{ "generated_at": "2026-11-07T11:06:23.757Z", "as_of": "2026-11-07", "window_days": 90, "sectors": { "finance": "Finance", "insurance": "Insurance", "healthcare": "Healthcare", "manufacturing": "Manufacturing", "technology": "Technology", "services": "Professional services", "consumer": "Retail & consumer", "education": "Education", "government": "Government", "energy": "Energy & utilities", "transportation": "Transportation", "agriculture": "Agriculture & food", "construction": "Construction", "unknown": "Unclassified" }, "packages": [ { "slug": "thegentlemen", "group": "thegentlemen", "name": "The Gentlemen", "note": null, "attck": [ { "id": "G1058", "name": "The Gentlemen", "kind": "intrusion-set", "url": "https://attack.mitre.org/groups/G1058" }, { "id": "S9051", "name": "The Gentlemen Ransomware", "kind": "malware", "url": "https://attack.mitre.org/software/S9051" } ], "activity": { "postings": 363, "first": "2026-08-10", "last": "2026-11-05", "countries": { "GB": 24, "BR": 19, "ES": 8, "DE": 14, "NZ": 1, "CA": 14, "CH": 6, "FR": 8, "US": 91, "VE": 1, "UA": 1, "??": 12, "IT": 13, "SE": 6, "DK": 3, "NO": 3, "TR": 3, "CO": 4, "AU": 10, "EC": 3, "MX": 10, "ID": 2, "CY": 1, "IN": 11, "ZA": 7, "BO": 1, "VN": 3, "SL": 1, "AR": 5, "TH": 7, "AD": 1, "JP": 5, "IE": 1, "KR": 3, "PK": 1, "CZ": 2, "TW": 8, "KZ": 1, "IL": 3, "BZ": 3, "OM": 1, "SG": 3, "SN": 1, "GR": 3, "AT": 3, "BE": 1, "PR": 2, "AG": 1, "PT": 3, "FI": 2, "AO": 1, "PE": 2, "BG": 2, "HR": 1, "EG": 1, "CL": 5, "GE": 1, "PL": 2, "MY": 2, "SA": 1, "AE": 2, "WS": 1, "MA": 1, "HK": 1 }, "sectors": { "healthcare": 46, "technology": 46, "manufacturing": 59, "services": 29, "consumer": 38, "government": 11, "unknown": 73, "transportation": 9, "education": 20, "energy": 12, "finance": 11, "insurance": 9, "agriculture": 9 }, "recent": [ { "date": "2026-11-05", "name": "KABS Pharmaceutical Services", "country": "GB", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/S0FCUyBQaGFybWFjZXV0aWNhbCBTZXJ2aWNlc0B0aGVnZW50bGVtZW4" }, { "date": "2026-11-05", "name": "Solutis Tecnologias", "country": "BR", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/U29sdXRpcyBUZWNub2xvZ2lhc0B0aGVnZW50bGVtZW4" }, { "date": "2026-11-05", "name": "Grupo Lorrio", "country": "ES", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/R3J1cG8gTG9ycmlvQHRoZWdlbnRsZW1lbg" }, { "date": "2026-11-05", "name": "McEwan Fraser Legal", "country": "GB", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/TWNFd2FuIEZyYXNlciBMZWdhbEB0aGVnZW50bGVtZW4" }, { "date": "2026-11-05", "name": "Hausarztpraxis Ries", "country": "DE", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/SGF1c2FyenRwcmF4aXMgUmllc0B0aGVnZW50bGVtZW4" }, { "date": "2026-11-05", "name": "Lighting Direct", "country": "NZ", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/TGlnaHRpbmcgRGlyZWN0QHRoZWdlbnRsZW1lbg" }, { "date": "2026-11-05", "name": "RedBlink Technologies", "country": "CA", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/UmVkQmxpbmsgVGVjaG5vbG9naWVzQHRoZWdlbnRsZW1lbg" }, { "date": "2026-11-05", "name": "Coemi Imóveis", "country": "BR", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/Q29lbWkgSW3Ds3ZlaXNAdGhlZ2VudGxlbWVu" }, { "date": "2026-11-05", "name": "Labatec", "country": "CH", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/TGFiYXRlY0B0aGVnZW50bGVtZW4" }, { "date": "2026-11-05", "name": "Antwerp House Dental", "country": "GB", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/QW50d2VycCBIb3VzZSBEZW50YWxAdGhlZ2VudGxlbWVu" }, { "date": "2026-11-05", "name": "Logsytech Group", "country": "FR", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/TG9nc3l0ZWNoIEdyb3VwQHRoZWdlbnRsZW1lbg" }, { "date": "2026-11-05", "name": "Secretaria de Estado de Saúde", "country": "BR", "sectors": [ "government" ], "url": "https://www.ransomware.live/id/U2VjcmV0YXJpYSBkZSBFc3RhZG8gZGUgU2HDumRlQHRoZWdlbnRsZW1lbg" } ] }, "convergences": [ { "name": "CAZ Investments LP", "flagged": "2026-09-30", "classes": [ "leak", "notice" ], "curated": false, "hand_picked": false }, { "name": "The Kenaitze Indian Tribe", "flagged": "2026-09-26", "classes": [ "leak", "notice" ], "curated": false, "hand_picked": false }, { "name": "Veradigm Inc.", "flagged": "2026-09-09", "classes": [ "filing", "leak", "litigation" ], "curated": false, "hand_picked": false }, { "name": "Nutex Health Inc.", "flagged": "2026-09-02", "classes": [ "filing", "leak", "litigation" ], "curated": false, "hand_picked": false }, { "name": "Advantage Home Health Care", "flagged": "2026-08-26", "classes": [ "leak", "notice" ], "curated": false, "hand_picked": false }, { "name": "Michigan Surgical Center, LLC", "flagged": "2026-06-10", "classes": [ "leak", "notice" ], "curated": false, "hand_picked": false } ], "reports": [ { "url": "https://unit42.paloaltonetworks.com/europes-refrigeration-systems-attacks/", "publisher": "Unit 42", "published": "2026-11-06", "title": "Turning Up the Heat: Inside the Attacks on Europe’s Refrigeration System", "origin": "feed", "primary": false }, { "url": "https://securelist.com/virtualization-security-esxi-and-proxmox-ransomware-cases/121819/", "publisher": "Kaspersky Securelist", "published": "2026-11-06", "title": "Virtualization security: attack layers and misconfiguration impact", "origin": "feed", "primary": false }, { "url": "https://reliaquest.com/blog/psts-industry-defense-gap-is-architectural-what-to-do-about-it/", "publisher": "ReliaQuest", "published": "2026-11-06", "title": "The PSTS Industry’s Defense Gap Is Architectural. Here’s What to Do About It.", "origin": "feed", "primary": false }, { "url": "https://reliaquest.com/blog/finance-and-insurance-faces-a-122-percent-ransomware-spike-how-to-defend-against-it/", "publisher": "ReliaQuest", "published": "2026-11-05", "title": "Finance and Insurance Faces a 122% Ransomware Spike. Here’s How to Defend Against It.", "origin": "feed", "primary": false }, { "url": "https://reliaquest.com/blog/health-care-faces-a-70-percent-ransomware-surge-how-to-defend-against-it/", "publisher": "ReliaQuest", "published": "2026-11-05", "title": "Health Care Faces a 70% Ransomware Surge. Here’s How to Defend Against It.", "origin": "feed", "primary": false }, { "url": "https://reliaquest.com/blog/manufacturing-attackers-using-more-paths-in-security-operations-need-to-move-first/", "publisher": "ReliaQuest", "published": "2026-11-05", "title": "Manufacturing Attackers Are Using More Paths In. Security Operations Need to Move First.", "origin": "feed", "primary": false }, { "url": "https://www.intel471.com/blog/why-is-italy-a-top-target-for-cybercrime", "publisher": "Intel 471", "published": "2026-11-04", "title": "Why is Italy a top target for cybercrime?", "origin": "feed", "primary": false }, { "url": "https://reliaquest.com/blog/threat-spotlight-ransomware-and-cyber-extortion-in-q3-2026/", "publisher": "ReliaQuest", "published": "2026-11-03", "title": "Ransomware and Cyber Extortion in Q3 2026", "origin": "feed", "primary": false }, { "url": "https://blog.talosintelligence.com/ir-trends-q3-2026/", "publisher": "Cisco Talos", "published": "2026-10-29", "title": "IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases", "origin": "feed", "primary": false }, { "url": "https://unit42.paloaltonetworks.com/unwrapping-retail-cyber-threats/", "publisher": "Unit 42", "published": "2026-10-28", "title": "Unwrapping Retail Peak Season Cyber Threats", "origin": "feed", "primary": false }, { "url": "https://asec.ahnlab.com/en/96180/", "publisher": "AhnLab ASEC", "published": "2026-10-27", "title": "Ransom & Dark Web Issues Week 5, October 2026", "origin": "feed", "primary": false }, { "url": "https://research.checkpoint.com/2026/26th-october-threat-intelligence-report/", "publisher": "Check Point Research", "published": "2026-10-26", "title": "26th October – Threat Intelligence Report", "origin": "feed", "primary": false }, { "url": "https://blog.talosintelligence.com/i-had-plans-for-that-second/", "publisher": "Cisco Talos", "published": "2026-10-22", "title": "I had plans for that second", "origin": "feed", "primary": false }, { "url": "https://www.group-ib.com/blog/stray-cat-network-edge/", "publisher": "Group-IB", "published": "2026-10-21", "title": "Stray Cat, Open Doors: How k0t Wanders Through the Network Edge", "origin": "feed", "primary": false }, { "url": "https://asec.ahnlab.com/en/95949/", "publisher": "AhnLab ASEC", "published": "2026-10-11", "title": "September 2026 Threat Trend Report on Ransomware", "origin": "feed", "primary": false }, { "url": "https://www.intel471.com/blog/agentic-hunting-needs-guardrails-start-with-your-methodology", "publisher": "Intel 471", "published": "2026-10-07", "title": "Agentic Hunting Needs Guardrails. Start With Your Methodology.", "origin": "feed", "primary": false }, { "url": "https://www.recordedfuture.com/blog/ai-social-engineering", "publisher": "Recorded Future Insikt", "published": "2026-09-29", "title": "Social Engineering in the Age of Synthetic Media", "origin": "feed", "primary": false }, { "url": "https://research.checkpoint.com/2026/ai-threat-landscape-digest-july-august-2026/", "publisher": "Check Point Research", "published": "2026-09-17", "title": "AI Threat Landscape Digest: July–August 2026", "origin": "feed", "primary": false }, { "url": "https://www.intel471.com/blog/follow-the-money-the-financial-sectors-threat-landscape-in-2026", "publisher": "Intel 471", "published": "2026-09-10", "title": "Follow the Money: The Financial Sector's Threat Landscape in 2026", "origin": "feed", "primary": false }, { "url": "https://www.group-ib.com/blog/ransomware-2026-incident-response-data/", "publisher": "Group-IB", "published": "2026-09-08", "title": "Ransomware in 2026: What the Data Demands From You", "origin": "feed", "primary": false }, { "url": "https://www.recordedfuture.com/research/h1-2026-malware-vulnerability-trends", "publisher": "Recorded Future Insikt", "published": "2026-09-03", "title": "H1 2026 Malware Vulnerability Trends", "origin": "feed", "primary": true }, { "url": "https://www.intel471.com/blog/threat-hunting-case-study-the-gentlemen", "publisher": "Intel 471", "published": "2026-08-11", "title": "Threat Hunting Case Study: The Gentlemen", "origin": "feed", "primary": true } ], "techniques": [ { "id": "T1005", "name": "Data from Local System", "tactics": [ "collection" ], "sources": [ "report" ], "structural": false, "own": [], "community": 14, "related": 0 }, { "id": "T1018", "name": "Remote System Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 17, "related": 0 }, { "id": "T1021.001", "name": "Remote Desktop Protocol", "tactics": [ "lateral-movement" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 16, "related": 10 }, { "id": "T1021.002", "name": "SMB/Windows Admin Shares", "tactics": [ "lateral-movement" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 38, "related": 10 }, { "id": "T1027", "name": "Obfuscated Files or Information", "tactics": [ "stealth" ], "sources": [ "attck", "report" ], "structural": false, "own": [], "community": 94, "related": 32 }, { "id": "T1027.002", "name": "Software Packing", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 1, "related": 94 }, { "id": "T1027.010", "name": "Command Obfuscation", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 10, "related": 94 }, { "id": "T1036", "name": "Masquerading", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [ "t1059-peoplesoft-psemhub-payload-execution" ], "community": 40, "related": 59 }, { "id": "T1036.001", "name": "Invalid Code Signature", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 40 }, { "id": "T1036.004", "name": "Masquerade Task or Service", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 3, "related": 40 }, { "id": "T1036.005", "name": "Match Legitimate Resource Name or Location", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [ "t1557-recaptcha-skinned-turnstile-gate" ], "community": 21, "related": 40 }, { "id": "T1037.003", "name": "Network Logon Script", "tactics": [ "persistence", "privilege-escalation" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1037.004", "name": "RC Scripts", "tactics": [ "persistence", "privilege-escalation" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "tactics": [ "exfiltration" ], "sources": [ "report" ], "structural": false, "own": [], "community": 5, "related": 0 }, { "id": "T1047", "name": "Windows Management Instrumentation", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 52, "related": 0 }, { "id": "T1053.003", "name": "Cron", "tactics": [ "execution", "persistence", "privilege-escalation" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 6, "related": 12 }, { "id": "T1053.005", "name": "Scheduled Task", "tactics": [ "execution", "persistence", "privilege-escalation" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 51, "related": 12 }, { "id": "T1059", "name": "Command and Scripting Interpreter", "tactics": [ "execution" ], "sources": [ "report" ], "structural": false, "own": [ "t1059-peoplesoft-psemhub-payload-execution" ], "community": 94, "related": 376 }, { "id": "T1059.001", "name": "PowerShell", "tactics": [ "execution" ], "sources": [ "attck", "report" ], "structural": false, "own": [], "community": 220, "related": 94 }, { "id": "T1059.003", "name": "Windows Command Shell", "tactics": [ "execution" ], "sources": [ "attck", "report" ], "structural": false, "own": [], "community": 46, "related": 94 }, { "id": "T1059.004", "name": "Unix Shell", "tactics": [ "execution" ], "sources": [ "report" ], "structural": false, "own": [], "community": 18, "related": 94 }, { "id": "T1059.012", "name": "Hypervisor CLI", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 9, "related": 94 }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "tactics": [ "privilege-escalation" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 30, "related": 0 }, { "id": "T1070.003", "name": "Clear Command History", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 9, "related": 20 }, { "id": "T1070.004", "name": "File Deletion", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 15, "related": 20 }, { "id": "T1070.007", "name": "Clear Network Connection History and Configurations", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 20 }, { "id": "T1071.001", "name": "Web Protocols", "tactics": [ "command-and-control" ], "sources": [ "report" ], "structural": false, "own": [], "community": 42, "related": 7 }, { "id": "T1074.001", "name": "Local Data Staging", "tactics": [ "collection" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 4, "related": 2 }, { "id": "T1078", "name": "Valid Accounts", "tactics": [ "stealth", "persistence", "privilege-escalation", "initial-access" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 55, "related": 54 }, { "id": "T1082", "name": "System Information Discovery", "tactics": [ "discovery" ], "sources": [ "report" ], "structural": false, "own": [], "community": 33, "related": 0 }, { "id": "T1083", "name": "File and Directory Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 24, "related": 0 }, { "id": "T1090", "name": "Proxy", "tactics": [ "command-and-control" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 22, "related": 12 }, { "id": "T1105", "name": "Ingress Tool Transfer", "tactics": [ "command-and-control" ], "sources": [ "report" ], "structural": false, "own": [ "t1204-004-clickfix-run-dialog-execution" ], "community": 87, "related": 0 }, { "id": "T1106", "name": "Native API", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 14, "related": 0 }, { "id": "T1112", "name": "Modify Registry", "tactics": [ "defense-impairment", "persistence" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 94, "related": 0 }, { "id": "T1135", "name": "Network Share Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 7, "related": 0 }, { "id": "T1190", "name": "Exploit Public-Facing Application", "tactics": [ "initial-access" ], "sources": [ "attck", "report" ], "structural": false, "own": [ "t1190-peoplesoft-psemhub-encoded-path-exploitation" ], "community": 147, "related": 0 }, { "id": "T1204", "name": "User Execution", "tactics": [ "execution" ], "sources": [ "report" ], "structural": false, "own": [], "community": 10, "related": 49 }, { "id": "T1219.002", "name": "Remote Desktop Software", "tactics": [ "command-and-control" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 46, "related": 6 }, { "id": "T1222.001", "name": "Windows Permissions", "tactics": [ "defense-impairment" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 5, "related": 2 }, { "id": "T1482", "name": "Domain Trust Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 17, "related": 0 }, { "id": "T1484.001", "name": "Group Policy Modification", "tactics": [ "defense-impairment", "privilege-escalation" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 6, "related": 1 }, { "id": "T1486", "name": "Data Encrypted for Impact", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 16, "related": 0 }, { "id": "T1489", "name": "Service Stop", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 20, "related": 0 }, { "id": "T1490", "name": "Inhibit System Recovery", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 27, "related": 0 }, { "id": "T1491.001", "name": "Internal Defacement", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 4, "related": 0 }, { "id": "T1505.003", "name": "Web Shell", "tactics": [ "persistence" ], "sources": [ "report" ], "structural": false, "own": [ "t1505-003-peoplesoft-psemhub-webshell-drop" ], "community": 34, "related": 1 }, { "id": "T1529", "name": "System Shutdown/Reboot", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 8, "related": 0 }, { "id": "T1543.003", "name": "Windows Service", "tactics": [ "persistence", "privilege-escalation" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 47, "related": 9 }, { "id": "T1547.001", "name": "Registry Run Keys / Startup Folder", "tactics": [ "persistence", "privilege-escalation" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 39, "related": 7 }, { "id": "T1561.001", "name": "Disk Content Wipe", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 1, "related": 0 }, { "id": "T1564.001", "name": "Hidden Files and Directories", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 9, "related": 10 }, { "id": "T1564.012", "name": "File/Path Exclusions", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 10 }, { "id": "T1569.002", "name": "Service Execution", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 43, "related": 4 }, { "id": "T1583.001", "name": "Domains", "tactics": [ "resource-development" ], "sources": [ "attck" ], "structural": true, "own": [ "t1583-001-claims-registration-conjunction" ], "community": 0, "related": 0 }, { "id": "T1585", "name": "Establish Accounts", "tactics": [ "resource-development" ], "sources": [ "attck" ], "structural": true, "own": [], "community": 0, "related": 0 }, { "id": "T1585.001", "name": "Social Media Accounts", "tactics": [ "resource-development" ], "sources": [ "attck" ], "structural": true, "own": [], "community": 0, "related": 0 }, { "id": "T1588.002", "name": "Tool", "tactics": [ "resource-development" ], "sources": [ "attck" ], "structural": true, "own": [], "community": 9, "related": 2 }, { "id": "T1657", "name": "Financial Theft", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1675", "name": "ESXi Administration Command", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1678", "name": "Delay Execution", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1679", "name": "Selective Exclusion", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1680", "name": "Local Storage Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1683.001", "name": "Written Content", "tactics": [ "resource-development" ], "sources": [ "attck" ], "structural": true, "own": [], "community": 0, "related": 0 }, { "id": "T1683.002", "name": "Audio-Visual Content", "tactics": [ "resource-development" ], "sources": [ "attck" ], "structural": true, "own": [], "community": 0, "related": 0 }, { "id": "T1685", "name": "Disable or Modify Tools", "tactics": [ "defense-impairment" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 162, "related": 44 }, { "id": "T1685.005", "name": "Clear Windows Event Logs", "tactics": [ "defense-impairment" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 8, "related": 162 }, { "id": "T1686.003", "name": "Windows Host Firewall", "tactics": [ "defense-impairment" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 20, "related": 7 }, { "id": "T1689", "name": "Downgrade Attack", "tactics": [ "defense-impairment" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 1, "related": 0 }, { "id": "T1690", "name": "Prevent Command History Logging", "tactics": [ "defense-impairment" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 1, "related": 0 } ], "cves": [ { "id": "CVE-2021-26855", "in_kev": true, "ransomware_use": true, "epss": 0.99996, "vendor": "Microsoft", "product": "Exchange Server" }, { "id": "CVE-2023-27532", "in_kev": true, "ransomware_use": true, "epss": 0.80599, "vendor": "Veeam", "product": "Backup & Replication" }, { "id": "CVE-2024-4345", "in_kev": false, "ransomware_use": false, "epss": 0.01456, "vendor": null, "product": null }, { "id": "CVE-2025-68947", "in_kev": false, "ransomware_use": false, "epss": 0.00136, "vendor": null, "product": null }, { "id": "CVE-2026-20131", "in_kev": true, "ransomware_use": true, "epss": 0.44431, "vendor": "Cisco", "product": "Secure Firewall Management Center (FMC)" } ], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 70, "defendable": 64, "covered": 54, "uncovered": [ "T1036.001", "T1037.003", "T1037.004", "T1070.007", "T1564.012", "T1657", "T1675", "T1678", "T1679", "T1680" ] } }, { "slug": "qilin", "group": "qilin", "name": "Qilin", "note": null, "attck": [ { "id": "S1242", "name": "Qilin", "kind": "malware", "url": "https://attack.mitre.org/software/S1242" } ], "activity": { "postings": 342, "first": "2026-08-10", "last": "2026-11-07", "countries": { "DE": 24, "IL": 3, "US": 92, "AU": 11, "CL": 9, "MY": 5, "??": 16, "JP": 10, "HU": 1, "AT": 2, "TW": 1, "MX": 13, "CI": 1, "GB": 21, "PH": 6, "ES": 19, "CA": 10, "MM": 1, "CH": 2, "NL": 5, "BD": 1, "TR": 4, "AR": 11, "IT": 16, "IN": 2, "AE": 2, "PT": 1, "PE": 2, "TH": 5, "KR": 2, "NG": 1, "RE": 1, "BR": 2, "SG": 4, "EC": 1, "MA": 1, "CO": 3, "SE": 2, "FI": 3, "QA": 3, "IE": 2, "FR": 7, "TT": 2, "SK": 1, "MK": 1, "MT": 1, "RO": 2, "ZA": 1, "CY": 1, "UY": 1, "BE": 2, "DK": 1, "PK": 1 }, "sectors": { "manufacturing": 64, "services": 35, "finance": 23, "insurance": 2, "education": 13, "healthcare": 14, "unknown": 65, "transportation": 23, "consumer": 30, "energy": 15, "technology": 35, "government": 13, "agriculture": 12 }, "recent": [ { "date": "2026-11-07", "name": "Acondistec", "country": "DE", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/QWNvbmRpc3RlY0BxaWxpbg" }, { "date": "2026-11-06", "name": "Rotstein & Shiffman", "country": "IL", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/Um90c3RlaW4gJiBTaGlmZm1hbkBxaWxpbg" }, { "date": "2026-11-05", "name": "Insurance Audit Services", "country": "US", "sectors": [ "finance", "insurance" ], "url": "https://www.ransomware.live/id/SW5zdXJhbmNlIEF1ZGl0IFNlcnZpY2VzQHFpbGlu" }, { "date": "2026-11-05", "name": "Calvary Christian College", "country": "AU", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/Q2FsdmFyeSBDaHJpc3RpYW4gQ29sbGVnZUBxaWxpbg" }, { "date": "2026-11-03", "name": "Arthur Chapman Kettering Smetak Pikala PA", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/QXJ0aHVyIENoYXBtYW4gS2V0dGVyaW5nIFNtZXRhayBQaWthbGEgUEFAcWlsaW4" }, { "date": "2026-11-02", "name": "Isapre Consalud", "country": "CL", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/SXNhcHJlIENvbnNhbHVkQHFpbGlu" }, { "date": "2026-11-02", "name": "Astino Berhad", "country": "MY", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/QXN0aW5vIEJlcmhhZEBxaWxpbg" }, { "date": "2026-11-01", "name": "fzmb GmbH, Forschungszentrum für Medizintechnik und Biotechnologie", "country": "DE", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/ZnptYiBHbWJILCBGb3JzY2h1bmdzemVudHJ1bSBmw7xyIE1lZGl6aW50ZWNobmlrIHVuZCBCaW90ZWNobm9sb2dpZUBxaWxpbg" }, { "date": "2026-11-01", "name": "Global Holding", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/R2xvYmFsIEhvbGRpbmdAcWlsaW4" }, { "date": "2026-11-01", "name": "Shibata Co., Ltd.", "country": "JP", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/U2hpYmF0YSBDby4sIEx0ZC5AcWlsaW4" }, { "date": "2026-11-01", "name": "Meshbesher & Spence", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/TWVzaGJlc2hlciAmIFNwZW5jZUBxaWxpbg" }, { "date": "2026-11-01", "name": "BKV Vasúti Jármjavító Kft", "country": "HU", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/QktWIFZhc8O6dGkgSsOhcm1qYXbDrXTDsyBLZnRAcWlsaW4" } ] }, "convergences": [ { "name": "The Nueva School", "flagged": "2026-11-04", "classes": [ "leak", "notice" ], "curated": false, "hand_picked": false } ], "reports": [ { "url": "https://unit42.paloaltonetworks.com/europes-refrigeration-systems-attacks/", "publisher": "Unit 42", "published": "2026-11-06", "title": "Turning Up the Heat: Inside the Attacks on Europe’s Refrigeration System", "origin": "feed", "primary": false }, { "url": "https://reliaquest.com/blog/psts-industry-defense-gap-is-architectural-what-to-do-about-it/", "publisher": "ReliaQuest", "published": "2026-11-06", "title": "The PSTS Industry’s Defense Gap Is Architectural. Here’s What to Do About It.", "origin": "feed", "primary": false }, { "url": "https://www.recordedfuture.com/blog/october-2026-cve-landscape", "publisher": "Recorded Future Insikt", "published": "2026-11-06", "title": "October 2026 CVE Landscape", "origin": "feed", "primary": false }, { "url": "https://reliaquest.com/blog/finance-and-insurance-faces-a-122-percent-ransomware-spike-how-to-defend-against-it/", "publisher": "ReliaQuest", "published": "2026-11-05", "title": "Finance and Insurance Faces a 122% Ransomware Spike. Here’s How to Defend Against It.", "origin": "feed", "primary": false }, { "url": "https://reliaquest.com/blog/health-care-faces-a-70-percent-ransomware-surge-how-to-defend-against-it/", "publisher": "ReliaQuest", "published": "2026-11-05", "title": "Health Care Faces a 70% Ransomware Surge. Here’s How to Defend Against It.", "origin": "feed", "primary": false }, { "url": "https://reliaquest.com/blog/manufacturing-attackers-using-more-paths-in-security-operations-need-to-move-first/", "publisher": "ReliaQuest", "published": "2026-11-05", "title": "Manufacturing Attackers Are Using More Paths In. Security Operations Need to Move First.", "origin": "feed", "primary": false }, { "url": "https://www.intel471.com/blog/why-is-italy-a-top-target-for-cybercrime", "publisher": "Intel 471", "published": "2026-11-04", "title": "Why is Italy a top target for cybercrime?", "origin": "feed", "primary": false }, { "url": "https://reliaquest.com/blog/threat-spotlight-ransomware-and-cyber-extortion-in-q3-2026/", "publisher": "ReliaQuest", "published": "2026-11-03", "title": "Ransomware and Cyber Extortion in Q3 2026", "origin": "feed", "primary": false }, { "url": "https://blog.talosintelligence.com/ir-trends-q3-2026/", "publisher": "Cisco Talos", "published": "2026-10-29", "title": "IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases", "origin": "feed", "primary": false }, { "url": "https://unit42.paloaltonetworks.com/unwrapping-retail-cyber-threats/", "publisher": "Unit 42", "published": "2026-10-28", "title": "Unwrapping Retail Peak Season Cyber Threats", "origin": "feed", "primary": false }, { "url": "https://flashpoint.io/blog/2026-ransomware-survival-guide/", "publisher": "Flashpoint", "published": "2026-10-27", "title": "Ransomware in the Age of AI: How Defenders Can Break the Attack Chain", "origin": "feed", "primary": false }, { "url": "https://www.group-ib.com/blog/stray-cat-network-edge/", "publisher": "Group-IB", "published": "2026-10-21", "title": "Stray Cat, Open Doors: How k0t Wanders Through the Network Edge", "origin": "feed", "primary": false }, { "url": "https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/", "publisher": "Unit 42", "published": "2026-10-20", "title": "Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20)", "origin": "feed", "primary": false }, { "url": "https://databreaches.net/2026/10/20/qilin-and-inc-ransomware-groups-exploit-palo-alto-networks-flaw-to-bypass-mfa/", "publisher": "DataBreaches.net", "published": "2026-10-20", "title": "Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA", "origin": "feed", "primary": true }, { "url": "https://asec.ahnlab.com/en/95933/", "publisher": "AhnLab ASEC", "published": "2026-10-20", "title": "Ransom & Dark Web Issues Week 4, October 2026", "origin": "feed", "primary": false }, { "url": "https://flare.io/learn/resources/blog/the-com-ecosystem-actors-attribution", "publisher": "Flare", "published": "2026-10-20", "title": "Arachnophobia: How Fear, Branding, and Bad Attribution Distorted The Com", "origin": "feed", "primary": false }, { "url": "https://www.aquasec.com/blog/japans-cyber-emergency-is-a-warning-for-the-world/", "publisher": "Aqua Nautilus", "published": "2026-10-15", "title": "Japan’s Cyber Emergency Is a Warning for the World", "origin": "feed", "primary": false }, { "url": "https://www.recordedfuture.com/blog/september-2026-cve-landscape", "publisher": "Recorded Future Insikt", "published": "2026-10-13", "title": "September 2026 CVE Landscape", "origin": "feed", "primary": false }, { "url": "https://asec.ahnlab.com/en/95949/", "publisher": "AhnLab ASEC", "published": "2026-10-11", "title": "September 2026 Threat Trend Report on Ransomware", "origin": "feed", "primary": false }, { "url": "https://asec.ahnlab.com/en/96155/", "publisher": "AhnLab ASEC", "published": "2026-10-11", "title": "Security Issues in the Korean & Global Financial Sector in September 2026", "origin": "feed", "primary": false }, { "url": "https://flare.io/learn/resources/blog/healthcare-ransomware-attack-surface", "publisher": "Flare", "published": "2026-10-08", "title": "Healthcare Is Cybercrime’s Highest-Value Target: Ransomware, Exposure, and the Expanding Attack Surface", "origin": "feed", "primary": false }, { "url": "https://www.guidepointsecurity.com/blog/ransomware-insights-q3-2026/", "publisher": "GuidePoint GRIT", "published": "2026-10-08", "title": "GRIT Q3 2026 Ransomware and Cyber Threat Insights Report: Top Takeaways", "origin": "feed", "primary": false }, { "url": "https://www.intel471.com/blog/agentic-hunting-needs-guardrails-start-with-your-methodology", "publisher": "Intel 471", "published": "2026-10-07", "title": "Agentic Hunting Needs Guardrails. Start With Your Methodology.", "origin": "feed", "primary": false }, { "url": "https://asec.ahnlab.com/en/95669/", "publisher": "AhnLab ASEC", "published": "2026-09-30", "title": "Ransom & Dark Web Issues Week 1, October 2026", "origin": "feed", "primary": false }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments/", "publisher": "Microsoft Threat Intelligence", "published": "2026-09-24", "title": "Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments", "origin": "feed", "primary": false }, { "url": "https://www.sekoia.com/blog/gotta-breach-em-all-the-journey-of-shinyhunters", "publisher": "Sekoia TDR", "published": "2026-09-24", "title": "Gotta Breach 'Em All! The Journey Of ShinyHunters", "origin": "feed", "primary": false }, { "url": "https://www.intel471.com/blog/follow-the-money-the-financial-sectors-threat-landscape-in-2026", "publisher": "Intel 471", "published": "2026-09-10", "title": "Follow the Money: The Financial Sector's Threat Landscape in 2026", "origin": "feed", "primary": false }, { "url": "https://www.sekoia.com/blog/beyond-lazarus-organization-of-dprk-cyber-capabilities", "publisher": "Sekoia TDR", "published": "2026-08-31", "title": "Beyond Lazarus: How North Korea Organizes Its Cyber Operations", "origin": "feed", "primary": false }, { "url": "https://www.wiz.io/blog/ai-infrastructure-honeypot", "publisher": "Wiz Research", "published": "2026-08-27", "title": "Inside 90 days of attacks on AI infrastructure", "origin": "feed", "primary": false }, { "url": "https://www.recordedfuture.com/blog/mexico-cybersecurity-plan", "publisher": "Recorded Future Insikt", "published": "2026-08-25", "title": "Mexico’s Cybersecurity Plan 2025-2030: Turning Ambition Into Defense", "origin": "feed", "primary": false } ], "techniques": [ { "id": "T1003.001", "name": "LSASS Memory", "tactics": [ "credential-access" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 79, "related": 36 }, { "id": "T1007", "name": "System Service Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 11, "related": 0 }, { "id": "T1012", "name": "Query Registry", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 13, "related": 0 }, { "id": "T1016", "name": "System Network Configuration Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 11, "related": 0 }, { "id": "T1018", "name": "Remote System Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 17, "related": 0 }, { "id": "T1021.002", "name": "SMB/Windows Admin Shares", "tactics": [ "lateral-movement" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 38, "related": 10 }, { "id": "T1021.004", "name": "SSH", "tactics": [ "lateral-movement" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 5, "related": 10 }, { "id": "T1027.013", "name": "Encrypted/Encoded File", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [ "t1557-claims-kit-single-letter-c2-xenc" ], "community": 0, "related": 94 }, { "id": "T1036.004", "name": "Masquerade Task or Service", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 3, "related": 40 }, { "id": "T1036.005", "name": "Match Legitimate Resource Name or Location", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [ "t1557-recaptcha-skinned-turnstile-gate" ], "community": 21, "related": 40 }, { "id": "T1047", "name": "Windows Management Instrumentation", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 52, "related": 0 }, { "id": "T1053.005", "name": "Scheduled Task", "tactics": [ "execution", "persistence", "privilege-escalation" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 51, "related": 12 }, { "id": "T1055.001", "name": "Dynamic-link Library Injection", "tactics": [ "stealth", "privilege-escalation" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 8, "related": 36 }, { "id": "T1057", "name": "Process Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 8, "related": 0 }, { "id": "T1059.001", "name": "PowerShell", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 220, "related": 94 }, { "id": "T1059.003", "name": "Windows Command Shell", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 46, "related": 94 }, { "id": "T1069.002", "name": "Domain Groups", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 15, "related": 3 }, { "id": "T1070.004", "name": "File Deletion", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 15, "related": 20 }, { "id": "T1071.002", "name": "File Transfer Protocols", "tactics": [ "command-and-control" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 7 }, { "id": "T1082", "name": "System Information Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 33, "related": 0 }, { "id": "T1083", "name": "File and Directory Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 24, "related": 0 }, { "id": "T1087.001", "name": "Local Account", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 13, "related": 16 }, { "id": "T1087.002", "name": "Domain Account", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 21, "related": 16 }, { "id": "T1106", "name": "Native API", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 14, "related": 0 }, { "id": "T1112", "name": "Modify Registry", "tactics": [ "defense-impairment", "persistence" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 94, "related": 0 }, { "id": "T1134", "name": "Access Token Manipulation", "tactics": [ "stealth", "privilege-escalation" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 2, "related": 21 }, { "id": "T1135", "name": "Network Share Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 7, "related": 0 }, { "id": "T1190", "name": "Exploit Public-Facing Application", "tactics": [ "initial-access" ], "sources": [ "attck" ], "structural": false, "own": [ "t1190-peoplesoft-psemhub-encoded-path-exploitation" ], "community": 147, "related": 0 }, { "id": "T1204.001", "name": "Malicious Link", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 4, "related": 10 }, { "id": "T1204.002", "name": "Malicious File", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 39, "related": 10 }, { "id": "T1219.002", "name": "Remote Desktop Software", "tactics": [ "command-and-control" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 46, "related": 6 }, { "id": "T1222", "name": "File and Directory Permissions Modification", "tactics": [ "defense-impairment" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 2, "related": 9 }, { "id": "T1480", "name": "Execution Guardrails", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1480.002", "name": "Mutual Exclusion", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1484.001", "name": "Group Policy Modification", "tactics": [ "defense-impairment", "privilege-escalation" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 6, "related": 1 }, { "id": "T1486", "name": "Data Encrypted for Impact", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 16, "related": 0 }, { "id": "T1489", "name": "Service Stop", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 20, "related": 0 }, { "id": "T1490", "name": "Inhibit System Recovery", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 27, "related": 0 }, { "id": "T1491.001", "name": "Internal Defacement", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 4, "related": 0 }, { "id": "T1529", "name": "System Shutdown/Reboot", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 8, "related": 0 }, { "id": "T1547.001", "name": "Registry Run Keys / Startup Folder", "tactics": [ "persistence", "privilege-escalation" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 39, "related": 7 }, { "id": "T1547.004", "name": "Winlogon Helper DLL", "tactics": [ "persistence", "privilege-escalation" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 4, "related": 7 }, { "id": "T1548.002", "name": "Bypass User Account Control", "tactics": [ "privilege-escalation" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 56, "related": 23 }, { "id": "T1566.001", "name": "Spearphishing Attachment", "tactics": [ "initial-access" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 24, "related": 14 }, { "id": "T1566.002", "name": "Spearphishing Link", "tactics": [ "initial-access" ], "sources": [ "attck" ], "structural": false, "own": [ "t1566-002-luxembourg-hospitality-sms-phish" ], "community": 4, "related": 14 }, { "id": "T1570", "name": "Lateral Tool Transfer", "tactics": [ "lateral-movement" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 6, "related": 0 }, { "id": "T1673", "name": "Virtual Machine Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1678", "name": "Delay Execution", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1680", "name": "Local Storage Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1685", "name": "Disable or Modify Tools", "tactics": [ "defense-impairment" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 162, "related": 44 }, { "id": "T1685.005", "name": "Clear Windows Event Logs", "tactics": [ "defense-impairment" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 8, "related": 162 }, { "id": "T1688", "name": "Safe Mode Boot", "tactics": [ "defense-impairment" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 0 } ], "cves": [ { "id": "CVE-2026-0257", "in_kev": true, "ransomware_use": true, "epss": 0.95642, "vendor": "Palo Alto Networks", "product": "PAN-OS" } ], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 52, "defendable": 52, "covered": 45, "uncovered": [ "T1071.002", "T1480", "T1480.002", "T1673", "T1678", "T1680", "T1688" ] } }, { "slug": "n0n", "group": "n0n", "name": "N0n", "note": null, "attck": [], "activity": { "postings": 204, "first": "2026-09-18", "last": "2026-11-06", "countries": { "IT": 1, "US": 74, "SA": 3, "AE": 4, "CA": 4, "DK": 1, "ID": 5, "DE": 2, "??": 41, "MY": 2, "ES": 3, "BG": 2, "PT": 2, "AR": 2, "ET": 2, "TN": 2, "CH": 2, "KR": 14, "TT": 1, "EG": 2, "NL": 3, "BR": 7, "TR": 2, "SG": 2, "CN": 2, "JP": 2, "HK": 1, "TW": 1, "KW": 1, "IN": 1, "GB": 3, "MA": 1, "VN": 3, "AU": 1, "ML": 1, "UZ": 1, "VE": 1, "SE": 1, "LU": 1 }, "sectors": { "healthcare": 16, "technology": 17, "energy": 5, "services": 9, "consumer": 10, "insurance": 7, "unknown": 89, "manufacturing": 13, "finance": 7, "transportation": 35, "government": 1, "education": 2 }, "recent": [ { "date": "2026-11-06", "name": "Dompé Farmaceutici S.p.A.", "country": "IT", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/RG9tcMOpIEZhcm1hY2V1dGljaSBTLnAuQS5ATjBu" }, { "date": "2026-11-06", "name": "Cogent Biosciences, Inc.", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/Q29nZW50IEJpb3NjaWVuY2VzLCBJbmMuQE4wbg" }, { "date": "2026-11-06", "name": "Chartboost LLC", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/Q2hhcnRib29zdCBMTENATjBu" }, { "date": "2026-11-06", "name": "Centrepoint", "country": "SA", "sectors": [ "energy" ], "url": "https://www.ransomware.live/id/Q2VudHJlcG9pbnRATjBu" }, { "date": "2026-11-06", "name": "Resource Consultants", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/UmVzb3VyY2UgQ29uc3VsdGFudHNATjBu" }, { "date": "2026-11-06", "name": "Max Fashion", "country": "AE", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/TWF4IEZhc2hpb25ATjBu" }, { "date": "2026-11-06", "name": "Hallmark Cards, Inc.", "country": "US", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/SGFsbG1hcmsgQ2FyZHMsIEluYy5ATjBu" }, { "date": "2026-11-06", "name": "Scry Analytics", "country": "US", "sectors": [ "technology", "insurance" ], "url": "https://www.ransomware.live/id/U2NyeSBBbmFseXRpY3NATjBu" }, { "date": "2026-11-05", "name": "Company #137", "country": "CA", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Q29tcGFueSAjMTM3QE4wbg" }, { "date": "2026-11-05", "name": "Company #136", "country": "DK", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Q29tcGFueSAjMTM2QE4wbg" }, { "date": "2026-11-05", "name": "Company #135", "country": "ID", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Q29tcGFueSAjMTM1QE4wbg" }, { "date": "2026-11-05", "name": "Company #134", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Q29tcGFueSAjMTM0QE4wbg" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "akira", "group": "akira", "name": "Akira", "note": null, "attck": [ { "id": "G1024", "name": "Akira", "kind": "intrusion-set", "url": "https://attack.mitre.org/groups/G1024" }, { "id": "S1129", "name": "Akira", "kind": "malware", "url": "https://attack.mitre.org/software/S1129" } ], "activity": { "postings": 116, "first": "2026-08-10", "last": "2026-11-06", "countries": { "FR": 1, "US": 30, "??": 60, "CA": 3, "CH": 1, "KR": 1, "NL": 2, "DE": 6, "GB": 3, "MX": 4, "BR": 4, "IT": 1 }, "sectors": { "consumer": 13, "manufacturing": 31, "services": 17, "unknown": 24, "technology": 8, "energy": 4, "finance": 5, "transportation": 4, "healthcare": 3, "insurance": 1, "education": 1, "agriculture": 6 }, "recent": [ { "date": "2026-11-06", "name": "Ligne Roset", "country": "FR", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/TGlnbmUgUm9zZXRAYWtpcmE" }, { "date": "2026-11-06", "name": "Houston Machine and Thread", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/SG91c3RvbiBNYWNoaW5lIGFuZCBUaHJlYWRAYWtpcmE" }, { "date": "2026-11-06", "name": "Hudson & Hudson SignProducts", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/SHVkc29uICYgSHVkc29uIFNpZ25Qcm9kdWN0c0Bha2lyYQ" }, { "date": "2026-11-06", "name": "Boyle, Pecharich, Cline, Whittington andStallings", "country": "??", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/Qm95bGUsIFBlY2hhcmljaCwgQ2xpbmUsIFdoaXR0aW5ndG9uIGFuZFN0YWxsaW5nc0Bha2lyYQ" }, { "date": "2026-11-05", "name": "Westboro Partners", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/V2VzdGJvcm8gUGFydG5lcnNAYWtpcmE" }, { "date": "2026-11-05", "name": "System Plus", "country": "??", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/U3lzdGVtIFBsdXNAYWtpcmE" }, { "date": "2026-11-05", "name": "David L Wade & Associates", "country": "??", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/RGF2aWQgTCBXYWRlICYgQXNzb2NpYXRlc0Bha2lyYQ" }, { "date": "2026-11-05", "name": "Source Energy Services", "country": "CA", "sectors": [ "energy" ], "url": "https://www.ransomware.live/id/U291cmNlIEVuZXJneSBTZXJ2aWNlc0Bha2lyYQ" }, { "date": "2026-11-04", "name": "Krishnan", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/S3Jpc2huYW5AYWtpcmE" }, { "date": "2026-11-04", "name": "Erowa", "country": "CH", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/RXJvd2FAYWtpcmE" }, { "date": "2026-11-03", "name": "Bison Bag", "country": "??", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/Qmlzb24gQmFnQGFraXJh" }, { "date": "2026-11-03", "name": "SK Global Software", "country": "KR", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/U0sgR2xvYmFsIFNvZnR3YXJlQGFraXJh" } ] }, "convergences": [ { "name": "Cascade Coffee, LLC", "flagged": "2026-08-27", "classes": [ "leak", "notice" ], "curated": false, "hand_picked": false } ], "reports": [ { "url": "https://unit42.paloaltonetworks.com/europes-refrigeration-systems-attacks/", "publisher": "Unit 42", "published": "2026-11-06", "title": "Turning Up the Heat: Inside the Attacks on Europe’s Refrigeration System", "origin": "feed", "primary": false }, { "url": "https://reliaquest.com/blog/manufacturing-attackers-using-more-paths-in-security-operations-need-to-move-first/", "publisher": "ReliaQuest", "published": "2026-11-05", "title": "Manufacturing Attackers Are Using More Paths In. Security Operations Need to Move First.", "origin": "feed", "primary": false }, { "url": "https://unit42.paloaltonetworks.com/unwrapping-retail-cyber-threats/", "publisher": "Unit 42", "published": "2026-10-28", "title": "Unwrapping Retail Peak Season Cyber Threats", "origin": "feed", "primary": false }, { "url": "https://flashpoint.io/blog/2026-ransomware-survival-guide/", "publisher": "Flashpoint", "published": "2026-10-27", "title": "Ransomware in the Age of AI: How Defenders Can Break the Attack Chain", "origin": "feed", "primary": false }, { "url": "https://asec.ahnlab.com/en/95949/", "publisher": "AhnLab ASEC", "published": "2026-10-11", "title": "September 2026 Threat Trend Report on Ransomware", "origin": "feed", "primary": false }, { "url": "https://flare.io/learn/resources/blog/healthcare-ransomware-attack-surface", "publisher": "Flare", "published": "2026-10-08", "title": "Healthcare Is Cybercrime’s Highest-Value Target: Ransomware, Exposure, and the Expanding Attack Surface", "origin": "feed", "primary": false }, { "url": "https://www.intel471.com/blog/agentic-hunting-needs-guardrails-start-with-your-methodology", "publisher": "Intel 471", "published": "2026-10-07", "title": "Agentic Hunting Needs Guardrails. Start With Your Methodology.", "origin": "feed", "primary": false }, { "url": "https://www.huntress.com/blog/mapping-akira-ransomware-attack", "publisher": "Huntress", "published": "2026-10-06", "title": "Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack", "origin": "feed", "primary": true }, { "url": "https://www.huntress.com/blog/what-happens-during-a-ransomware-attack", "publisher": "Huntress", "published": "2026-10-02", "title": "The First 24 Hours: What Happens When Ransomware Lands", "origin": "feed", "primary": true }, { "url": "https://www.intel471.com/blog/follow-the-money-the-financial-sectors-threat-landscape-in-2026", "publisher": "Intel 471", "published": "2026-09-10", "title": "Follow the Money: The Financial Sector's Threat Landscape in 2026", "origin": "feed", "primary": false }, { "url": "https://www.huntress.com/blog/akira-hits-safe-mode-ransomware-rebooting-around-edr", "publisher": "Huntress", "published": "2026-08-12", "title": "Akira Hits Safe Mode: Ransomware Rebooting Around EDR", "origin": "feed", "primary": true } ], "techniques": [ { "id": "T1018", "name": "Remote System Discovery", "tactics": [ "discovery" ], "sources": [ "attck", "report" ], "structural": false, "own": [], "community": 17, "related": 0 }, { "id": "T1021.001", "name": "Remote Desktop Protocol", "tactics": [ "lateral-movement" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 16, "related": 10 }, { "id": "T1027.001", "name": "Binary Padding", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 3, "related": 94 }, { "id": "T1036.005", "name": "Match Legitimate Resource Name or Location", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [ "t1557-recaptcha-skinned-turnstile-gate" ], "community": 21, "related": 40 }, { "id": "T1047", "name": "Windows Management Instrumentation", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 52, "related": 0 }, { "id": "T1057", "name": "Process Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 8, "related": 0 }, { "id": "T1059.001", "name": "PowerShell", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 220, "related": 94 }, { "id": "T1059.003", "name": "Windows Command Shell", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 46, "related": 94 }, { "id": "T1078", "name": "Valid Accounts", "tactics": [ "stealth", "persistence", "privilege-escalation", "initial-access" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 55, "related": 54 }, { "id": "T1082", "name": "System Information Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 33, "related": 0 }, { "id": "T1083", "name": "File and Directory Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 24, "related": 0 }, { "id": "T1087", "name": "Account Discovery", "tactics": [ "discovery" ], "sources": [ "report" ], "structural": false, "own": [], "community": 16, "related": 37 }, { "id": "T1106", "name": "Native API", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 14, "related": 0 }, { "id": "T1133", "name": "External Remote Services", "tactics": [ "persistence", "initial-access" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 20, "related": 0 }, { "id": "T1135", "name": "Network Share Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 7, "related": 0 }, { "id": "T1213.002", "name": "Sharepoint", "tactics": [ "collection" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 7 }, { "id": "T1219", "name": "Remote Access Tools", "tactics": [ "command-and-control" ], "sources": [ "attck" ], "structural": false, "own": [ "t1505-003-peoplesoft-psemhub-webshell-drop" ], "community": 6, "related": 46 }, { "id": "T1482", "name": "Domain Trust Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 17, "related": 0 }, { "id": "T1486", "name": "Data Encrypted for Impact", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 16, "related": 0 }, { "id": "T1490", "name": "Inhibit System Recovery", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 27, "related": 0 }, { "id": "T1531", "name": "Account Access Removal", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 9, "related": 0 }, { "id": "T1558", "name": "Steal or Forge Kerberos Tickets", "tactics": [ "credential-access" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 5, "related": 17 }, { "id": "T1560.001", "name": "Archive via Utility", "tactics": [ "collection" ], "sources": [ "attck", "report" ], "structural": false, "own": [], "community": 17, "related": 4 }, { "id": "T1567.002", "name": "Exfiltration to Cloud