http://ransomlookumjrc6erzqn467lkcu2t5h4enjzfigvsxrrktxicysi2yd.onion/group/agl0bgvycg
Similarly, there is no known data about its extortion type (single or double), preferred targets, intrusion methods, encryption techniques, file extensions, or ransom note behavior. The only identifiable detail is the blog URL hitleransomware.cf, which appears to serve as its public-facing leak or command-and-control site.