bc1qds0yly3fn608gtm332gag029munvlute2wxktnRansom payment address, per an FBI alert. Repeated by a security vendor.
- First public mention
- 23 Aug 2021
- Sources captured
- 3
- Linked indicators
- 23
- Report generated
- 25 Sep 2026
FBI Flash CU-000149-MW
Federal Bureau of Investigation, published on IC3
Listed under “Ransom Note Details and TOR Website” as the address victims are told to pay, right below the group’s onion site.
ic3.gov/CSA/2021/210823.pdfFBI Flash, hosted by the AHA
American Hospital Association
Same alert and same address, but an earlier version: it still tells readers to contact FBI CyWatch by email and phone.
aha.org/…/fbi-flash-report-…-onepercent-group-ransomware-8-23-21.pdfOnePercent Group Ransomware Campaign
Infoblox Threat Intel blog
Summarizes the FBI alert two days later. The address appears in its indicators table, labeled as a BTC address.
infoblox.com/blog/…/onepercent-group-ransomware-campaign| Type | Values (defanged) | Seen in | Note |
|---|---|---|---|
| Tor site1 | 5mvifa3xq5m7sou3xzaajfz7h6eserp5fnkwotohns5pgbb5oxty3zad[.]onion |
FBIInfoblox | Payment and negotiation portal. Valid v3 onion address. |
| Email2 | 1percentransomware@protonmail[.]com1percentransom@protonmail[.]com |
FBIInfoblox | Extortion contacts. Infoblox lists only the first one. |
| IPv47 | 157.245.239[.]18731.187.64[.]199206.189.227[.]145167.71.224[.]3980.82.67[.]221138.197.179[.]153134.209.203[.]30 |
FBIInfoblox | Same seven in both sources after normalization. |
| Domains7 | nix1[.]xyzgolddisco[.]topdelokijio[.]pwjune85[.]cyouintensemisha[.]cyoubiggarderoub[.]cyoud30qpb9e10re4o.cloudfront[.]net |
FBIInfoblox | Infrastructure associated with the campaign. |
| File hashes4 | SHA-256 ECA9FAC6…842E7FESHA-256 E70ED531…CD580116SHA-1 C00CFB45…C443DF97SHA-1 A1D985E1…B0D733C9 |
FBIInfoblox | Copies of rclone, a legitimate tool used here to exfiltrate data. SHA-1 values only in the FBI alert. |
| File paths2 | %TEMP%\Temp1_request.zip\[FILENAME].doc%PROGRAMDATA%\vexby.txt |
FBI | Observed on infected machines. |
Tools reportedIcedID, Cobalt Strike, PowerShell, rclone, Mimikatz, SharpKatz, BetterSafetyKatz, SharpSploit and AWS S3.
BehaviorRansom notes named with an 8-character random string plus -readme.txt, matching the extension of the encrypted files. Threat to sell stolen data to the Sodinokibi (REvil) group.
- Attacks begin
The FBI says the group has been targeting US companies since this month.
- FBI publishes Flash CU-000149-MW
First public mention of the address, as the group’s ransom wallet.
- Copy published by the AHA
The American Hospital Association hosts the alert for its members, with the CyWatch contact block.
- Infoblox publishes its advisory
Repeats the indicators, including the address, two days after the FBI.
- Infoblox page modified
Page metadata shows an update three years after publication.
- Captured by ChainWitness
All three sources captured. A difference between the two copies of the FBI alert is detected.
Two versions of the same FBI alert
The copy hosted by the AHA tells readers to contact FBI CyWatch by email and phone. The file currently on IC3 replaces that with a pointer to FBI field offices. Only dated captures prove that both versions existed.
The secondary source is incomplete
Infoblox lists one of the two ProtonMail addresses and leaves SharpSploit out of its tool list. Its indicators come from the FBI alert, so it confirms the publication, not the attribution.
A defanging typo, matched anyway
Infoblox writes one IP as 31[.]187[.]64.[.]199. ChainWitness normalizes it to 31.187.64.199 and matches it to the FBI list instead of creating a false new indicator.
Address and onion checked offline
- Encoding
- bech32, checksum valid
- Script
- witness v0, 20-byte program (P2WPKH)
- Hash160
- 6c1e4f92299e9e742f718a91d43d45df26cff179
- Onion
- v3, checksum valid
Preview note: the captures above were reconstructed from the text of each source, retrieved on 25 Sep 2026. In the product, every capture carries the full-page screenshot, a WARC archive, SHA-256 hashes and a trusted timestamp. The wallet overview loads live data from public block explorers; in the product it comes from our own node.