Ransomware needs a way in. Stolen credentials are the cheapest one.
sovcali Ransomware Group
Ransomware group profile
Description
Sovcali is a ransomware operation that emerged in August 2026, utilizing double-extortion tactics to coerce ransom payments from targeted organizations. The group gained notoriety for a significant exfiltration of proprietary automotive engineering data, threatening public disclosure to increase pressure on victims.
Key insights
- •Operates using double-extortion tactics by exfiltrating sensitive data before encrypting systems.
- •Targets high-value industries, particularly automotive and transportation sectors.
- •Employs custom ransomware that utilizes AES-256 and RSA encryption for file locking.
- •Accesses victim networks through bought compromised credentials or phishing attacks.
- •Demonstrates high operational impact by staging and exfiltrating multi-terabyte databases.
- •Listens for ransom payments through threats of public disclosure on a Tor leak site.
Threat Level & Status Breakdown
For sovcali · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for sovcali in the selected period
No intelligence data for this group.
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for sovcali
T1562
Impair Defenses
T1059
Command and Scripting Interpreter
T1486
Data Encrypted for Impact
T1490
Inhibit System Recovery
T1021
Remote Services
T1080
Taint Shared Content
T1040
T1040
T1078
Valid Accounts
T1547
Boot or Logon Autostart Execution
Victims(2)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Alert | — | Negotiating | 29 days ago | |
| Lucidmotors | United States | Claimed | about 1 month ago |
Affected countries(1)
Countries where this group has been reported to target or leak victims.