Ransomware needs a way in. Stolen credentials are the cheapest one.
sovcali Ransomware Group
Ransomware group profile
Description
Sovcali is a ransomware operation that emerged in August 2026, utilizing double-extortion tactics to coerce ransom payments from targeted organizations. The group gained notoriety for a significant exfiltration of proprietary automotive engineering data, threatening public disclosure to increase pressure on victims.
Key insights
- •Operates using double-extortion tactics by exfiltrating sensitive data before encrypting systems.
- •Targets high-value industries, particularly automotive and transportation sectors.
- •Employs custom ransomware that utilizes AES-256 and RSA encryption for file locking.
- •Accesses victim networks through bought compromised credentials or phishing attacks.
- •Demonstrates high operational impact by staging and exfiltrating multi-terabyte databases.
- •Listens for ransom payments through threats of public disclosure on a Tor leak site.
Threat Level & Status Breakdown
For sovcali · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for sovcali in the selected period
No intelligence data for this group.
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for sovcali
T1562
Impair Defenses
T1059
Command and Scripting Interpreter
T1486
Data Encrypted for Impact
T1490
Inhibit System Recovery
T1021
Remote Services
T1080
Taint Shared Content
T1040
T1040
T1078
Valid Accounts
T1547
Boot or Logon Autostart Execution
Victims(8)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| HollywoodHair | Poland | Claimed | about 24 hours ago | |
| Warp9 Microsolutions | — | Claimed | 4 days ago | |
| leak #1 lucidmotors | — | Claimed | 13 days ago | |
| Lucid | — | Claimed | 13 days ago | |
| Lucidmotors | United States | Claimed | 2 months ago | |
| THE ENDGAME OF LUCID MOTORS’ PSYCHOLOGICAL GAME | — | Claimed | 13 days ago | |
| They Failed. 100GB Drops in 2 Days | — | Claimed | 13 days ago | |
| Alert | — | Negotiating | about 2 months ago |
Affected countries(2)
Countries where this group has been reported to target or leak victims.