EMPERADOR Ransomware

EMPERADOR is an emerging extortion/ransomware operation first tracked publicly in August 2026. The actor operates a dedicated Tor leak site and rapidly accumulated claims spanning government, education, energy, technology, transportation and other sectors across several regions.

The strongest public evidence supports leak-site driven data-extortion activity. Vendor intelligence additionally maps encryption, recovery inhibition, RDP, valid-account use and WMI to the actor, but the public evidence beneath those mappings is uneven; these technical behaviors should therefore be retained with medium confidence rather than treated as universally observed across EMPERADOR incidents.