Storage", "tactics": [ "exfiltration" ], "sources": [ "attck", "report" ], "structural": false, "own": [], "community": 14, "related": 12 }, { "id": "T1657", "name": "Financial Theft", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1685", "name": "Disable or Modify Tools", "tactics": [ "defense-impairment" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 162, "related": 44 }, { "id": "T1688", "name": "Safe Mode Boot", "tactics": [ "defense-impairment" ], "sources": [ "report" ], "structural": false, "own": [], "community": 0, "related": 0 } ], "cves": [], "indicators": { "list": [ { "type": "ipv4", "value": "64.227.4.134", "source": "https://www.huntress.com/blog/mapping-akira-ransomware-attack" }, { "type": "ipv4", "value": "72.23.77.35", "source": "https://www.huntress.com/blog/akira-hits-safe-mode-ransomware-rebooting-around-edr" }, { "type": "sha256", "value": "1f1bb322591b6d27fd2946e373d7d2efc2f4e1e66818846060d391600b600fba", "source": "https://www.huntress.com/blog/mapping-akira-ransomware-attack" }, { "type": "sha256", "value": "414b9985f46714f44dd1bd63860d2a48dcfababcfe5c712a4b4f575378127a56", "source": "https://www.huntress.com/blog/akira-hits-safe-mode-ransomware-rebooting-around-edr" }, { "type": "sha256", "value": "d00833318a04caa019c6f95dcb3598ad947d405010bfb2f3cbd04530a00bc3a4", "source": "https://www.huntress.com/blog/mapping-akira-ransomware-attack" }, { "type": "sha256", "value": "e2356c742c74cce5c6b6100162d0071a3f71e2fed2ed895c2011061a95b3299a", "source": "https://www.huntress.com/blog/akira-hits-safe-mode-ransomware-rebooting-around-edr" } ], "withheld": 0 }, "rules": [], "coverage": { "techniques": 27, "defendable": 27, "covered": 24, "uncovered": [ "T1213.002", "T1657", "T1688" ] } }, { "slug": "incransom", "group": "incransom", "name": "INC Ransom", "note": null, "attck": [ { "id": "G1032", "name": "INC Ransom", "kind": "intrusion-set", "url": "https://attack.mitre.org/groups/G1032" } ], "activity": { "postings": 96, "first": "2026-08-12", "last": "2026-11-07", "countries": { "AL": 1, "CA": 6, "ES": 3, "US": 50, "DE": 5, "CR": 1, "PL": 1, "BR": 3, "IN": 1, "AE": 2, "ZA": 2, "SE": 1, "MA": 1, "MO": 1, "GB": 3, "NL": 1, "TW": 2, "AR": 1, "MY": 3, "MX": 2, "IT": 1, "PA": 1, "CH": 1, "TH": 1, "MU": 1, "AU": 1 }, "sectors": { "unknown": 16, "healthcare": 13, "finance": 7, "services": 18, "technology": 8, "consumer": 6, "education": 4, "manufacturing": 16, "government": 3, "transportation": 2, "energy": 3, "insurance": 1 }, "recent": [ { "date": "2026-11-07", "name": "1da9100e55aqf21eb651eNea", "country": "AL", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/MWRhOTEwMGU1NWFxZjIxZWI2NTFlTmVhQGluY3JhbnNvbQ" }, { "date": "2026-11-06", "name": "https://www.sleep-clinic.ca/", "country": "CA", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/aHR0cHM6Ly93d3cuc2xlZXAtY2xpbmljLmNhL0BpbmNyYW5zb20" }, { "date": "2026-11-03", "name": "fidepartners.com", "country": "ES", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/ZmlkZXBhcnRuZXJzLmNvbUBpbmNyYW5zb20" }, { "date": "2026-11-03", "name": "roundglass.com", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/cm91bmRnbGFzcy5jb21AaW5jcmFuc29t" }, { "date": "2026-11-03", "name": "butler.legal", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/YnV0bGVyLmxlZ2FsQGluY3JhbnNvbQ" }, { "date": "2026-11-03", "name": "innovativedriven.com", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/aW5ub3ZhdGl2ZWRyaXZlbi5jb21AaW5jcmFuc29t" }, { "date": "2026-11-03", "name": "bliss1041.com", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Ymxpc3MxMDQxLmNvbUBpbmNyYW5zb20" }, { "date": "2026-11-03", "name": "hillandbeyer.com", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/aGlsbGFuZGJleWVyLmNvbUBpbmNyYW5zb20" }, { "date": "2026-10-31", "name": "chicagolawyer.com", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/Y2hpY2Fnb2xhd3llci5jb21AaW5jcmFuc29t" }, { "date": "2026-10-22", "name": "bereskinparr.com smartbiggar.ca", "country": "CA", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/YmVyZXNraW5wYXJyLmNvbSBzbWFydGJpZ2dhci5jYUBpbmNyYW5zb20" }, { "date": "2026-10-20", "name": "centralrogers.com", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Y2VudHJhbHJvZ2Vycy5jb21AaW5jcmFuc29t" }, { "date": "2026-10-19", "name": "Seetelhotels.de", "country": "DE", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/U2VldGVsaG90ZWxzLmRlQGluY3JhbnNvbQ" } ] }, "convergences": [ { "name": "Life Bridges, Inc.", "flagged": "2026-08-21", "classes": [ "leak", "notice" ], "curated": false, "hand_picked": false } ], "reports": [ { "url": "https://www.recordedfuture.com/blog/october-2026-cve-landscape", "publisher": "Recorded Future Insikt", "published": "2026-11-06", "title": "October 2026 CVE Landscape", "origin": "feed", "primary": false }, { "url": "https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/", "publisher": "Unit 42", "published": "2026-10-20", "title": "Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20)", "origin": "feed", "primary": false }, { "url": "https://databreaches.net/2026/10/20/qilin-and-inc-ransomware-groups-exploit-palo-alto-networks-flaw-to-bypass-mfa/", "publisher": "DataBreaches.net", "published": "2026-10-20", "title": "Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA", "origin": "feed", "primary": false }, { "url": "https://www.huntress.com/blog/two-inc-ransom-notes", "publisher": "Huntress", "published": "2026-09-21", "title": "The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress", "origin": "feed", "primary": true } ], "techniques": [ { "id": "T1021.001", "name": "Remote Desktop Protocol", "tactics": [ "lateral-movement" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 16, "related": 10 }, { "id": "T1036.005", "name": "Match Legitimate Resource Name or Location", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [ "t1557-recaptcha-skinned-turnstile-gate" ], "community": 21, "related": 40 }, { "id": "T1046", "name": "Network Service Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 20, "related": 0 }, { "id": "T1047", "name": "Windows Management Instrumentation", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 52, "related": 0 }, { "id": "T1049", "name": "System Network Connections Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 9, "related": 0 }, { "id": "T1059.003", "name": "Windows Command Shell", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 46, "related": 94 }, { "id": "T1069.002", "name": "Domain Groups", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 15, "related": 3 }, { "id": "T1070.004", "name": "File Deletion", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 15, "related": 20 }, { "id": "T1071", "name": "Application Layer Protocol", "tactics": [ "command-and-control" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 7, "related": 59 }, { "id": "T1074", "name": "Data Staged", "tactics": [ "collection" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 2, "related": 4 }, { "id": "T1078", "name": "Valid Accounts", "tactics": [ "stealth", "persistence", "privilege-escalation", "initial-access" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 55, "related": 54 }, { "id": "T1087.002", "name": "Domain Account", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 21, "related": 16 }, { "id": "T1105", "name": "Ingress Tool Transfer", "tactics": [ "command-and-control" ], "sources": [ "attck" ], "structural": false, "own": [ "t1204-004-clickfix-run-dialog-execution" ], "community": 87, "related": 0 }, { "id": "T1135", "name": "Network Share Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 7, "related": 0 }, { "id": "T1190", "name": "Exploit Public-Facing Application", "tactics": [ "initial-access" ], "sources": [ "attck" ], "structural": false, "own": [ "t1190-peoplesoft-psemhub-encoded-path-exploitation" ], "community": 147, "related": 0 }, { "id": "T1219", "name": "Remote Access Tools", "tactics": [ "command-and-control" ], "sources": [ "attck" ], "structural": false, "own": [ "t1505-003-peoplesoft-psemhub-webshell-drop" ], "community": 6, "related": 46 }, { "id": "T1486", "name": "Data Encrypted for Impact", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 16, "related": 0 }, { "id": "T1537", "name": "Transfer Data to Cloud Account", "tactics": [ "exfiltration" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 6, "related": 0 }, { "id": "T1560.001", "name": "Archive via Utility", "tactics": [ "collection" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 17, "related": 4 }, { "id": "T1566", "name": "Phishing", "tactics": [ "initial-access" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 14, "related": 28 }, { "id": "T1569.002", "name": "Service Execution", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 43, "related": 4 }, { "id": "T1570", "name": "Lateral Tool Transfer", "tactics": [ "lateral-movement" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 6, "related": 0 }, { "id": "T1588.002", "name": "Tool", "tactics": [ "resource-development" ], "sources": [ "attck" ], "structural": true, "own": [], "community": 9, "related": 2 }, { "id": "T1657", "name": "Financial Theft", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1685", "name": "Disable or Modify Tools", "tactics": [ "defense-impairment" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 162, "related": 44 } ], "cves": [], "indicators": { "list": [ { "type": "domain", "value": "throughoutes.net", "source": "https://www.huntress.com/blog/two-inc-ransom-notes" }, { "type": "ipv4", "value": "213.111.185.108", "source": "https://www.huntress.com/blog/two-inc-ransom-notes" } ], "withheld": 0 }, "rules": [], "coverage": { "techniques": 25, "defendable": 24, "covered": 23, "uncovered": [ "T1657" ] } }, { "slug": "storm", "group": "storm", "name": "Storm", "note": "Not Microsoft's Storm-#### naming.", "attck": [], "activity": { "postings": 83, "first": "2026-08-10", "last": "2026-10-19", "countries": { "US": 62, "CA": 11, "AU": 6, "DE": 3, "GB": 1 }, "sectors": { "transportation": 4, "finance": 15, "services": 6, "technology": 5, "healthcare": 13, "manufacturing": 19, "education": 2, "agriculture": 4, "consumer": 5, "unknown": 7, "insurance": 3, "energy": 1, "government": 2 }, "recent": [ { "date": "2026-10-19", "name": "Baltimore Tank Lines", "country": "US", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/QmFsdGltb3JlIFRhbmsgTGluZXNAU3Rvcm0" }, { "date": "2026-10-19", "name": "Merit Financial Group", "country": "US", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/TWVyaXQgRmluYW5jaWFsIEdyb3VwQFN0b3Jt" }, { "date": "2026-10-19", "name": "Patriot Maritime", "country": "US", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/UGF0cmlvdCBNYXJpdGltZUBTdG9ybQ" }, { "date": "2026-10-16", "name": "R. A. Wood Associates", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/Ui4gQS4gV29vZCBBc3NvY2lhdGVzQFN0b3Jt" }, { "date": "2026-10-16", "name": "Tech Electronics", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/VGVjaCBFbGVjdHJvbmljc0BTdG9ybQ" }, { "date": "2026-10-08", "name": "Cooperative Des Techniciens Ambulanciers De La Monte", "country": "CA", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/Q29vcGVyYXRpdmUgRGVzIFRlY2huaWNpZW5zIEFtYnVsYW5jaWVycyBEZSBMYSBNb250ZUBTdG9ybQ" }, { "date": "2026-10-08", "name": "TheraCare", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/VGhlcmFDYXJlQFN0b3Jt" }, { "date": "2026-10-04", "name": "Nipigon District Memorial Hospital", "country": "CA", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/TmlwaWdvbiBEaXN0cmljdCBNZW1vcmlhbCBIb3NwaXRhbEBTdG9ybQ" }, { "date": "2026-10-04", "name": "Nipigon District Memorial Hospital", "country": "CA", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/TmlwaWdvbiBEaXN0cmljdCBNZW1vcmlhbCBIb3NwaXRhbEBTdG9ybQ==" }, { "date": "2026-10-03", "name": "States Industries", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/U3RhdGVzIEluZHVzdHJpZXNAU3Rvcm0" }, { "date": "2026-10-03", "name": "States Industries", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/U3RhdGVzIEluZHVzdHJpZXNAU3Rvcm0=" }, { "date": "2026-10-03", "name": "Allied Machine & Engineering", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/QWxsaWVkIE1hY2hpbmUgJiBFbmdpbmVlcmluZ0BTdG9ybQ" } ] }, "convergences": [ { "name": "Insight Credit Union", "flagged": "2026-11-07", "classes": [ "leak", "notice", "press" ], "curated": false, "hand_picked": false }, { "name": "WindRose Health Network", "flagged": "2026-09-17", "classes": [ "leak", "notice" ], "curated": false, "hand_picked": false } ], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "silentransomgroup", "group": "silentransomgroup", "name": "Silent Ransom Group", "note": null, "attck": [], "activity": { "postings": 76, "first": "2026-08-12", "last": "2026-11-07", "countries": { "US": 23, "??": 51, "DE": 2 }, "sectors": { "services": 30, "unknown": 46 }, "recent": [ { "date": "2026-11-07", "name": "Benesch