Threat actor analysis
Pixelleaks has disclosed 1 victims on its leak site, 0% of all ransomware listings tracked in this database. Its earliest disclosure here dates to November 2026.
The group has listed organisations in 1 countries, most often in Italy (1 victims).
Like most current ransomware operations, Pixelleaks is likely to use double extortion: data is stolen before files are encrypted, and organisations that refuse to pay are named on the leak site with the stolen data as leverage.