[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f39H_5RVuUnFzith5POTDpn7n9OEtyMd_acWOKOs8gCg":3,"$fsruP6X3kFVDRqY_VF4UNVOd3-iFN8sQq0oJo8FnDqOY":66},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":63,"created_at":64,"updated_at":65,"published_at":28},"new-ransomware-group-linkc-targets-h2o-ai-with-extortion-claims","New Ransomware Group Linkc Targets H2O.ai with Extortion Claims","The group has published alleged stolen data, including source code and internal documents, on a Tor-hosted leak site.","A newly identified ransomware operation named Linkc has emerged, claiming to have breached AI and cloud provider H2O.ai and demanding payment in exchange for withheld sensitive corporate information.",[10,11,12,13,14],"Ransomware","H2O.ai","Data Exfiltration","Cybersecurity Threats","Extortion","# New Ransomware Group Linkc Targets H2O.ai with Extortion Claims\n\n*The group has published alleged stolen data, including source code and internal documents, on a Tor-hosted leak site.*\n\n**Tags:** `Ransomware` `H2O.ai` `Data Exfiltration` `Cybersecurity Threats` `Extortion`\n\n> A newly identified ransomware operation named Linkc has emerged, claiming to have breached AI and cloud provider H2O.ai and demanding payment in exchange for withheld sensitive corporate information.\n\n---\n\n## New Ransomware Group Emerges: Linkc\n\nA new ransomware operation identified as Linkc has emerged in the extortion landscape, operating a Tor-based data leak site titled “Linkc Pub.” First observed in early 2025, the group has maintained active operations through mid-2026, with recent victim disclosures appearing as recently as April of this year. The collective targets organizations within the technology and artificial intelligence sectors, including cloud service providers and aerospace manufacturers.\n\nThe group’s infrastructure includes a private login portal alongside its public leak site, indicating a tiered extortion strategy that likely restricts access to additional stolen data for paying victims or negotiators. Linkc has claimed responsibility for breaches at several US-based entities, demanding ransoms in exchange for the return of sensitive materials such as source code, internal documentation, and proprietary datasets.\n\n## The H2O.ai Extortion Claim\n\nLinkc’s initial public extortion claim targets H2O.ai, a US-based provider of artificial intelligence and cloud services. Posted on the group’s Tor-hosted data leak site in late January 2025, the listing alleges that the collective obtained unanonymized user datasets specifically prepared for AI training purposes. The threat actor further asserts possession of the complete source code from H2O.ai’s Git repositories, which reportedly includes programming for driverless systems and GPT models.\n\nBeyond technical assets, Linkc claims to have exfiltrated a substantial volume of sensitive internal records. These materials are described as including commercial contracts, customer personal data, project cost structures, and detailed project documentation. The group also alleges it secured backup copies of employee email accounts containing direct correspondence with clients. To substantiate these assertions, Linkc published screenshots of database entries and legal documents on its leak site, alongside a link to a CSV file purportedly derived from the stolen information.\n\nH2O.ai has not issued a public statement addressing the alleged breach or the specific data categories cited by the extortion group.\n\n## Operational Profile and Victimology\n\nLinkc’s operational focus extends beyond the artificial intelligence sector to encompass aerospace and advanced manufacturing. The group has claimed responsibility for breaches at Sajet Products, alleging the theft of 700 MB of technical blueprints that include designs for Amazon’s Project Kuiper low-Earth orbit satellite constellation, as well as engine schematics associated with Airbus and Boeing. Another identified victim is StrongLink, a technology firm whose data was reportedly exfiltrated in an attack estimated to have occurred in early February 2026. These incidents illustrate the collective’s strategy of targeting organizations that hold high-value intellectual property within critical infrastructure and defense-adjacent supply chains.\n\nExtortion demands from Linkc have reached as high as $15 million for certain targets, reflecting the group’s assessment of the commercial sensitivity of the stolen materials. While specific ransom figures for H2O.ai remain undisclosed in public records, the scale of the alleged data theft—including source code and customer datasets—suggests a similarly significant financial demand. The group’s leak site, titled “Linkc Pub,” operates without the countdown timers commonly employed by other data-leak sites to pressure victims into payment. Additionally, there is no evidence that Linkc has been discussed or linked on major cybercrime forums, indicating a degree of operational isolation from the broader ransomware ecosystem.\n\n## Key points\n\n- Linkc is a new extortion group that launched its data leak site in early 2025, initially targeting the US-based AI developer H2O.ai.\n- The group claims to have exfiltrated unanonymized user datasets, full source code for driverless systems and GPT models, and internal contracts from H2O.ai.