Threat Group Profile
m3rx
● Active — last 30 days
Victim claims
37
First seen
Apr 2026
Last activity
14 Aug 2026
Tracked since
Apr 2026
Group overview
M3rx is a small ransomware group first observed in 2025, using AES-CTR/AES-GCM encryption and targeting organizations in England, the US, Australia, Germany, Italy, and Switzerland, with around eight claimed victims including a Sydney-based property firm.
Preferred targets
Business Services · 9
Consumer Services · 6
Technology · 6
Professional Services · 3
Manufacturing · 2
Transportation/Logistics · 1
Most targeted countries
US · 8
DE · 4
GB · 4
AU · 3
CA · 3
ES · 2