Threat Group Profile
morpheus
● Active — last 30 days
Victim claims
8
First seen
Apr 2026
Last activity
30 Jul 2026
Tracked since
Jan 2025
Group overview
Morpheus emerged in late 2024 as a semi-private RaaS operation whose affiliates share identical payloads with the HellCat ransomware group, targeting pharmaceutical, manufacturing, legal, and Italian ESXi environments with ransom demands reaching up to 32 BTC (~$3M USD).
Preferred targets
Business Services · 3
Financial Services · 2
Technology · 1
Professional Services · 1
Manufacturing · 1
Most targeted countries
IN · 3
US · 1
DK · 1
SG · 1
TW · 1