Teamxxx, an emerging ransomware group, launched in June 2025 claiming to have victims across eight countries, including the United States, United Kingdom, Norway, with twelve recorded incidents thus far.
Who Teamxxx is
TeamXXX is an emerging ransomware group that launched its leak site in June 2025, claiming victims across healthcare, agriculture, hospitality, financial services, and shipping sectors in the US, UK, Norway, Ireland, and Europe within its first months.
Recorded activity
Disclosures attributed to Teamxxx in this database run from June 2025 to August 2025, totalling 12 victims — 0.1% of everything tracked here. Teamxxx has listed victims in 8 countries in this database, most often United States, followed by United Kingdom and Germany. The sectors appearing most in its listings are Healthcare, Transportation/Logistics, Business Services.
Indicators of compromise
Showing a sample of 1 IP on file. Hashes and network indicators published for Teamxxx. Leak-site addresses are deliberately excluded. Indicators age quickly — treat a match as a starting point for investigation, and an absence of matches as no assurance.
YARA detection rules
teamxxx.yar
/*
teamxxx ransomware
*/
rule teamxxx_Ransomnote
{
meta:
author = "ransomware.live"
family = "ransomware.teamxxx"
description = "Detects teamxxx ransomware ransom note or artifact"
date = "2026-05-04"
severity = 7
score = 70
strings:
$name1 = "teamxxx" ascii nocase
$name2 = "TEAMXXX" ascii
$onion = "teamxxx.onion" ascii nocase
condition:
any of them
}
Community-contributed rules for Teamxxx, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.
