PEAR Ransomware Recovery: Pure Extraction And Ransom, Data Theft Without Encryption

PEAR, short for Pure Extraction And Ransom, is an extortion group first detected in June 2025 by the cyber insurer At-Bay. It published its first 18 victims on one day, 5 August 2025, and by 3 November 2026 had listed 132 (ransomware.live). 118 of them are in the United States; professional services such as law and accounting firms are hit most, then healthcare, financial services and manufacturing.

Unlike most groups on this blog, PEAR is not known to encrypt files. Security vendors such as WatchGuard classify it as a data-theft and extortion operation: the threat is publication of stolen data, not locked systems.

At-Bay's research describes PEAR using legitimate tools rather than custom malware: remote management software such as AteraAgent and Splashtop for access, and file-transfer tools such as WinSCP and Rclone, often renamed, to move the data out. Because IT departments use the same tools, they are hard to block outright.

After the theft the group contacts employees directly by text message and WhatsApp, claiming to hold terabytes of data, to increase pressure on management. At-Bay put the average initial demand at around 550,000 US dollars; Cyber Daily reported one victim being asked for four bitcoin to have its data deleted and its name removed from the leak site.

If your files are readable, the priority is finding out what was taken and how the attackers got in: check remote management tools you did not install, renamed WinSCP or Rclone executables, and large outbound transfers. Change every password and remote-access key, and keep the logs; they are the evidence of what left the network.

If you also find encrypted files, a second group is involved or PEAR has changed its method. Do not delete the encrypted files. We recover databases, virtual machines and backups from ransomware-damaged files, and help you establish what was on the systems the attackers reached. Contact us for a free assessment. No data, no charge.