ImNotAVillain Ransomware Operates Without Encryption Through Data Acquisition and Exposure

Executive Summary

ImNotAVillain is an emerging data-only extortion group first observed on September 24, 2026, with two victims identified across the United Kingdom and Italy. The group reportedly targets high-value cryptocurrency users and uses social engineering and alleged law-enforcement impersonation to obtain sensitive KYC, identity, banking, and transaction data without reported network intrusion or file encryption. Its September 2026 activity includes a UK Financial Services victim involving a claimed 680 high-value users and an Italy Government & Defense listing claiming 85,000+ files totaling 150GB. The group operates through Tor and other communication channels, uses Monero demands and paid data-exclusion offers, while its attribution and competing breach claims remain unconfirmed.

Threat Profile

Group Overview

ImNotAVillain operates a data-only extortion model with no file encryption reported. Its leverage comes from personal and financial records: identity documents, verification selfies, bank details, and transaction history. The group presents itself as exposing organizations for failing to protect user information and for moving customer data across jurisdictions. It combines social engineering against an institutional process with a public extortion campaign, rather than intrusion into the victim's networks. It is an emerging group, and its attribution, origin, and affiliations remain unconfirmed.

Operational Characteristics

ImNotAVillain targets cryptocurrency holders through blockchain analysis and allegedly uses law-enforcement impersonation to obtain personal and financial data. The group uses short public countdowns, demands Monero payments, and offers paid data removal before threatened sale or disclosure. It operates through Tor, clearnet, Telegram, and Session, while also publicly disputing competing claimants and alleged impersonators.

Victimology

Overview

Geographical Distribution

The group has 2 victims across 2 countries, with one victim each in the United Kingdom (UK) and Italy (IT), which is 50% each. Both were first discovered on September 24, 2026. There is no concentration in a single country, and the small sample does not show a wider regional pattern yet.

Sector Targeting

The 2 victims fall into 2 different sectors: Financial Services (the United Kingdom victim) and Government & Defense (the Italy victim), at 50% each. The group has not repeated a sector, so no sector preference can be established from the current listings.

Victim Profile 1: UK Digital Bank (Financial Services)

The first victim is a UK-based digital bank, listed under Financial Services. The group's landing page presents it as a "user database" and states that the data is on sale, with contact details at the bottom of the page. It claims 680 high-value net worth users.

Group's stated reason: The group says the bank received a report about a user database and ignored it, so the group is exposing the bank for failing to keep user information secure and for sending data from a different jurisdiction. A separate "Jurisdiction" section repeats this, saying the bank is based in one place and still moved customer records from another.

Data claimed: The group says it has everything, including KYC documents, addresses, phone numbers, emails, bank accounts, and fiat and crypto transactions. Its "What is stored" list names 11 categories:

It also shows proof of the bank sending data, described as one request out of many. The "Why it matters" section says KYC documents do not change, and that this information is enough to impersonate support, reset access, or reuse a profile on another service.

Pay-to-exclude offer: Individuals can pay to have their information removed before it is sold, and once excluded their records will not be part of any future sale or distribution. The offer applies to the 680 high-value users and is described as limited until the sale is final, after which no removals are possible. Contact is through Telegram or Session, the same channels for staff, press, and users.

ImNotAVillain leak site offering paid exclusion of data, referencing 680 high-value net worth users

Sample entries: A separate Leaks page lists ten numbered sample entries, numbered 002 to 011, each with "account data" and "transactions" links hosted on an external file-sharing service and protected by a shared password that is the group's own name. The page does not say which victim they belong to, but the format appears consistent with proof samples for the customer database claim. One entry points both links to an unrelated general website rather than a data archive, which suggests a placeholder or a broken sample.

Competing claim: The group's warning notice says an impersonator and scammer who used to work with it took a small sample and is now claiming the breach as his own. It says that sample is not the full set, that the bank and other companies sent the data to the group, and that it can prove this through the originals, the volume, the conversations, and the companies involved. It tells others not to deal with the impersonator.

Press message: The group says the public fact is an ignored report and a user database at scale, and asks the press to get the bank on record before treating the rest as given.

Victim Profile 2: Italy (Government & Defense)

The second victim is listed as Italy under Government & Defense, with a dedicated page titled "The Italy Files." The landing page frames it as Italy being exposed for failing to follow proper data protection laws, and claims 85,000+ files totalling 150GB, with top departments, units, and offices affected.

Data claimed: The Italy page claims personal information on more than 130K federal officers across top departments. It says official mailboxes contained unsecured copies of identity documents, including passports, health cards, immigration papers, and other personal information, and that a sample is shown on the page. The two figures measure different things, with 85,000+ files describing the dataset and 130K describing the people the group says are affected.

