RANSOMEDVC is for sale Listed by Ransomed Ransomware Group

On October 30, 2023, the ransomware group Ransomed listed RANSOMEDVC for sale on its leak site, announcing it had exfiltrated internal files from the victim during a ransomware attack. The seller, who claims to be the original operator, states they no longer wish to be monitored by federal agencies and are selling the entire project, including domains and a ransomware builder described as 100% FUD that bypasses antivirus and automatically infects LAN devices.

Details in the Leak Listing

The primary disclosure on the Ransomed leak site does not quantify how many records were taken or name the specific company behind RANSOMEDVC. It states that internal files were exfiltrated in a ransomware attack and that the operator is now attempting to sell the entire operation as a going concern. The package explicitly includes domains and a ransomware builder capable of evading detection and spreading across local networks. No further technical details about the initial access method or exact data types appear in the listing itself.

The listing makes clear the data has already been taken out of the victim environment. Because the seller is offering the project for continued operation by a new buyer, any information contained in the stolen files could be used, repackaged, or publicly released if a sale does not occur quickly.

Why This Matters for You and Your Family

When a ransomware operator puts an entire victim project up for sale, the internal files they stole often contain employee records, customer information, contracts, or credentials that can be exploited long after the initial attack. Even though the listing does not specify what was taken, the exposure of internal files from any organization creates downstream risk for anyone whose data touched that environment.