Ransomware Group: WORLDLEAKS

VICTIM NAME: AntFarm

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the WORLDLEAKS Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The ransomware leak page concerns a business incubator named AntFarm, which is based in Mumbai, India, and specializes in nurturing early-stage startups within the digital media and technology sectors. The attack date is listed as June 7, 2025, with the incident being discovered shortly after, on June 7, 2025, at around 12:15 PM. The page indicates that the attacker has not provided any available data indicating employee information, third-party details, or specific internal content leaks. The incident appears to involve an info-stealer component, but no detailed statistics or data fragments are disclosed on the leak site. The page does not include explicit screenshots or download links, and the focus is on reporting the compromise without revealing sensitive or PII-related information. The targeted victim, AntFarm, is involved in fostering startup growth, and the attack could potentially impact its operational data, though no specific files or data have been publicly leaked at this time.

The incident appears to be linked to a ransomware group or group of hackers operating under a known leak group, identified as ‘worldleaks.’ While the attack specifics are not provided, the public leak platform lists the victim’s domain and reports the attack date, emphasizing the timing of the compromise. No additional press releases or overt disclosures about the attack’s nature or the data affected are available on this leak page. The lack of explicit screenshots, download options, or user data indicates that the attackers might be withholding detailed stolen information, or that the leak is more of a warning and alert rather than a data dump. The victim’s industry and country are noted, but no sensitive individual or corporate details are exposed via this leak listing.