Latest Research on INC and The Gentlemen Ransomware: Exposed AI Infrastructure
triple x Ransomware Group
Ransomware group profile
Description
Triple X is a ransomware group that emerged in May 2026, specializing in the exfiltration of sensitive data to extort victims. They utilize a double-extortion model and maintain a leak site on the Tor network to publish stolen data, primarily targeting financial institutions and professional services.
Key insights
- •Employs double-extortion tactics, threatening public release of stolen data.
- •Targets primarily financial institutions and professional service firms.
- •Gains initial access through brute force attacks on RDP services and exploitation of valid accounts.
- •Uses command and scripting interpreters for movement within compromised networks.
- •Impairs security tools and deletes backups to obstruct recovery efforts.
Threat Level & Status Breakdown
For triple x · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for triple x in the selected period
No intelligence data for this group.
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for triple x
T1110
Brute Force
T1562
Impair Defenses
T1046
Network Service Discovery
T1059
Command and Scripting Interpreter
T1486
Data Encrypted for Impact
T1490
Inhibit System Recovery
T1021
Remote Services
T1021.001
Remote Desktop Protocol
T1569
T1569
T1078
Valid Accounts
T1547
Boot or Logon Autostart Execution
Affected countries(4)
Countries where this group has been reported to target or leak victims.