Group profile21 claimed in last 30d23 total tracked

Pure Extraction And Ransom

Forward this

Pure Extraction And Ransom (PEAR) Team has been unusually active in its first month of tracked activity, claiming 13 victims in the past 30 days out of 14 total, a pace that marks it as one of the more prolific newcomers currently on the board. Claimed targets span a broad range of sectors including financial services, construction, marine, electrical, and distribution, with a geographic lean toward the United States and smaller footprints in Norway and Canada. The victim profile skews toward small and mid-sized businesses rather than large enterprise targets, suggesting either opportunistic access brokering or a deliberate strategy of volume over headline impact. PEAR's operators describe themselves as a private, disciplined team with no affiliations to other threat actors, though such self-characterizations carry no independent verification and are standard distancing rhetoric within ransomware-as-a-service and closed-group ecosystems. No detailed TTP catalog has been publicly attributed to PEAR at this stage, but the rapid claiming cadence and sector diversity are consistent with groups that rely on commodity initial access and automated deployment tooling.

Brief by The Nexus · Jun 27 · 15:03 UTC

Pure Extraction And Ransom (PEAR) Team is the community of highly responsible and strictly disciplined members. We are a private team and have nothing common with any other threat actors. We've been monitoring this field for a long-long time. So, we understand all the processes and know well how it all works.

First seen: May 19 · 00:00 UTCLast seen: Jul 8 · 00:00 UTCTracked since: 2025-08-05

Sectors hit

Transportation/Logistics1
Technology1
Unspecified1
Manufacturing1
Financial Services1
Consumer Services1
Construction1
Agriculture and Food Production1

Countries hit

United States5
Singapore1
Norway1
Canada1

MITRE ATT&CK · observed TTPs8 tactics

Tactics and techniques attributed to PURE EXTRACTION AND RANSOM by ransomware.live's curated TTP catalog. Identifiers link to the canonical MITRE ATT&CK reference for each tactic or sub-technique.

TA0001Initial Access
- T1078Valid Accounts
- T1566Phishing
TA0002Execution
- T1059.001Command and Scripting Interpreter: PowerShell
- T1204.002User Execution: Malicious File
- T1204.004User Execution: Malicious Copy and Paste
TA0003Persistence
- T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
TA0005Defense Evasion
- T1027.013Obfuscated Files or Information: Encrypted/Encoded File
- T1055.001Process Injection: DLL Injection
TA0006Credential Access
- T1056.001Input Capture: Keylogging
- T1555.003Credentials from Password Stores: Credentials from Web Browsers
TA0009Collection
- T1005Data from Local System
- T1074Data Staged
- T1114Email Collection
- T1213Data from Information Repositories
- T1560.001Archive Collected Data: Archive via Utility
TA0010Exfiltration
- T1041Exfiltration Over C2 Channel
- T1567Exfiltration Over Web Service
- T1567.004Exfiltration Over Webhook
TA0011Command and Control
- T1071.001Application Layer Protocol: Web Protocols
- T1090.003Proxy: Multi-hop Proxy

Recent claimed victims

Jul 8 · 12:55 UTC

Tostrud & Temp, S.C.

AC Beverage, Inc.

CNW Electronics Pte Ltd

AC Beverage, Inc.

CNW Electronics Pte Ltd

Spector and Lenz, PC

ORA Group Information

Sociedad Latina

Sociedad Latina

Optimum First Mortgage

Optimum First Mortgage

B & B Trading

Release Marine, Inc.

Kirbor Homes

K & E Distributing

Bayou Electrical Services

National Health Fund

Alpha IT

K & E Distributing

Bayou Electrical Services

Alpha IT

Plexsupply Inc

Kinsmen TeleMiracle