Law", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/QmVuZXNjaCBMYXdAU2lsZW50UmFuc29tR3JvdXA" }, { "date": "2026-11-06", "name": "Tucker Ellis", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/VHVja2VyIEVsbGlzQFNpbGVudFJhbnNvbUdyb3Vw" }, { "date": "2026-11-06", "name": "Wachtell, Lipton, Rosen & Katz", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/V2FjaHRlbGwsIExpcHRvbiwgUm9zZW4gJiBLYXR6QFNpbGVudFJhbnNvbUdyb3Vw" }, { "date": "2026-11-06", "name": "B... law", "country": "??", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/Qi4uLiBsYXdAU2lsZW50UmFuc29tR3JvdXA" }, { "date": "2026-11-05", "name": "Smith, Gambrell & Russell, LLP", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/U21pdGgsIEdhbWJyZWxsICYgUnVzc2VsbCwgTExQQFNpbGVudFJhbnNvbUdyb3Vw" }, { "date": "2026-11-05", "name": "W... R...", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Vy4uLiBSLi4uQFNpbGVudFJhbnNvbUdyb3Vw" }, { "date": "2026-11-04", "name": "K... R...", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Sy4uLiBSLi4uQFNpbGVudFJhbnNvbUdyb3Vw" }, { "date": "2026-11-04", "name": "W... G...", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Vy4uLiBHLi4uQFNpbGVudFJhbnNvbUdyb3Vw" }, { "date": "2026-11-03", "name": "G... R...", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Ry4uLiBSLi4uQFNpbGVudFJhbnNvbUdyb3Vw" }, { "date": "2026-11-02", "name": "S... G...", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Uy4uLiBHLi4uQFNpbGVudFJhbnNvbUdyb3Vw" }, { "date": "2026-10-30", "name": "ArentFox Schiff", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/QXJlbnRGb3ggU2NoaWZmQFNpbGVudFJhbnNvbUdyb3Vw" }, { "date": "2026-10-30", "name": "Moritt Hock & Hamroff LLP", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/TW9yaXR0IEhvY2sgJiBIYW1yb2ZmIExMUEBTaWxlbnRSYW5zb21Hcm91cA" } ] }, "convergences": [ { "name": "Troutman Pepper Locke LLP", "flagged": "2026-10-31", "classes": [ "leak", "notice" ], "curated": false, "hand_picked": false }, { "name": "Sheppard, Mullin, Richter & Hampton LLP", "flagged": "2026-10-06", "classes": [ "leak", "litigation", "notice" ], "curated": false, "hand_picked": false } ], "reports": [ { "url": "https://www.sygnia.co/blog/investigating-data-extortion-involving-trusted-vendor-access/", "publisher": "Sygnia", "published": "2026-11-01", "title": "Investigating Data Extortion Involving Trusted Vendor Access", "origin": "feed", "primary": true }, { "url": "https://www.sygnia.co/blog/best-practices-incident-response/", "publisher": "Sygnia", "published": "2026-10-28", "title": "Incident Response Best Practices: Strategies, Tools & Plans", "origin": "feed", "primary": true }, { "url": "https://www.sygnia.co/threat-reports-and-advisories/php2shell-two-critical-php-vulnerabilities-expose-web-servers-to-remote-code-execution/", "publisher": "Sygnia", "published": "2026-10-22", "title": "php2shell: Two Critical PHP Vulnerabilities Expose Web Servers to Remote Code Execution", "origin": "feed", "primary": true }, { "url": "https://www.guidepointsecurity.com/blog/silent-ransom-group-leaked-chats/", "publisher": "GuidePoint GRIT", "published": "2026-10-15", "title": "Behind the Help Desk Call: Insights from the Leaked Chats of an IT-Impersonation Extortion Crew", "origin": "feed", "primary": true }, { "url": "https://www.sygnia.co/press-release/sygnia-expands-global-mdr-operations-austin-singapore-soc-hubs/", "publisher": "Sygnia", "published": "2026-10-11", "title": "Sygnia Unveils Security Operations Center Hubs and Expands AI-Powered Cybersecurity Capabilities To Challenge Threat Attack Rise", "origin": "feed", "primary": true }, { "url": "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/", "publisher": "Sygnia", "published": "2026-09-28", "title": "Actively Exploited NetScaler Vulnerabilities", "origin": "feed", "primary": true }, { "url": "https://www.sygnia.co/blog/when-it-support-is-the-attack-how-law-firms-can-defend-against-silent-ransom-group/", "publisher": "Sygnia", "published": "2026-09-22", "title": "When IT Support Is the Attack: How Law Firms Can Defend Against Silent Ransom Group", "origin": "feed", "primary": true }, { "url": "https://www.sygnia.co/webinars/how-law-firms-can-defend-against-silent-ransom-group/", "publisher": "Sygnia", "published": "2026-09-17", "title": "When IT Support Is the Attack: Defending Law Firms Against Silent Ransom Group", "origin": "feed", "primary": true }, { "url": "https://www.sygnia.co/blog/shai-hulud-in-the-wild-what-security-and-incident-response-teams-need-to-know/", "publisher": "Sygnia", "published": "2026-09-06", "title": "Shai-Hulud in the Wild: What Security and Incident Response Teams Need to Know", "origin": "feed", "primary": true }, { "url": "https://www.sygnia.co/blog/how-the-safepay-ransomware-group-abused-onedrive-to-steal-data/", "publisher": "Sygnia", "published": "2026-08-31", "title": "Exfiltration in Plain Sight: How the SafePay Ransomware Group Abused OneDrive to Steal Data", "origin": "feed", "primary": true } ], "techniques": [ { "id": "T1005", "name": "Data from Local System", "tactics": [ "collection" ], "sources": [ "report" ], "structural": false, "own": [], "community": 14, "related": 0 }, { "id": "T1052.001", "name": "Exfiltration over USB", "tactics": [ "exfiltration" ], "sources": [ "report" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1091", "name": "Replication Through Removable Media", "tactics": [ "lateral-movement", "initial-access" ], "sources": [ "report" ], "structural": false, "own": [], "community": 1, "related": 0 }, { "id": "T1199", "name": "Trusted Relationship", "tactics": [ "initial-access" ], "sources": [ "report" ], "structural": false, "own": [], "community": 1, "related": 0 }, { "id": "T1200", "name": "Hardware Additions", "tactics": [ "initial-access" ], "sources": [ "report" ], "structural": false, "own": [], "community": 3, "related": 0 }, { "id": "T1219", "name": "Remote Access Tools", "tactics": [ "command-and-control" ], "sources": [ "report" ], "structural": false, "own": [ "t1505-003-peoplesoft-psemhub-webshell-drop" ], "community": 6, "related": 46 }, { "id": "T1566.004", "name": "Spearphishing Voice", "tactics": [ "initial-access" ], "sources": [ "report" ], "structural": false, "own": [ "t1583-001-claims-registration-conjunction" ], "community": 0, "related": 14 }, { "id": "T1567.002", "name": "Exfiltration to Cloud Storage", "tactics": [ "exfiltration" ], "sources": [ "report" ], "structural": false, "own": [], "community": 14, "related": 12 }, { "id": "T1583.001", "name": "Domains", "tactics": [ "resource-development" ], "sources": [ "report" ], "structural": true, "own": [ "t1583-001-claims-registration-conjunction" ], "community": 0, "related": 0 }, { "id": "T1585.003", "name": "Cloud Accounts", "tactics": [ "resource-development" ], "sources": [ "report" ], "structural": true, "own": [], "community": 0, "related": 0 }, { "id": "T1589.002", "name": "Email Addresses", "tactics": [ "reconnaissance" ], "sources": [ "report" ], "structural": true, "own": [], "community": 1, "related": 2 }, { "id": "T1589.003", "name": "Employee Names", "tactics": [ "reconnaissance" ], "sources": [ "report" ], "structural": true, "own": [], "community": 0, "related": 2 }, { "id": "T1591.004", "name": "Identify Roles", "tactics": [ "reconnaissance" ], "sources": [ "report" ], "structural": true, "own": [], "community": 2, "related": 0 }, { "id": "T1593.001", "name": "Social Media", "tactics": [ "reconnaissance" ], "sources": [ "report" ], "structural": true, "own": [], "community": 0, "related": 0 }, { "id": "T1650", "name": "Acquire Access", "tactics": [ "resource-development" ], "sources": [ "report" ], "structural": true, "own": [], "community": 0, "related": 0 }, { "id": "T1656", "name": "T1656", "tactics": [], "sources": [ "report" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1657", "name": "Financial Theft", "tactics": [ "impact" ], "sources": [ "report" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1684", "name": "Social Engineering", "tactics": [ "stealth" ], "sources": [ "report" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1684.001", "name": "Impersonation", "tactics": [ "stealth" ], "sources": [ "report" ], "structural": false, "own": [], "community": 0, "related": 0 } ], "cves": [ { "id": "CVE-2021-44228", "in_kev": true, "ransomware_use": true, "epss": 0.99999, "vendor": "Apache", "product": "Log4j2" }, { "id": "CVE-2024-20399", "in_kev": true, "ransomware_use": false, "epss": 0.04306, "vendor": "Cisco", "product": "NX-OS" }, { "id": "CVE-2026-109618", "in_kev": true, "ransomware_use": false, "epss": 0.99999, "vendor": "PHP Group", "product": "PHP" }, { "id": "CVE-2026-109619", "in_kev": true, "ransomware_use": false, "epss": 0.99999, "vendor": "PHP Group", "product": "PHP" }, { "id": "CVE-2026-88771", "in_kev": true, "ransomware_use": false, "epss": 0.81894, "vendor": "Citrix", "product": "NetScaler" }, { "id": "CVE-2026-88772", "in_kev": true, "ransomware_use": false, "epss": 0.76566, "vendor": "Citrix", "product": "NetScaler" }, { "id": "CVE-2026-88773", "in_kev": false, "ransomware_use": false, "epss": 0.03081, "vendor": null, "product": null }, { "id": "CVE-2026-88774", "in_kev": false, "ransomware_use": false, "epss": 0.00395, "vendor": null, "product": null }, { "id": "CVE-2026-88775", "in_kev": false, "ransomware_use": false, "epss": 0.00719, "vendor": null, "product": null }, { "id": "CVE-2026-88776", "in_kev": false, "ransomware_use": false, "epss": 0.00734, "vendor": null, "product": null }, { "id": "CVE-2026-88777", "in_kev": false, "ransomware_use": false, "epss": 0.00719, "vendor": null, "product": null }, { "id": "CVE-2026-88778", "in_kev": false, "ransomware_use": false, "epss": 0.00694, "vendor": null, "product": null } ], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 19, "defendable": 12, "covered": 7, "uncovered": [ "T1052.001", "T1656", "T1657", "T1684", "T1684.001" ] } }, { "slug": "krybit", "group": "krybit", "name": "krybit", "note": null, "attck": [], "activity": { "postings": 76, "first": "2026-08-11", "last": "2026-10-29", "countries": { "AT": 1, "US": 5, "MY": 1, "EG": 1, "??": 6, "MX": 4, "CA": 3, "FR": 5, "CO": 2, "IR": 2, "CZ": 2, "IN": 9, "SA": 2, "TZ": 1, "AU": 1, "TR": 2, "DE": 3, "GE": 1, "ZA": 1, "AE": 1, "MA": 1, "HT": 1, "HR": 1, "KE": 1, "GT": 2, "CH": 1, "CN": 1, "TH": 2, "BT": 1, "GA": 1, "VN": 1, "BR": 3, "AR": 2, "IT": 1, "HK": 1, "TW": 1, "SG": 1, "FI": 1 }, "sectors": { "transportation": 5, "consumer": 13, "manufacturing": 7, "services": 7, "technology": 8, "healthcare": 10, "unknown": 16, "education": 3, "government": 1, "agriculture": 5, "finance": 1 }, "recent": [ { "date": "2026-10-29", "name": "www.viehhauser-kfz.at", "country": "AT", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/d3d3LnZpZWhoYXVzZXIta2Z6LmF0QGtyeWJpdA" }, { "date": "2026-10-24", "name": "www.choicegoodwill.com", "country": "US", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/d3d3LmNob2ljZWdvb2R3aWxsLmNvbUBrcnliaXQ" }, { "date": "2026-10-24", "name": "mainplace.com.my", "country": "MY", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/bWFpbnBsYWNlLmNvbS5teUBrcnliaXQ" }, { "date": "2026-10-24", "name": "MODON Developments S.A.E", "country": "EG", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/TU9ET04gRGV2ZWxvcG1lbnRzIFMuQS5FQGtyeWJpdA" }, { "date": "2026-10-24", "name": "www.zhservices.com", "country": "??", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/d3d3Lnpoc2VydmljZXMuY29tQGtyeWJpdA" }, { "date": "2026-10-24", "name": "grupoeuro.com.mx", "country": "MX", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/Z3J1cG9ldXJvLmNvbS5teEBrcnliaXQ" }, { "date": "2026-10-24", "name": "www.optika.ca", "country": "CA", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/d3d3Lm9wdGlrYS5jYUBrcnliaXQ" }, { "date": "2026-10-04", "name": "euroditel.com", "country": "FR", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/ZXVyb2RpdGVsLmNvbUBrcnliaXQ" }, { "date": "2026-10-04", "name": "euroditel.com", "country": "FR", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/ZXVyb2RpdGVsLmNvbUBrcnliaXQ=" }, { "date": "2026-10-04", "name": "superpack.com.co", "country": "CO", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/c3VwZXJwYWNrLmNvbS5jb0BrcnliaXQ" }, { "date": "2026-10-04", "name": "superpack.com.co", "country": "CO", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/c3VwZXJwYWNrLmNvbS5jb0BrcnliaXQ=" }, { "date": "2026-10-04", "name": "daralteb.com", "country": "IR", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/ZGFyYWx0ZWIuY29tQGtyeWJpdA" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "settra", "group": "settra", "name": "Settra", "note": null, "attck": [], "activity": { "postings": 75, "first": "2026-08-11", "last": "2026-11-06", "countries": { "US": 35, "GB": 6, "JM": 1, "EE": 1, "??": 8, "NO": 2, "LA": 1, "DE": 5, "AT": 1, "AU": 2, "BR": 2, "MS": 1, "MX": 1, "IT": 1, "NL": 2, "CA": 1, "SE": 1, "JP": 1, "GR": 1, "MY": 1, "EC": 1 }, "sectors": { "government": 1, "consumer": 11, "manufacturing": 10, "insurance": 3, "unknown": 13, "finance": 4, "services": 12, "healthcare": 4, "transportation": 6, "technology": 11, "agriculture": 2, "energy": 1 }, "recent": [ { "date": "2026-11-06", "name": "ar500armor.com", "country": "US", "sectors": [ "government" ], "url": "https://www.ransomware.live/id/YXI1MDBhcm1vci5jb21Ac2V0dHJh" }, { "date": "2026-11-06", "name": "lakelawnresort.com", "country": "US", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/bGFrZWxhd25yZXNvcnQuY29tQHNldHRyYQ" }, { "date": "2026-11-06", "name": "metalloidcorp.com", "country": "US", "sectors": [ "manufacturing", "insurance" ], "url": "https://www.ransomware.live/id/bWV0YWxsb2lkY29ycC5jb21Ac2V0dHJh" }, { "date": "2026-11-03", "name": "marlo-inc.com", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/bWFybG8taW5jLmNvbUBzZXR0cmE" }, { "date": "2026-11-02", "name": "kingdomtitle.net", "country": "GB", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/a2luZ2RvbXRpdGxlLm5ldEBzZXR0cmE" }, { "date": "2026-11-02", "name": "mackinengineering.com", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/bWFja2luZW5naW5lZXJpbmcuY29tQHNldHRyYQ" }, { "date": "2026-11-02", "name": "insurancehouse.com", "country": "GB", "sectors": [ "finance", "insurance" ], "url": "https://www.ransomware.live/id/aW5zdXJhbmNlaG91c2UuY29tQHNldHRyYQ" }, { "date": "2026-10-31", "name": "atljamaica.com", "country": "JM", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/YXRsamFtYWljYS5jb21Ac2V0dHJh" }, { "date": "2026-10-31", "name": "flynn-construction.com", "country": "US", "sectors": [ "manufacturing", "insurance" ], "url": "https://www.ransomware.live/id/Zmx5bm4tY29uc3RydWN0aW9uLmNvbUBzZXR0cmE" }, { "date": "2026-10-31", "name": "smithandcasady.com", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/c21pdGhhbmRjYXNhZHkuY29tQHNldHRyYQ" }, { "date": "2026-10-31", "name": "nelsenarchitects.com", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/bmVsc2VuYXJjaGl0ZWN0cy5jb21Ac2V0dHJh" }, { "date": "2026-10-18", "name": "www.marvinpac.com", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/d3d3Lm1hcnZpbnBhYy5jb21Ac2V0dHJh" } ] }, "convergences": [], "reports": [ { "url": "https://www.recordedfuture.com/blog/october-2026-cve-landscape", "publisher": "Recorded Future Insikt", "published": "2026-11-06", "title": "October 2026 CVE Landscape", "origin": "feed", "primary": false }, { "url": "https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/", "publisher": "Unit 42", "published": "2026-10-20", "title": "Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20)", "origin": "feed", "primary": false }, { "url": "https://asec.ahnlab.com/en/95764/", "publisher": "AhnLab ASEC", "published": "2026-10-11", "title": "September 2026 Dark Web Breach Incident Trend Report", "origin": "feed", "primary": false }, { "url": "https://www.intel471.com/blog/2026-sans-threat-hunting-survey-adversaries-prizing-stealth-over-speed-defenders-cooling-on-ai", "publisher": "Intel 471", "published": "2026-09-24", "title": "2026 SANS Threat Hunting Survey: Adversaries Prizing Stealth over Speed? Defenders Cooling on AI?", "origin": "feed", "primary": false }, { "url": "https://www.huntress.com/blog/new-settra-ransomware-variant", "publisher": "Huntress", "published": "2026-09-17", "title": "Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM", "origin": "feed", "primary": true } ], "techniques": [], "cves": [], "indicators": { "list": [ { "type": "ipv4", "value": "193.5.65.114", "source": "https://www.huntress.com/blog/new-settra-ransomware-variant" }, { "type": "ipv4", "value": "45.13.122.7", "source": "https://www.huntress.com/blog/new-settra-ransomware-variant" } ], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "direwolf", "group": "direwolf", "name": "direwolf", "note": null, "attck": [], "activity": { "postings": 67, "first": "2026-08-10", "last": "2026-11-06", "countries": { "US": 28, "GB": 4, "MX": 3, "PE": 1, "BR": 5, "MY": 1, "CO": 1, "SE": 4, "ZA": 1, "TH": 1, "ID": 1, "TR": 1, "CL": 1, "IT": 1, "CA": 1, "NL": 1, "??": 4, "AE": 1, "DK": 1, "AU": 1, "IN": 1, "AI": 1, "DE": 1, "ES": 1, "PH": 1 }, "sectors": { "technology": 16, "finance": 8, "consumer": 2, "energy": 2, "insurance": 2, "transportation": 4, "services": 6, "unknown": 8, "education": 4, "manufacturing": 3, "healthcare": 14 }, "recent": [ { "date": "2026-11-06", "name": "Algonomy", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/QWxnb25vbXlAZGlyZXdvbGY" }, { "date": "2026-11-03", "name": "USClaims", "country": "US", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/VVNDbGFpbXNAZGlyZXdvbGY" }, { "date": "2026-11-01", "name": "My Cloud Grocer", "country": "GB", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/TXkgQ2xvdWQgR3JvY2VyQGRpcmV3b2xm" }, { "date": "2026-10-27", "name": "GRUPO PETROIL", "country": "MX", "sectors": [ "energy" ], "url": "https://www.ransomware.live/id/R1JVUE8gUEVUUk9JTEBkaXJld29sZg" }, { "date": "2026-10-13", "name": "Interseguro", "country": "PE", "sectors": [ "finance", "insurance" ], "url": "https://www.ransomware.live/id/SW50ZXJzZWd1cm9AZGlyZXdvbGY" }, { "date": "2026-10-04", "name": "Softruck", "country": "BR", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/U29mdHJ1Y2tAZGlyZXdvbGY" }, { "date": "2026-10-04", "name": "Softruck", "country": "BR", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/U29mdHJ1Y2tAZGlyZXdvbGY=" }, { "date": "2026-09-11", "name": "Port of Tanjung Pelepas", "country": "MY", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/UG9ydCBvZiBUYW5qdW5nIFBlbGVwYXNAZGlyZXdvbGY=" }, { "date": "2026-09-09", "name": "RelyComply AML Platform", "country": "GB", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/UmVseUNvbXBseSBBTUwgUGxhdGZvcm1AZGlyZXdvbGY=" }, { "date": "2026-09-08", "name": "Sales Boomerang", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/U2FsZXMgQm9vbWVyYW5nQGRpcmV3b2xm" }, { "date": "2026-09-08", "name": "EMS1R", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/RU1TMVJAZGlyZXdvbGY=" }, { "date": "2026-09-07", "name": "Precision Vehicle Logistics", "country": "US", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/UHJlY2lzaW9uIFZlaGljbGUgTG9naXN0aWNzQGRpcmV3b2xm" } ] }, "convergences": [ { "name": "Photon Health", "flagged": "2026-10-22", "classes": [ "leak", "litigation", "notice" ], "curated": false, "hand_picked": false } ], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "safepay", "group": "safepay", "name": "safepay", "note": null, "attck": [], "activity": { "postings": 66, "first": "2026-08-14", "last": "2026-11-04", "countries": { "AU": 1, "DE": 11, "US": 9, "ES": 5, "BE": 4, "EC": 1, "TW": 2, "PE": 2, "JP": 2, "AR": 2, "IL": 1, "MX": 3, "CH": 8, "IT": 3, "CL": 1, "SK": 1, "MY": 1, "NL": 1, "PH": 2, "CZ": 1, "LT": 1, "AT": 1, "PT": 1, "CA": 1, "KR": 1 }, "sectors": { "unknown": 20, "consumer": 8, "manufacturing": 9, "services": 7, "education": 3, "healthcare": 6, "transportation": 1, "agriculture": 5, "technology": 6, "government": 1, "insurance": 1 }, "recent": [ { "date": "2026-11-04", "name": "prospecthillcamberwell.com.au", "country": "AU", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/cHJvc3BlY3RoaWxsY2FtYmVyd2VsbC5jb20uYXVAc2FmZXBheQ" }, { "date": "2026-11-04", "name": "jhz-bernardshof.de", "country": "DE", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/amh6LWJlcm5hcmRzaG9mLmRlQHNhZmVwYXk" }, { "date": "2026-11-04", "name": "ehrenwall.de", "country": "DE", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/ZWhyZW53YWxsLmRlQHNhZmVwYXk" }, { "date": "2026-11-04", "name": "ruscopackaging.com", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/cnVzY29wYWNrYWdpbmcuY29tQHNhZmVwYXk" }, { "date": "2026-11-04", "name": "valemany.com", "country": "ES", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/dmFsZW1hbnkuY29tQHNhZmVwYXk" }, { "date": "2026-11-04", "name": "titres-services.net", "country": "BE", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/dGl0cmVzLXNlcnZpY2VzLm5ldEBzYWZlcGF5" }, { "date": "2026-11-04", "name": "sportschule-steinbach.de", "country": "DE", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/c3BvcnRzY2h1bGUtc3RlaW5iYWNoLmRlQHNhZmVwYXk" }, { "date": "2026-11-04", "name": "fuss-sprunggelenk.de", "country": "DE", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/ZnVzcy1zcHJ1bmdnZWxlbmsuZGVAc2FmZXBheQ" }, { "date": "2026-11-02", "name": "deom.be", "country": "BE", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/ZGVvbS5iZUBzYWZlcGF5" }, { "date": "2026-10-31", "name": "quevedo-ponce.com", "country": "EC", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/cXVldmVkby1wb25jZS5jb21Ac2FmZXBheQ" }, { "date": "2026-10-31", "name": "mars-semi.com.tw", "country": "TW", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/bWFycy1zZW1pLmNvbS50d0BzYWZlcGF5" }, { "date": "2026-10-31", "name": "Rood Trucking", "country": "US", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/Um9vZCBUcnVja2luZ0BzYWZlcGF5" } ] }, "convergences": [], "reports": [ { "url": "https://www.sygnia.co/blog/investigating-data-extortion-involving-trusted-vendor-access/", "publisher": "Sygnia", "published": "2026-11-01", "title": "Investigating Data Extortion Involving Trusted Vendor Access", "origin": "feed", "primary": false }, { "url": "https://www.sygnia.co/blog/best-practices-incident-response/", "publisher": "Sygnia", "published": "2026-10-28", "title": "Incident Response Best Practices: Strategies, Tools & Plans", "origin": "feed", "primary": false }, { "url": "https://databreaches.net/2026/10/27/conduent-to-pay-80m-to-settle-3rd-largest-healthcare-data-breach/", "publisher": "DataBreaches.net", "published": "2026-10-27", "title": "Conduent to pay $80M to settle 3rd-largest healthcare data breach", "origin": "feed", "primary": false }, { "url": "https://databreaches.net/2026/10/27/fbi-says-safepay-ransomware-gang-among-most-active-with-more-than-600-victims-since-2024/", "publisher": "DataBreaches.net", "published": "2026-10-27", "title": "FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024", "origin": "feed", "primary": true }, { "url": "https://www.sygnia.co/threat-reports-and-advisories/php2shell-two-critical-php-vulnerabilities-expose-web-servers-to-remote-code-execution/", "publisher": "Sygnia", "published": "2026-10-22", "title": "php2shell: Two Critical PHP Vulnerabilities Expose Web Servers to Remote Code Execution", "origin": "feed", "primary": false }, { "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a", "publisher": "CISA", "published": "2026-10-19", "title": "#StopRansomware: SafePay Ransomware", "origin": "feed", "primary": true }, { "url": "https://www.sygnia.co/press-release/sygnia-expands-global-mdr-operations-austin-singapore-soc-hubs/", "publisher": "Sygnia", "published": "2026-10-11", "title": "Sygnia Unveils Security Operations Center Hubs and Expands AI-Powered Cybersecurity Capabilities To Challenge Threat Attack Rise", "origin": "feed", "primary": false }, { "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a", "publisher": "CISA", "published": "2026-10-06", "title": "Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data", "origin": "feed", "primary": false }, { "url": "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/", "publisher": "Sygnia", "published": "2026-09-28", "title": "Actively Exploited NetScaler Vulnerabilities", "origin": "feed", "primary": false }, { "url": "https://www.sygnia.co/blog/shai-hulud-in-the-wild-what-security-and-incident-response-teams-need-to-know/", "publisher": "Sygnia", "published": "2026-09-06", "title": "Shai-Hulud in the Wild: What Security and Incident Response Teams Need to Know", "origin": "feed", "primary": false }, { "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-251a", "publisher": "CISA", "published": "2026-09-04", "title": "China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies", "origin": "feed", "primary": false }, { "url": "https://www.sygnia.co/blog/how-the-safepay-ransomware-group-abused-onedrive-to-steal-data/", "publisher": "Sygnia", "published": "2026-08-31", "title": "Exfiltration in Plain Sight: How the SafePay Ransomware Group Abused OneDrive to Steal Data", "origin": "feed", "primary": true }, { "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-237a", "publisher": "CISA", "published": "2026-08-20", "title": "A Tale of Two SOCs: Insights From Two Red Team Assessments", "origin": "feed", "primary": false }, { "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a", "publisher": "CISA", "published": "2026-08-14", "title": "Defending Against an Active Threat to Siemens S7 Series PLCs", "origin": "feed", "primary": false }, { "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-222a", "publisher": "CISA", "published": "2026-08-05", "title": "#StopRansomware: Gunra Ransomware", "origin": "feed", "primary": false } ], "techniques": [], "cves": [ { "id": "CVE-2020-3259", "in_kev": true, "ransomware_use": true, "epss": 