Cybercrime medium Unknown — no attribution to any nation-state or region is offered in current reporting.

Emperador

Newly identified extortion group operating its own leak site; not linked in current reporting to any previously known brand. Leak-site claims are single-vendor (SOCRadar, dexpose, ransomware.live). · Financial extortion via data-leak-site claims (sale/exposure pressure); no ransom demand has been made public.

Reports 1

Active Since Approximately August 10-12, 2026 (first tracked)

Last Reported 23 Aug 2026

Sectors Targeted critical-infrastructure, communications

Tactics, Techniques & Procedures (TTPs)

No confirmed initial-access technique disclosed; SOCRadar lists generic likely entry points (RDP, VPN, brute force, phishing loaders) as general assessment, not confirmed findings
Double extortion per SOCRadar; ransomware.live calls the group emerging
The earlier infostealer-credentials inference is unsourced: the dexpose write-up does not mention it

Known Targets

EVNHANOI / Vietnam Electricity: 22 August 2026 claim of 300GB+ (13.36M customer rows, 6.99M subscriptions, 2.26M accounts), price "open to negotiation"; the claim is confirmed as the group's own but not by EVN or independent sources; sources disagree on the domain (evn.com.vn vs evnhanoi.vn)Receita Federal do Brasil (listed 23 September 2026, claim)Pancaribbean Logistics Group, Panama (listed 5 October 2026, claim)Metrocolor S.A., Peru; also listed: Easy Job S.A.S., SiteProRentals, Hanwha Renewables, Westbridge Institute of Technology and M&M Odontoclinica (all SOCRadar-reported claims)SOCRadar's group page reports 73 victims, mostly claimed; recent victims are mostly Latin American, so the earlier Asia-only picture is incomplete

Analyst Notes

First tracked around 10–12 August 2026. All victim listings are the group's own claims relayed by SOCRadar; none is independently confirmed. The earlier note that a Philippine municipality was the "first listed victim" was not corroborated and was removed. SOCRadar labels the group ransomware while earlier text called it extortion-only; the encryption status is unconfirmed. Treat all figures as unverified.

Intelligence Reports

Briefing critical-infrastructurecommunications

Emperador Extortion Group Claims Breach of Vietnam's Largest Power Utility

A newly surfaced extortion group calling itself Emperador claims to have breached EVNHANOI, part of Vietnam Electricity, exposing over 300GB of customer and account data. The claim is unconfirmed by EVN or Vietnamese authorities.

23 Aug 2026 · 4 min read