Mimori
Mimori is a data-extortion / ransomware group first observed on 2026-10-20, when it launched a leak site and listed its first two claimed victims: OpenText (Canada, technology) and AVEVA (UK, industrial software), claiming 177,234 files from AVEVA. A third claimed victim, St. James's Place (UK, financial services), was reported on 2026-10-21. The leak site, mimori.group, is a clearnet domain fronted by Cloudflare that publishes victim pages under /organizations/ and threatens to publish stolen data unless victims make contact. None of the claims has been independently verified. AVEVA and OpenText have each disclosed a separate security incident (unauthorized access to AVEVA's corporate SharePoint, and to an OpenText employee account through social engineering), but neither has attributed it to Mimori. No ransomware sample, encryptor or affiliate program has been publicly linked to the group, and its operators and any links to earlier groups are unknown.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
- AvevaOct 20, 2026
- OpenTextOct 20, 2026
A leak-site post is the group's claim, not confirmed by the victim.
Recent activity
No posts or advisories have named this actor recently.
References
- https://www.ransomware.live/group/Mimori
- https://www.ransomlook.io/group/Mimori
- https://www.breachsense.com/ransomware-groups/mimori/
- https://cti.fyi/groups/Mimori.html
- https://www.redtigersecurity.com/advisory/aveva-corporate-sharepoint-unauthorized-access
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.