
Huntress
USUnited States
Klue.com
CACanada
thecreditpros.com
USUnited States
Cazh.id
IDIndonesia

Frequently asked questions

What is Icarus ransomware?

Icarus is a ransomware threat group that has claimed 12 victims since its first known activity in May 2026. The group operates by infiltrating target networks, exfiltrating data, encrypting files, and threatening to publish stolen data on a dark web leak site if the ransom is not paid.

How many victims has Icarus attacked?

Icarus has claimed 12 victims in our database, representing 0.1% of all tracked ransomware attacks. The most targeted countries are United States, Canada, Indonesia.

Which countries does Icarus target?

Icarus has attacked organizations in 3 countries. The top targeted countries are: United States, Canada, Indonesia.

Which industries does Icarus target?

Icarus most frequently targets the Technology, Business Services, Financial Services sectors based on victim disclosures in our database.

Is Icarus still active?

Icarus's most recent victim disclosure in our database was on June 23, 2026. Ransomware groups frequently rebrand or go dormant; monitor this page and our ransomware map for the latest activity.