6 victims listed on the Obsoft leak site across 1 countries. Most recent disclosure .
Compiled from the ransomware.live profile for Obsoft and from this database. Figures and technique mappings are quoted from the source data, not inferred.
Disclosures attributed to Obsoft in this database run from November 2026 to November 2026, totalling 6 victims — 0% of everything tracked here. Obsoft has listed victims in 1 countries in this database, most often South Korea.
Obsoft has disclosed 6 victims on its leak site, 0% of all ransomware listings tracked in this database. Its earliest disclosure here dates to November 2026.
The group has listed organisations in 1 countries, most often in South Korea (5 victims).
Like most current ransomware operations, Obsoft is likely to use double extortion: data is stolen before files are encrypted, and organisations that refuse to pay are named on the leak site with the stolen data as leverage.
| Organization | Country | Sector | Disclosed |
|---|---|---|---|
|
Company #1
KRSouth Korea
|
KRSouth Korea | — | |
|
Company #2
KRSouth Korea
|
KRSouth Korea | — | |
|
Company #3
KRSouth Korea
|
KRSouth Korea | — | |
|
Company #4
KRSouth Korea
|
KRSouth Korea | — | |
|
Company #5
KRSouth Korea
|
KRSouth Korea | — | |
|
New Victim Company #6
|
— | — |
Obsoft is a ransomware threat group that has claimed 6 victims since its first known activity in November 2026. The group operates by infiltrating target networks, exfiltrating data, encrypting files, and threatening to publish stolen data on a dark web leak site if the ransom is not paid.
Obsoft has claimed 6 victims in our database, representing 0% of all tracked ransomware attacks. The most targeted countries are South Korea.
Obsoft has attacked organizations in 1 countries. The top targeted countries are: South Korea.
Obsoft has targeted organizations across multiple industries including healthcare, manufacturing, and business services.
Obsoft's most recent victim disclosure in our database was on November 3, 2026. Ransomware groups frequently rebrand or go dormant; monitor this page and our ransomware map for the latest activity.