Specific claims:

Limits of the evidence: No ransom amount or sale demand is attached to this listing, and the pages do not state whether the files have been published or how they were obtained. Everything above is the group's own claim and has not been independently verified.

Technical Analysis

Initial Access: No intrusion into the bank's internal systems has been reported. The group allegedly accessed an address in the Italian certified email system and, for several months, impersonated law enforcement officials to request information about selected clients. The bank confirmed that the requests came through a legitimate government domain and passed its internal checks. It did not confirm the certified email detail. Whether the government mailbox was breached or cloned has not been established.

Execution, Discovery, and Lateral Movement: The bank states its internal infrastructure and databases were not breached, and no lateral movement or malware activity is reported. Discovery took the form of target selection through blockchain analysis, identifying customers with significant crypto activity before requests were made. This means the actor needed to link on-chain holdings to real customer identities before sending any request, which points to prior identity research.

Collection and Exfiltration: Data was released by the bank in response to the fraudulent requests, so collection happened through the bank's own compliance workflow rather than through technical exfiltration. The group claims to hold names, contact details, addresses, account and bank account identifiers, crypto deposits and withdrawals, fiat transactions, KYC documents, and verification selfies. It also provided a one-minute screen recording purportedly showing passports, driver's licenses, identity verification photos, contact and banking details, and transaction history. Its leak page shows a sample it describes as one request out of many, which suggests a repeated, per-customer request pattern.

Extortion and Impact: No encryption is reported. Pressure is applied through a 24-hour countdown, a threat to sell all data, and a "buy exclusion of your data" offer that lets individuals, including the 680 high-value users, pay to be removed before a sale is final. The personal data involved stays useful for impersonation, access resets, and profile reuse long after any deadline passes.

Leak Site and Infrastructure Analysis

ImNotAVillain operates one known Tor-hosted data leak site, currently available with no CAPTCHA gating and no indication of seizure. The onion address is a 56-character v3 service, served by an nginx 1.18.0 web server. The site was recorded as available on September 28. It has Home, Leaks, and a dedicated Italy page, and its structure includes:

Clearnet Domain Analysis

The classification as phishing and fraud is a reputation signal and does not by itself show that the domain hosted credential-harvesting content. It does mean users and analysts visiting it face risk, and it should be blocked and monitored rather than browsed.

Available Leak-Site & Communication Indicators

Competing Claims and Attribution

Responsibility for the breach is contested. An earlier claimant reportedly demanded 10,000 Bitcoin, worth about $780 million at the time, far above the current demand. ImNotAVillain says this came from an impersonator and former associate who received only a small sample of the data. A separate site, revoloot.lol, has been linked to another actor claiming responsibility. Both the clearnet site and revoloot.lol were unavailable when checked, which leaves control of the stolen records unclear. The bank says it has received no direct message from any of them.

Law Enforcement and Regulatory Response

The bank blocked the address used for the fake requests and notified the relevant government agency, law enforcement, financial regulators, and data protection bodies. Italian national authorities are involved because the suspected intrusion concerns a government entity. Local prosecutors have opened an investigation into unauthorized access to a computer system of public interest, while investigators work to establish whether the institutional email account was breached or cloned. Italy's privacy regulator has asked banks to urgently review the security of their access systems and is examining whether other financial institutions were involved. Law enforcement is encouraging European banks to double-check their data protection.

Detection and Hunting Opportunities

MITRE ATT&CK TTPs

Indicators of Compromise (IOCs)

No file hashes or IP-based infrastructure have been independently confirmed. This activity is being actively monitored, and this section will be updated as verified IOCs become available.

Mitigations & Recommendations

1. Initial Access Hardening

2. Identity & Credential Protection

3. Network Security & Lateral Movement Control

4. Endpoint Protection & Threat Monitoring

5. Data Protection & Exfiltration Prevention

6. External Exposure & Leak Monitoring

7. Backup & Recovery Strategy 

8. Incident Response & Extortion Readiness

9. Third-Party Request Verification & Customer Data Governance

Conclusion

ImNotAVillain is an emerging data-only extortion group whose observed activity focuses on obtaining and exploiting sensitive personal and financial information rather than encrypting victim systems. The group has two identified victims across the United Kingdom and Italy, with reported exposure involving KYC documents, identity records, banking information, cryptocurrency transactions, and other personal data. Its activity reportedly includes social engineering and alleged impersonation of law-enforcement entities, while several aspects of the claimed access and data acquisition remain unverified. Attribution is further complicated by competing actors and claims, including the separate revoloot[.]lol site. Despite the currently limited victim count, the reported targeting of high-value cryptocurrency users and the use of stolen identity and financial records for extortion present a continued risk of impersonation, account abuse, fraud, and further exposure. Organizations should strengthen independent verification of sensitive-data requests, tighten controls over customer-data release, and maintain monitoring for emerging leak-site activity and related infrastructure.