[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f39H_5RVuUnFzith5POTDpn7n9OEtyMd_acWOKOs8gCg":3,"$fsruP6X3kFVDRqY_VF4UNVOd3-iFN8sQq0oJo8FnDqOY":62},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":59,"created_at":60,"updated_at":61,"published_at":28},"new-ransomware-group-linkc-targets-h2o-ai-with-extortion-claims","New Ransomware Group Linkc Targets H2O.ai with Extortion Claims","The group has published alleged stolen data, including source code and internal documents, on a Tor-hosted leak site.","A newly identified ransomware operation named Linkc has emerged, claiming to have breached AI and cloud provider H2O.ai and demanding payment in exchange for withheld sensitive corporate information.",[10,11,12,13,14],"Ransomware","H2O.ai","Data Exfiltration","Cybersecurity Threats","Extortion","# New Ransomware Group Linkc Targets H2O.ai with Extortion Claims\n\n*The group has published alleged stolen data, including source code and internal documents, on a Tor-hosted leak site.*\n\n**Tags:** `Ransomware` `H2O.ai` `Data Exfiltration` `Cybersecurity Threats` `Extortion`\n\n> A newly identified ransomware operation named Linkc has emerged, claiming to have breached AI and cloud provider H2O.ai and demanding payment in exchange for withheld sensitive corporate information.\n\n---\n\n## New Ransomware Group Emerges: Linkc\n\nA new ransomware operation identified as Linkc has emerged in the extortion landscape, operating a Tor-based data leak site titled “Linkc Pub.” First observed in early 2025, the group has maintained active operations through mid-2026, with recent victim disclosures appearing as recently as April of this year. The collective targets organizations within the technology and artificial intelligence sectors, including cloud service providers and aerospace manufacturers.\n\nThe group’s infrastructure includes a private login portal alongside its public leak site, indicating a tiered extortion strategy that likely restricts access to additional stolen data for paying victims or negotiators. Linkc has claimed responsibility for breaches at several US-based entities, demanding ransoms in exchange for the return of sensitive materials such as source code, internal documentation, and proprietary datasets.\n\n## The H2O.ai Extortion Claim\n\nLinkc’s initial public extortion claim targets H2O.ai, a US-based provider of artificial intelligence and cloud services. Posted on the group’s Tor-hosted data leak site in late January 2025, the listing alleges that the collective obtained unanonymized user datasets specifically prepared for AI training purposes. The threat actor further asserts possession of the complete source code from H2O.ai’s Git repositories, which reportedly includes programming for driverless systems and GPT models.\n\nBeyond technical assets, Linkc claims to have exfiltrated a substantial volume of sensitive internal records. These materials are described as including commercial contracts, customer personal data, project cost structures, and detailed project documentation. The group also alleges it secured backup copies of employee email accounts containing direct correspondence with clients. To substantiate these assertions, Linkc published screenshots of database entries and legal documents on its leak site, alongside a link to a CSV file purportedly derived from the stolen information.\n\nH2O.ai has not issued a public statement addressing the alleged breach or the specific data categories cited by the extortion group.\n\n## Operational Profile and Victimology\n\nLinkc’s operational focus extends beyond the artificial intelligence sector to encompass aerospace and advanced manufacturing. The group has claimed responsibility for breaches at Sajet Products, alleging the theft of 700 MB of technical blueprints that include designs for Amazon’s Project Kuiper low-Earth orbit satellite constellation, as well as engine schematics associated with Airbus and Boeing. Another identified victim is StrongLink, a technology firm whose data was reportedly exfiltrated in an attack estimated to have occurred in early February 2026. These incidents illustrate the collective’s strategy of targeting organizations that hold high-value intellectual property within critical infrastructure and defense-adjacent supply chains.\n\nExtortion demands from Linkc have reached as high as $15 million for certain targets, reflecting the group’s assessment of the commercial sensitivity of the stolen materials. While specific ransom figures for H2O.ai remain undisclosed in public records, the scale of the alleged data theft—including source code and customer datasets—suggests a similarly significant financial demand. The group’s leak site, titled “Linkc Pub,” operates without the countdown timers commonly employed by other data-leak sites to pressure victims into payment. Additionally, there is no evidence that Linkc has been discussed or linked on major cybercrime forums, indicating a degree of operational isolation from the broader ransomware ecosystem.\n\n## Key points\n\n- Linkc is a new extortion group that launched its data leak site in early 2025, initially targeting the US-based AI developer H2O.ai.