THREATOPS

THREAT OPS › Threat News › [metaencryptor] SFA Engineering Corporation posted to leak site

[metaencryptor] SFA Engineering Corporation posted to leak site

medransomware_livePublished 2026-09-15

Ransomware group: metaencryptor Victim: SFA Engineering Corporation Victim website: sfa.co.kr Sector: Manufacturing Country: KR Discovered: 2026-09-15T11:59:46.342220+00:00 Leak-site post: https://metacrpttdfpbm4qoxzcrqqgr6e6zafpazgxm72knmujw2mwvi34rwad.onion/0AFC:b4e5dcfb3b326b048e07e9eb243f13de/0AFC:e7a37dfd17dd56a4dbf0ace14ec1970c3803b2c7819d8b27b95efd14633411c040dd911a325f1324eb38cedd28917dcb

Indicators of compromise

sfa.co.krdomain
https://metacrpttdfpbm4qoxzcrqqgr6e6zafpazgxm72knmujw2mwvi34rwad.onion/0AFC:b4e5dcfb3b326b048e07e9eb243f13de/0AFC:e7a37dfd17dd56a4dbf0ace14ec1970c3803b2c7819d8b27b95efd14633411c040dd911a325f1324eb38cedd28917dcburl

Original source: https://metacrpttdfpbm4qoxzcrqqgr6e6zafpazgxm72knmujw2mwvi34rwad.onion/0AFC:b4e5dcfb3b326b048e07e9eb243f13de/0AFC:e7a37dfd17dd56a4dbf0ace14ec1970c3803b2c7819d8b27b95efd14633411c040dd911a325f1324eb38cedd28917dcb