obscura ransomware group lists New Obscura 2.0! on its leak site

• Ransomware group: obscura
• Country: United States
• Sector: Government & Defense
• Announcement date: December 12, 2025

The obscura group claims a breach of the FBI

The threat actor known as obscura has listed the domain fbi.gov on its dedicated leak platform. This announcement, made on December 12, 2025, marks a significant development in the group's recent activities. While the listing has been posted, the specific details regarding the nature of the alleged breach remain limited to the group's claims on their site.

The group has introduced a new iteration of their malware, referred to as Obscura 2.0. According to the threat actor, this new version features enhanced encryption mechanisms designed to operate at a faster speed than previous versions. Furthermore, the group has indicated that they are operating under a software-as-a-service model, stating that their ransomware software is available for rent. They have expressed a clear intention to continue their operations against various entities in the future.

Details regarding the alleged data leak

At this stage, there is no information regarding the nature of the allegedly leaked data. The threat actor has not provided any specifics concerning the types of files or the volume of information involved in this incident. Furthermore, no screenshots of the leak have been provided to support the claims made on the leak site.

• No data types have been named in the listing.

Ransomware leak sites are frequently used by threat actors to exert pressure on victims through a tactic known as double extortion. In such scenarios, attackers not only encrypt an organization's data to disrupt operations but also threaten to publish sensitive information publicly if a ransom is not paid. This method aims to maximize the leverage held by the cybercriminal group.

The Federal Bureau of Investigation

The target of this alleged attack is the Federal Bureau of Investigation (FBI). The FBI serves as the domestic intelligence and security service of the United States. Operating under the Department of Justice, the agency is responsible for enforcing federal laws and protecting national security.

Security implications and sector risks

This incident may indicate that the security of the affected entity's network could have been compromised. Given the organization's critical role in the government and defense sector, any potential data exposure might pose significant risks to national security. The publication of alleged data could lead to secondary risks, such as targeted phishing attacks against personnel or the disruption of operational processes.

The fact that the ransomware group is utilizing a software-as-a-service model suggests that similar attacks could increase in frequency across various sectors. When highly specialized ransomware tools are available for rent, it lowers the barrier to entry for various malicious actors, potentially leading to a rise in the volume of cyberattacks.

For organizations operating within the government and defense sectors, maintaining robust defensive postures is essential. Common defensive steps include implementing strict network segmentation to prevent lateral movement, maintaining rigorous patch management protocols, and conducting regular security awareness training to mitigate the risk of phishing. Additionally, continuous monitoring of network traffic and the implementation of multi-factor authentication are standard practices to defend against evolving ransomware threats.

Summary of the threat actor profile

Information regarding the obscura group remains limited in the public domain. Their ability to develop and market new versions of their software suggests a level of technical sophistication and a structured business model aimed at sustained operations against diverse targets.