\n- The group claims to have exfiltrated unanonymized user datasets, full source code for driverless systems and GPT models, and internal contracts from H2O.ai.\n- Linkc operates a Tor-hosted public leak site titled 'Linkc Pub' that displays screenshots of databases and legal documents purportedly stolen from the victim.\n- The group has not released a countdown timer for data publication but threatens to make all stolen information available to visitors if ransom demands are not met.\n\n## Further reading & sources\n\n- [How's that for a malicious Linkc, new group launches DLS - CYJAX](https:\u002F\u002Fcyjax.com\u002Fresources\u002Fblog\u002Fhows-that-for-a-malicious-linkc-new-group-launches-dls)\n- [Ransomware.live: linkc](https:\u002F\u002Fransomware.live\u002Fgroup\u002Flinkc)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fnew-ransomware-group-linkc-targets-h2o-ai-with-extortion-claims.png?v=e353bc1862",{"iocs":18,"actors":22,"targets":30,"timeline":39,"industries":52,"technologies":56},[19],{"type":20,"value":21},"other","Linkc Pub",[23],{"url":24,"name":25,"slug":26,"type":27,"origin":28,"motivation":29},"\u002Fthreat-groups\u002Flinkc","Linkc","linkc","ransomware",null,"financial",[31,35],{"name":11,"sector":32,"status":33,"geography":34},"Technology \u002F AI","claimed","US",{"name":36,"sector":37,"status":38,"geography":28},"Sajet Products","Technology","confirmed",[40,44,48],{"date":41,"event":42,"description":43},"2025-02-19","First discovered","First discovered date for Linkc group.",{"date":45,"event":46,"description":47},"2025-02-20","Observation Date","Cyjax observed the status of the Linkc DLS and its single victim listing.",{"date":49,"event":50,"description":51},"2026-04-08","Last discovered","Last discovered date for Linkc group.",[53],{"url":54,"name":37,"slug":55},"\u002Findustries\u002Ftechnology","technology",[57],{"vendor":11,"product":58},"AI\u002FCloud Services Platform","threat_actor_activity","2026-08-18T18:41:58.855449+00:00","2026-10-16T12:29:24.222715+00:00",{"articles":63},[64,74,85,97],{"slug":65,"title":66,"summary":67,"tags":68,"hero_image_url":72,"story_type":59,"created_at":73},"trend-micro-exposes-the-gentlemen-ransomware-group-s-advanced-driver-abuse-and-a","Trend Micro Exposes The Gentlemen Ransomware Group's Advanced Driver Abuse and Anti-AV Tactics","Trend Micro has detailed the sophisticated tactics of The Gentlemen ransomware group, which leverages legitimate driver abuse and Group Policy Object manipulation to compromise manufacturing, healthcare, and construction sectors globally.",[69,10,70,71,13],"The Gentlemen","Trend Micro","Driver Abuse","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ftrend-micro-exposes-the-gentlemen-ransomware-group-s-advanced-driver-abuse-and-a.png?v=fb82a8efc1","2026-08-18T18:29:37.334637+00:00",{"slug":75,"title":76,"summary":77,"tags":78,"hero_image_url":82,"story_type":83,"created_at":84},"gdlockersec-claims-attacks-on-nigerian-agency-and-aws-but-evidence-suggests-amat","GDLockerSec Claims Attacks on Nigerian Agency and AWS, but Evidence Suggests Amateur Operation","The GDLockerSec ransomware group has claimed responsibility for attacks on a Nigerian government agency and Amazon Web Services in January 2025, yet forensic analysis indicates the operation is amateurish and relies on exaggerated narratives to inflate its reputation within the cybercrime ecosystem.",[79,10,80,81,13],"GDLockerSec","AWS","Nigeria","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgdlockersec-claims-attacks-on-nigerian-agency-and-aws-but-evidence-suggests-amat.png?v=797dede701","ransomware_incident","2026-08-18T18:35:26.293755+00:00",{"slug":86,"title":87,"summary":88,"tags":89,"hero_image_url":95,"story_type":59,"created_at":96},"ahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-","AhnLab ASEC Links Gunra Ransomware to State-Sponsored Actor in 'Operation Double Barrel'","AhnLab ASEC and four Korean government agencies jointly published 'Operation Double Barrel,' revealing a state-sponsored actor that has continuously distributed malware through Korean financial security software vulnerabilities since 2025 and linking it to the Gunra ransomware group through shared initial access, backdoors, SSH fingerprints, and C2 infrastructure.",[90,91,92,93,94,10],"Gunra","AhnLab ASEC","Operation Double Barrel","FortiOS","FortiProxy","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-.png?v=579bc98ad5","2026-09-18T07:15:06.272711+00:00",{"slug":98,"title":99,"summary":100,"tags":101,"hero_image_url":106,"story_type":83,"created_at":107},"stormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577","StormEncryptor ransomware deployed via N-central auth-bypass CVE-2026-18577","A former Medusa affiliate (Storm-1175) is actively deploying StormEncryptor ransomware through an incomplete patch for CVE-2026-18556 in N-able N-central, allowing unauthenticated remote attackers to bypass authentication and take over the RMM server to reach managed endpoints.",[102,103,104,10,105],"N-able N-central","CVE-2026-18577","StormEncryptor","MSP","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577.png?v=80dc7c8067","2026-09-24T07:05:56.501709+00:00"]