PEAR Threat Profile: Redefining Ransomware Through Data Exposure

Executive Summary

PEAR (Pure Extraction and Ransom) is an emerging data-extortion threat group that operates using an exfiltration-first model, focusing on stealing and publicly exposing sensitive data rather than deploying encryption-based ransomware. Active since June 2025, the group has rapidly scaled operations to over 92 victims across 9 countries, with a strong concentration in the United States and a diverse cross-sector footprint led by Business Services and Healthcare. Its operations rely on externally obtained access, large-scale data exfiltration, and direct victim engagement through manual communication channels, supported by a TOR-based leak ecosystem and distributed file servers for data publication. The group employs a multi-layer extortion strategy—including direct pressure, double extortion, and staged data leaks—indicating a structured yet evolving operational model centered on data monetization and exposure rather than system disruption.

Threat Profile

Group Overview

PEAR (Pure Extraction and Ransom) is a data-extortion-focused ransomware group that operates using:

The group claims to be a private, disciplined team with no affiliation to other threat actors. It positions itself as a security-focused organization, stating that its goal is to expose vulnerabilities and encourage better data protection practices.

This narrative is reinforced in its public messaging, where it frames attacks as a consequence of poor security hygiene rather than malicious intent.

Operational Characteristics

PEAR follows a non-traditional ransomware model centered on data theft and exposure rather than encryption.

Victimology

Overview

Lower-frequency sectors such as Consumer Services (5.4%), Construction (3.3%), Education (3.3%), Hospitality & Tourism (3.3%), Transportation & Logistics (2.2%), and Agriculture & Food Production (1.1%) demonstrate broader but limited reach. This distribution highlights a skewed sector spread, where a few dominant industries account for the majority of victims while remaining sectors show fragmented and minimal activity.

Technical Analysis

Initial Access and Foothold:

• Available intelligence does not identify a consistent or repeatable initial access vector across observed PEAR incidents. The group’s activity suggests the use of externally obtained access, potentially through compromised credentials or exposed services, rather than reliance on a single intrusion method.

• There is no confirmed evidence of vulnerability exploitation or advanced intrusion techniques. Observations indicate that access is established through commonly available entry points, with no indication of specialized or custom-developed access mechanisms.

Privilege Escalation, Defense Evasion, and Persistence:

• There is limited visibility into privilege escalation, persistence, and defense evasion techniques used by PEAR. No consistent tools, exploits, or repeatable mechanisms have been identified across observed incidents.

• Available data suggests that operations are conducted using existing access privileges and standard system capabilities, without introducing identifiable malware or complex persistence structures. These stages remain largely unobserved and lack sufficient technical detail for further classification.

Lateral Movement, Exfiltration, and Encryption:

Lateral Movement

• Lateral movement techniques are not explicitly documented. Internal access expansion is likely performed using available credentials and standard administrative access methods, though no consistent pattern or tooling has been confirmed.

Attack Sequence

Data Exfiltration

• Data exfiltration is the central operational activity. The group focuses on extracting large volumes of data, which are later referenced on its leak platform with associated size indicators (GB/TB scale).

Encryption

• There is no observed use of encryption. The group explicitly states that it does not encrypt victim systems and relies entirely on data theft and exposure for extortion.

Command and Control (C2):

• Available intelligence indicates the use of attacker-controlled infrastructure for handling stolen data and supporting operational activity. This implies the presence of command-and-control communication, likely conducted through standard web-based channels.

• Specific technical characteristics — including protocols, beaconing behavior, or infrastructure patterns — remain unconfirmed, with no identifiable or unique C2 framework observed.

Communication and Platform Analysis

• PEAR uses a direct and manual communication model, primarily through email and TOX messaging. Responses are typically provided within a short timeframe, indicating active human involvement rather than automated systems.

• Victims are required to initiate and maintain communication to prevent data exposure, with interactions managed continuously throughout the engagement. This reflects a controlled, manually operated workflow, without reliance on dedicated negotiation portals or automated platforms.

Negotiation Behavior

• PEAR follows a structured negotiation process driven by strict timelines and staged escalation. Deadlines are enforced for both agreement and payment, with clearly defined consequences, including public data exposure and further escalation actions.

• The group validates its claims by sharing selected files and providing access to stolen data samples, reinforcing credibility while maintaining pressure. This is combined with persistent follow-ups, urgency-driven messaging, and limited pricing flexibility through controlled discounts.

• In addition, PEAR applies multi-layer pressure tactics, including threats of data leaks, reputational impact, regulatory exposure, and outreach to third parties. The negotiation remains fully manual, with the group maintaining control of the process and treating delays as non-cooperation.

Leak Site and Infrastructure Analysis:

• PEAR operates a TOR-based leak ecosystem supported by multiple file-hosting servers used to store and distribute stolen data. The leak site presents structured victim entries, including organization identifiers and associated data volumes.

• The platform distinguishes between different exposure stages, such as publicly listed entries and datasets made available for download. Multiple file server links are used to host stolen data, enabling access through separate infrastructure endpoints.

The ecosystem includes:

Key observations include:

Overall, PEAR’s infrastructure reflects a data exposure model centered on direct publication and distribution, where stolen datasets are made available through its own controlled environment and leveraged for extortion.

MITRE ATT&CK TTPs

Mitigations & Recommendations

1. Initial Access Hardening

2. Identity & Credential Protection

3. Network Security & Lateral Movement Control

4. Endpoint Protection & Threat Monitoring

5. Data Protection & Exfiltration Prevention

6. External Exposure & Leak Monitoring

7. Backup & Recovery Strategy

8. Incident Response & Extortion Readiness