\n- Linkc operates a Tor-hosted public leak site titled 'Linkc Pub' that displays screenshots of databases and legal documents purportedly stolen from the victim.\n- The group has not released a countdown timer for data publication but threatens to make all stolen information available to visitors if ransom demands are not met.\n\n## Further reading & sources\n\n- [How's that for a malicious Linkc, new group launches DLS - CYJAX](https:\u002F\u002Fcyjax.com\u002Fresources\u002Fblog\u002Fhows-that-for-a-malicious-linkc-new-group-launches-dls)\n- [Ransomware.live: linkc](https:\u002F\u002Fransomware.live\u002Fgroup\u002Flinkc)","https:\u002F\u002Fllqtyrforgvojyokyvkk.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fnew-ransomware-group-linkc-targets-h2o-ai-with-extortion-claims.png",{"iocs":18,"actors":22,"targets":30,"timeline":39,"industries":56,"technologies":60},[19],{"type":20,"value":21},"other","Linkc Pub",[23],{"url":24,"name":25,"slug":26,"type":27,"origin":28,"motivation":29},"\u002Fthreat-groups\u002Flinkc","Linkc","linkc","ransomware",null,"financial",[31,35],{"name":11,"sector":32,"status":33,"geography":34},"Technology \u002F AI","claimed","US",{"name":36,"sector":37,"status":38,"geography":28},"Sajet Products","Technology","confirmed",[40,44,48,52],{"date":41,"event":42,"description":43},"2025-01-29","Breach Claim Posted","Linkc posted a claim of breach against H2O.ai on its DLS.",{"date":45,"event":46,"description":47},"2025-02-19","first_discovered","First discovered date for Linkc group.",{"date":49,"event":50,"description":51},"2025-02-20","Observation Date","Cyjax observed the status of the Linkc DLS and its single victim listing.",{"date":53,"event":54,"description":55},"2026-04-08","last_discovered","Last discovered date for Linkc group.",[57],{"url":58,"name":37,"slug":59},"\u002Findustries\u002Ftechnology","technology",[61],{"vendor":11,"product":62},"AI\u002FCloud Services Platform","threat_actor_activity","2026-08-18T18:41:58.855449+00:00","2026-08-18T18:47:13.093963+00:00",{"articles":67},[68,78,89,100],{"slug":69,"title":70,"summary":71,"tags":72,"hero_image_url":76,"story_type":63,"created_at":77},"trend-micro-exposes-the-gentlemen-ransomware-group-s-advanced-driver-abuse-and-a","Trend Micro Exposes The Gentlemen Ransomware Group's Advanced Driver Abuse and Anti-AV Tactics","Trend Micro has detailed the sophisticated tactics of The Gentlemen ransomware group, which leverages legitimate driver abuse and Group Policy Object manipulation to compromise manufacturing, healthcare, and construction sectors globally.",[73,10,74,75,13],"The Gentlemen","Trend Micro","Driver Abuse","https:\u002F\u002Fllqtyrforgvojyokyvkk.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ftrend-micro-exposes-the-gentlemen-ransomware-group-s-advanced-driver-abuse-and-a.png","2026-08-18T18:29:37.334637+00:00",{"slug":79,"title":80,"summary":81,"tags":82,"hero_image_url":86,"story_type":87,"created_at":88},"gdlockersec-claims-attacks-on-nigerian-agency-and-aws-but-evidence-suggests-amat","GDLockerSec Claims Attacks on Nigerian Agency and AWS, but Evidence Suggests Amateur Operation","The GDLockerSec ransomware group has claimed responsibility for attacks on a Nigerian government agency and Amazon Web Services in January 2025, yet forensic analysis indicates the operation is amateurish and relies on exaggerated narratives to inflate its reputation within the cybercrime ecosystem.",[83,10,84,85,13],"GDLockerSec","AWS","Nigeria","https:\u002F\u002Fllqtyrforgvojyokyvkk.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgdlockersec-claims-attacks-on-nigerian-agency-and-aws-but-evidence-suggests-amat.png","ransomware_incident","2026-08-18T18:35:26.293755+00:00",{"slug":90,"title":91,"summary":92,"tags":93,"hero_image_url":98,"story_type":87,"created_at":99},"hunters-international-ceases-operations-announces-mass-leak-of-stolen-data-from-","Hunters International Ceases Operations, Announces Mass Leak of Stolen Data from 67 Victims","Hunters International has officially closed its project and announced it will leak stolen data from 67 victims, following a period of increased law enforcement pressure that led to its rebranding as World Leaks earlier this year.",[10,94,95,96,97],"Data Extortion","Hunters International","World Leaks","Cybercrime","https:\u002F\u002Fllqtyrforgvojyokyvkk.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhunters-international-ceases-operations-announces-mass-leak-of-stolen-data-from-.png","2026-08-18T18:39:28.135907+00:00",{"slug":101,"title":102,"summary":103,"tags":104,"hero_image_url":110,"story_type":111,"created_at":112},"attackers-exploit-sharepoint-authentication-bypass-cve-2026-55040-following-publ","Attackers Exploit SharePoint Authentication Bypass CVE-2026-55040 Following Public PoC Release","Microsoft SharePoint is under active attack as threat actors exploit CVE-2026-55040, a critical security feature bypass with a CVSS score of 9.1, immediately after public proof-of-concept code became available.",[105,106,107,108,109],"SharePoint","CVE-2026-55040","Authentication Bypass","Active Exploitation","Microsoft Security","https:\u002F\u002Fllqtyrforgvojyokyvkk.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fattackers-exploit-sharepoint-authentication-bypass-cve-2026-55040-following-publ.png","exploitation","2026-08-18T18:47:03.864693+00:00"]