New Ransomware Group Emerges: Linkc
A new ransomware operation identified as Linkc has emerged in the extortion landscape, operating a Tor-based data leak site titled “Linkc Pub.” First observed in early 2025, the group has maintained active operations through mid-2026, with recent victim disclosures appearing as recently as April of this year. The collective targets organizations within the technology and artificial intelligence sectors, including cloud service providers and aerospace manufacturers.
The group’s infrastructure includes a private login portal alongside its public leak site, indicating a tiered extortion strategy that likely restricts access to additional stolen data for paying victims or negotiators. Linkc has claimed responsibility for breaches at several US-based entities, demanding ransoms in exchange for the return of sensitive materials such as source code, internal documentation, and proprietary datasets.
The H2O.ai Extortion Claim
Linkc’s initial public extortion claim targets H2O.ai, a US-based provider of artificial intelligence and cloud services. Posted on the group’s Tor-hosted data leak site in late January 2025, the listing alleges that the collective obtained unanonymized user datasets specifically prepared for AI training purposes. The threat actor further asserts possession of the complete source code from H2O.ai’s Git repositories, which reportedly includes programming for driverless systems and GPT models.
Beyond technical assets, Linkc claims to have exfiltrated a substantial volume of sensitive internal records. These materials are described as including commercial contracts, customer personal data, project cost structures, and detailed project documentation. The group also alleges it secured backup copies of employee email accounts containing direct correspondence with clients. To substantiate these assertions, Linkc published screenshots of database entries and legal documents on its leak site, alongside a link to a CSV file purportedly derived from the stolen information.
H2O.ai has not issued a public statement addressing the alleged breach or the specific data categories cited by the extortion group.
Operational Profile and Victimology
Linkc’s operational focus extends beyond the artificial intelligence sector to encompass aerospace and advanced manufacturing. The group has claimed responsibility for breaches at Sajet Products, alleging the theft of 700 MB of technical blueprints that include designs for Amazon’s Project Kuiper low-Earth orbit satellite constellation, as well as engine schematics associated with Airbus and Boeing. Another identified victim is StrongLink, a technology firm whose data was reportedly exfiltrated in an attack estimated to have occurred in early February 2026. These incidents illustrate the collective’s strategy of targeting organizations that hold high-value intellectual property within critical infrastructure and defense-adjacent supply chains.
Extortion demands from Linkc have reached as high as $15 million for certain targets, reflecting the group’s assessment of the commercial sensitivity of the stolen materials. While specific ransom figures for H2O.ai remain undisclosed in public records, the scale of the alleged data theft—including source code and customer datasets—suggests a similarly significant financial demand. The group’s leak site, titled “Linkc Pub,” operates without the countdown timers commonly employed by other data-leak sites to pressure victims into payment. Additionally, there is no evidence that Linkc has been discussed or linked on major cybercrime forums, indicating a degree of operational isolation from the broader ransomware ecosystem.
Key points
- Linkc is a new extortion group that launched its data leak site in early 2025, initially targeting the US-based AI developer H2O.ai.
- The group claims to have exfiltrated unanonymized user datasets, full source code for driverless systems and GPT models, and internal contracts from H2O.ai.
- Linkc operates a Tor-hosted public leak site titled 'Linkc Pub' that displays screenshots of databases and legal documents purportedly stolen from the victim.
- The group has not released a countdown timer for data publication but threatens to make all stolen information available to visitors if ransom demands are not met.