Apt73

☆ pin

Also known as APT73, Wolves of Turan

Reports

First seen

May 21, 2026

Last seen

Jul 24, 2026

Motivation

Financial

Targeting

Sectors

Government ×4 Other ×2 Media & Entertainment ×1 Transport & Logistics ×1 Healthcare ×1 Hospitality ×1

Victim regions

×1

×2

Armenia×2

Panama×1

Argentina×1

Thailand×1

North Macedonia×1

Iran×1

Brazil×1

Austria×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Indicators

domain ×31ip_v4 ×4hash_sha256 ×2hash_md5 ×1

Indicator values are available on Pro and via the API.

Recent reports

Medium

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Targeting

Indicators

Recent reports

Apt73 publishes victim: metrabyte.cloud

APT73 claims victim: dgcement.com

Apt73 claims new victim: azarestan.com

Apt73 ransomware claims victim: vicentetrapani.com

APT73 publishes new victim: westernint.com

APT73 claims victim: aydeniz.com

APT73 claims Flazio as ransomware victim on ransomware.live

Apt73 publishes Holiday Palace as ransomware victim

Apt73 publishes ritavo.com as ransomware victim

Apt73 publishes new victim: kliknklik.com

APT73 publishes Brazilian government victim on leak site

Apt73 claims Vienna Airport in ransomware extortion post

Apt73 publishes new victim: smarty.arpinet.am

Apt73 publishes elections.mia.gov.am victim claim on ransomware.live

Apt73 publishes Turkish government victim on ransomware.live

Apt73 publishes victim: minsa.com.mx

Apt73 claims TVN Media (Panama) in ransomware extortion

Apt73 claims Grupo Petersen as ransomware victim

Apt73 claims victim narit.or.th

Apt73 claims alkaloid.com.mk victim on ransomware.live

Apt73 publishes new victim: ungererandcompany.com