Ms13089

aka ms13-089 Active

MS13089 is a newly emerged ransomware group (first observed December 2025) that named itself after a 2013 Microsoft Security Bulletin, claiming a handful of victims including a law firm, operating primarily as a double-extortion actor.

3 Victims

Dec 18, 2025 First Discovered

Jan 15, 2026 Last Discovered

108 Days Inactive

0% Infostealer

1/1 Sites Online

Top Countries

LU 1

IT 1

DE 1

Top Sectors

Business Services 2

Healthcare 1

Known Locations (1)

MS13-089 Blog

msleakjir7pxbe6onlqe5uwgvdmy6nq4mnwfy7ojswbhnleenm77vgad.onion

Victims (3)

sjl-legal.com

LU Business Services Discovered: Jan 15, 2026 · Attack est.: Jan 15, 2026

SJL is a high-end independent business law firm renowned for its savoir faire and reliability. The firm has been created in 2010 as an independent alternative investment funds, finance, corporate...

dgpcommercialisti.it

IT Business Services Discovered: Dec 18, 2025 · Attack est.: Dec 18, 2025

Aree di specializzazione: contabilità, bilanci, dichiarazioni fiscali, incarichi di sindaco e revisore legale, consulente tecnico d’ufficio, ristrutturazioni e operazioni straordinarie. Consulenza Societaria, ordinaria e straordinaria, ivi...

uro.com

DE Healthcare Discovered: Dec 18, 2025 · Attack est.: Dec 18, 2025

Virginia Urology (VU) has a long history of providing quality care to the Greater Richmond metro area since 1929. This practice prides itself on its strong commitment to the community’s...