Ransomware needs a way in. Stolen credentials are the cheapest one.
pear Ransomware Group
Ransomware group profile
Description
The PEAR group, known for its ransomware operations, specializes in data exfiltration and extortion since its emergence in July 2025. They aim to steal sensitive information and threaten to release it unless a ransom is paid, using techniques that obscure their identity and intentions. Operating with a low-noise, high-pressure approach, they manipulate victims by posing as legitimate penetration testers during negotiations.
Key insights
- •PEAR operates as a ransom group focusing on data theft rather than encryption.
- •Common initial access methods include credential abuse, phishing, and exploiting unsecured VPNs.
- •The group maintains an average dwell time of approximately 41 days in compromised networks.
- •Communication methods associated with PEAR include contact via Tox and pseudonymous email.
- •They threaten to publish exfiltrated data on their leak site if ransom negotiations fail.
Threat Level & Status Breakdown
For pear · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for pear in the selected period
Intelligence
IOCs, YARA/Sigma rules, and related families for pear
- onionmail.org
- pearsmob5sn44ismokiusuld34pnfwi6ctgin3qbvonpoob4lh3rmtqd.onion
- peargxn3oki34c4savcbcfqofjjwjnnyrlrbszfv6ujlx36mhrh57did.onion
- xq5m6ofel63h57by46algju25g37zkdwoxxt7ij45b6obo4mxzc3h6id.onion
- xsomiaq5awxh3zkzn334s3dgwuvngy6z2to7265exgovnkwk66hjypid.onion
- 5qynbyjl4u6vbtnmpokslaxaknyicdvty7vn2qgxmaty3lb7wwxpkbid.onion
- etus2tmakckdlkyjpevoyciuao7er5fj3qm26aev3nch4fusptefiayd.onion
- q2bg7ljsrpmy6736qqmpwsnqqm3w6d3hhrokohytnmldbom7sthp4sad.onion
- m3wwhkus4dxbnxbtihexlyd2cv63qrvex6jiebc4vqe22kg2z3udebid.onion
- e7a6zgqfijn2ko6lzkz53tysjpnf22fxj4h2f3saufrmsts5pbul5eid.onion
- glheoet37vdimgho57tqj76v7fnebnbqxn65bounxyt6hduilkso4yyd.onion
- psvrn6ahevi6dgf55bzc26q3gjc7s6n7vcth34rmkl2y7e7dijhjfiqd.onion
- yxwomyfmexm3bfcuumnugrzwluol5qwsw6pmne7jklgmzthkp35l2jqd.onion
- aw6wb6lmqbtp5po7qrmvmujulbxw4eeeolpg3byva2bgoj44psdugmid.onion
- csxilwnl7orv6rwfjen5ye3tefk5shjtr4tysuykgxjsyngpvoqrvbid.onion
- 757ylxaeemidrhrmmuz6rkxw5jlk65oqou3lvi6evxtrr2nhm5ytmrqd.onion
- diyr2bnty7iktyxfd4kz65uigcfappjvux73dpgkkeocp3fmlgnuzyyd.onion
- njqaowdto3tfbbco575fkmhahszxfw7fiprbfmt6y6kfy5fntt45akyd.onion
- 3hzi7qjklm632atxj5k67p3bxdie5aipvf6tsbtc2xlfbcellujyxryd.onion
- smnalvhqecyjf7reptunoevh6jd6x7ofpz4tj2plyg5a4q667givgqyd.onion
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for pear
T1486
T1486
T1490
T1490
T1078
T1078
T1021
T1021
T1562
T1562
T1047
T1047
T1021.001
T1021.001
T1059
T1059
T1389
T1389
T1105
T1105
T1071.001
T1071.001
Victims(85)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Kellys Home Center | United States | Claimed | 11 days ago | |
| Indroj Medical Group | United States | Claimed | 15 days ago | |
| Martin Lawrence Galleries | United States | Claimed | 15 days ago | |
| Westside GI | United States | Claimed | 15 days ago | |
| Software Answers | United States | Claimed | 8 days ago | |
| Foss Inc. | United States | Claimed | 28 days ago | |
| Kovo Healthtech Corp | United States | Claimed | about 1 month ago | |
| EdgeChem Jamaica Limited | Jamaica | Claimed | about 1 month ago | |
| Next Level Urgent Care | United States | Claimed | about 1 month ago | |
| Mogren, Glessner & Ahrens | United States | Claimed | about 2 months ago | |
| Island Networks | Jamaica | Claimed | about 2 months ago | |
| Clifton Architectural Glass and Metal | United States | Claimed | about 2 months ago | |
| First Commerce LLC | United States | Claimed | about 2 months ago | |
| Club One Casino | United States | Claimed | about 2 months ago | |
| Practi-Cal | United States | Claimed | about 2 months ago | |
| Austin Plastic Surgery Institute | United States | Claimed | about 2 months ago | |
| Medical Arts Chemists and Surgicals | United States | Claimed | about 2 months ago | |
| Metropolitan Construction Systems | United States | Claimed | 3 months ago | |
| Sonitor | United States | Claimed | 2 months ago | |
| Faro | Canada | Claimed | 3 months ago |
Page 1 of 5
Affected countries(45)
Countries where this group has been reported to target or leak victims.