PEAR (Pure Extraction and Ransom) is a data-extortion threat group that emerged in June 2025, operating with an exfiltration-first model rather than deploying encryption-based ransomware. The group rapidly scaled its operations, focusing on stealing and publicly exposing sensitive data to monetize its efforts through direct extortion, double extortion, and staged data leaks. PEAR distinguishes itself by claiming to be a private, disciplined team with no affiliations to other threat actors, often positioning itself as a security-focused organization that aims to expose vulnerabilities in victims' systems. The group is also known to manipulate victims during negotiations by posing as legitimate penetration testers.

This profile is generated from the same canonical actor-card record used by the Threat Actor Cards directory, so aliases, targeting fields, activity notes, and source links stay aligned as the database is enriched.