0.715, "vendor": "Cisco", "product": "Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)" }, { "id": "CVE-2021-44228", "in_kev": true, "ransomware_use": true, "epss": 0.99999, "vendor": "Apache", "product": "Log4j2" }, { "id": "CVE-2023-20269", "in_kev": true, "ransomware_use": true, "epss": 0.26623, "vendor": "Cisco", "product": "Adaptive Security Appliance and Firepower Threat Defense" }, { "id": "CVE-2023-27532", "in_kev": true, "ransomware_use": true, "epss": 0.80599, "vendor": "Veeam", "product": "Backup & Replication" }, { "id": "CVE-2024-20399", "in_kev": true, "ransomware_use": false, "epss": 0.04306, "vendor": "Cisco", "product": "NX-OS" }, { "id": "CVE-2024-40711", "in_kev": true, "ransomware_use": true, "epss": 0.90369, "vendor": "Veeam", "product": "Backup & Replication" }, { "id": "CVE-2024-40766", "in_kev": true, "ransomware_use": true, "epss": 0.18379, "vendor": "SonicWall", "product": "SonicOS" } ], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "lockbit5", "group": "lockbit5", "name": "LockBit 5.0", "note": "ATT&CK models LockBit 3.0; 5.0 is its successor build.", "attck": [ { "id": "S1202", "name": "LockBit 3.0", "kind": "malware", "url": "https://attack.mitre.org/software/S1202" } ], "activity": { "postings": 64, "first": "2026-08-16", "last": "2026-11-04", "countries": { "BR": 4, "ID": 1, "TH": 2, "MX": 3, "IT": 5, "LB": 1, "LI": 1, "ES": 1, "TR": 1, "US": 10, "MY": 1, "EG": 1, "AU": 1, "FR": 3, "GR": 1, "HT": 1, "DE": 7, "AR": 2, "KR": 1, "KZ": 1, "SO": 1, "CL": 1, "TW": 1, "FI": 1, "NL": 6, "ZA": 1, "JP": 1, "TN": 1, "CZ": 1, "BE": 1, "PT": 1 }, "sectors": { "unknown": 19, "finance": 5, "education": 1, "services": 13, "consumer": 4, "healthcare": 8, "manufacturing": 5, "agriculture": 2, "technology": 4, "government": 1, "energy": 2 }, "recent": [ { "date": "2026-11-04", "name": "centratamagroup.com", "country": "BR", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Y2VudHJhdGFtYWdyb3VwLmNvbUBsb2NrYml0NQ" }, { "date": "2026-11-01", "name": "synergy.co.id", "country": "ID", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/c3luZXJneS5jby5pZEBsb2NrYml0NQ" }, { "date": "2026-10-29", "name": "xspringcapital.com", "country": "TH", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/eHNwcmluZ2NhcGl0YWwuY29tQGxvY2tiaXQ1" }, { "date": "2026-10-29", "name": "susannecerda.com", "country": "MX", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/c3VzYW5uZWNlcmRhLmNvbUBsb2NrYml0NQ" }, { "date": "2026-10-23", "name": "dorsiacademy.it", "country": "IT", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/ZG9yc2lhY2FkZW15Lml0QGxvY2tiaXQ1" }, { "date": "2026-10-23", "name": "mlh.com.lb", "country": "LB", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/bWxoLmNvbS5sYkBsb2NrYml0NQ" }, { "date": "2026-10-23", "name": "lidoway.com", "country": "LI", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/bGlkb3dheS5jb21AbG9ja2JpdDU" }, { "date": "2026-10-23", "name": "zelsior.es", "country": "ES", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/emVsc2lvci5lc0Bsb2NrYml0NQ" }, { "date": "2026-10-22", "name": "istanbultrading.com", "country": "TR", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/aXN0YW5idWx0cmFkaW5nLmNvbUBsb2NrYml0NQ" }, { "date": "2026-10-19", "name": "chooseultimate.com", "country": "US", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/Y2hvb3NldWx0aW1hdGUuY29tQGxvY2tiaXQ1" }, { "date": "2026-10-17", "name": "ock.com.my", "country": "MY", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/b2NrLmNvbS5teUBsb2NrYml0NQ" }, { "date": "2026-10-15", "name": "torcivialaw.com", "country": "IT", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/dG9yY2l2aWFsYXcuY29tQGxvY2tiaXQ1" } ] }, "convergences": [ { "name": "ADT, Inc.", "flagged": "2026-08-24", "classes": [ "leak", "notice" ], "curated": false, "hand_picked": false } ], "reports": [ { "url": "https://securelist.com/storm-2603-fileless-toolshell-attack/121467/", "publisher": "Kaspersky Securelist", "published": "2026-11-05", "title": "The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603", "origin": "feed", "primary": false }, { "url": "https://reliaquest.com/blog/finance-and-insurance-faces-a-122-percent-ransomware-spike-how-to-defend-against-it/", "publisher": "ReliaQuest", "published": "2026-11-05", "title": "Finance and Insurance Faces a 122% Ransomware Spike. Here’s How to Defend Against It.", "origin": "feed", "primary": false }, { "url": "https://www.intel471.com/blog/why-is-italy-a-top-target-for-cybercrime", "publisher": "Intel 471", "published": "2026-11-04", "title": "Why is Italy a top target for cybercrime?", "origin": "feed", "primary": false }, { "url": "https://flare.io/learn/resources/blog/shinyhunters-arrests-brand-name-fight", "publisher": "Flare", "published": "2026-11-04", "title": "Aftermath of the September ShinyHunters Arrests: Battle Over the Brand Name", "origin": "feed", "primary": false }, { "url": "https://reliaquest.com/blog/threat-spotlight-ransomware-and-cyber-extortion-in-q3-2026/", "publisher": "ReliaQuest", "published": "2026-11-03", "title": "Ransomware and Cyber Extortion in Q3 2026", "origin": "feed", "primary": false }, { "url": "https://www.guidepointsecurity.com/blog/silent-ransom-group-leaked-chats/", "publisher": "GuidePoint GRIT", "published": "2026-10-15", "title": "Behind the Help Desk Call: Insights from the Leaked Chats of an IT-Impersonation Extortion Crew", "origin": "feed", "primary": false }, { "url": "https://asec.ahnlab.com/en/95949/", "publisher": "AhnLab ASEC", "published": "2026-10-11", "title": "September 2026 Threat Trend Report on Ransomware", "origin": "feed", "primary": false }, { "url": "https://asec.ahnlab.com/en/96155/", "publisher": "AhnLab ASEC", "published": "2026-10-11", "title": "Security Issues in the Korean & Global Financial Sector in September 2026", "origin": "feed", "primary": false }, { "url": "https://flare.io/learn/resources/blog/healthcare-ransomware-attack-surface", "publisher": "Flare", "published": "2026-10-08", "title": "Healthcare Is Cybercrime’s Highest-Value Target: Ransomware, Exposure, and the Expanding Attack Surface", "origin": "feed", "primary": false }, { "url": "https://www.sekoia.com/blog/gotta-breach-em-all-the-journey-of-shinyhunters", "publisher": "Sekoia TDR", "published": "2026-09-24", "title": "Gotta Breach 'Em All! The Journey Of ShinyHunters", "origin": "feed", "primary": false }, { "url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "publisher": "Kaspersky Securelist", "published": "2026-09-21", "title": "Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO", "origin": "feed", "primary": false }, { "url": "https://www.recordedfuture.com/blog/mexico-cybersecurity-plan", "publisher": "Recorded Future Insikt", "published": "2026-08-25", "title": "Mexico’s Cybersecurity Plan 2025-2030: Turning Ambition Into Defense", "origin": "feed", "primary": false }, { "url": "https://www.intel471.com/blog/a-new-era-of-bulletproof-hosting-providers-emerge", "publisher": "Intel 471", "published": "2026-08-19", "title": "A New Era of Bulletproof Hosting Providers Emerge", "origin": "feed", "primary": false } ], "techniques": [ { "id": "T1021.002", "name": "SMB/Windows Admin Shares", "tactics": [ "lateral-movement" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 38, "related": 10 }, { "id": "T1027.002", "name": "Software Packing", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 1, "related": 94 }, { "id": "T1027.013", "name": "Encrypted/Encoded File", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [ "t1557-claims-kit-single-letter-c2-xenc" ], "community": 0, "related": 94 }, { "id": "T1057", "name": "Process Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 8, "related": 0 }, { "id": "T1059.001", "name": "PowerShell", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 220, "related": 94 }, { "id": "T1070.004", "name": "File Deletion", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 15, "related": 20 }, { "id": "T1071.001", "name": "Web Protocols", "tactics": [ "command-and-control" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 42, "related": 7 }, { "id": "T1078.003", "name": "Local Accounts", "tactics": [ "stealth", "persistence", "privilege-escalation", "initial-access" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 5, "related": 55 }, { "id": "T1082", "name": "System Information Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 33, "related": 0 }, { "id": "T1083", "name": "File and Directory Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 24, "related": 0 }, { "id": "T1106", "name": "Native API", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 14, "related": 0 }, { "id": "T1112", "name": "Modify Registry", "tactics": [ "defense-impairment", "persistence" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 94, "related": 0 }, { "id": "T1120", "name": "Peripheral Device Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 2, "related": 0 }, { "id": "T1132.001", "name": "Standard Encoding", "tactics": [ "command-and-control" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 4, "related": 0 }, { "id": "T1135", "name": "Network Share Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 7, "related": 0 }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 18, "related": 0 }, { "id": "T1218.003", "name": "CMSTP", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 7, "related": 153 }, { "id": "T1480", "name": "Execution Guardrails", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1480.002", "name": "Mutual Exclusion", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1484.001", "name": "Group Policy Modification", "tactics": [ "defense-impairment", "privilege-escalation" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 6, "related": 1 }, { "id": "T1486", "name": "Data Encrypted for Impact", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 16, "related": 0 }, { "id": "T1489", "name": "Service Stop", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 20, "related": 0 }, { "id": "T1490", "name": "Inhibit System Recovery", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 27, "related": 0 }, { "id": "T1543.003", "name": "Windows Service", "tactics": [ "persistence", "privilege-escalation" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 47, "related": 9 }, { "id": "T1547.004", "name": "Winlogon Helper DLL", "tactics": [ "persistence", "privilege-escalation" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 4, "related": 7 }, { "id": "T1548.002", "name": "Bypass User Account Control", "tactics": [ "privilege-escalation" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 56, "related": 23 }, { "id": "T1569.002", "name": "Service Execution", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 43, "related": 4 }, { "id": "T1573.001", "name": "Symmetric Cryptography", "tactics": [ "command-and-control" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 6 }, { "id": "T1614.001", "name": "System Language Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 2, "related": 0 }, { "id": "T1622", "name": "Debugger Evasion", "tactics": [ "stealth", "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 1, "related": 0 }, { "id": "T1680", "name": "Local Storage Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1685", "name": "Disable or Modify Tools", "tactics": [ "defense-impairment" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 162, "related": 44 }, { "id": "T1685.005", "name": "Clear Windows Event Logs", "tactics": [ "defense-impairment" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 8, "related": 162 }, { "id": "T1688", "name": "Safe Mode Boot", "tactics": [ "defense-impairment" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 0 } ], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 34, "defendable": 34, "covered": 29, "uncovered": [ "T1480", "T1480.002", "T1573.001", "T1680", "T1688" ] } }, { "slug": "emperador", "group": "emperador", "name": "emperador", "note": null, "attck": [], "activity": { "postings": 60, "first": "2026-08-12", "last": "2026-10-31", "countries": { "UY": 1, "CH": 1, "IT": 4, "??": 17, "FR": 1, "MX": 2, "BE": 1, "DE": 3, "US": 5, "BR": 8, "AR": 2, "TT": 1, "TR": 2, "SE": 2, "CZ": 1, "IN": 2, "CO": 1, "BA": 1, "KR": 1, "ES": 1, "VN": 1, "AL": 1, "PH": 1 }, "sectors": { "consumer": 5, "manufacturing": 13, "services": 5, "unknown": 7, "transportation": 7, "government": 7, "technology": 5, "agriculture": 3, "energy": 4, "healthcare": 2, "education": 2 }, "recent": [ { "date": "2026-10-31", "name": "Punta Shopping", "country": "UY", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/UHVudGEgU2hvcHBpbmdAZW1wZXJhZG9y" }, { "date": "2026-10-31", "name": "Holcim", "country": "CH", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/SG9sY2ltQGVtcGVyYWRvcg" }, { "date": "2026-10-30", "name": "Studio Stelitano e Associati", "country": "IT", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/U3R1ZGlvIFN0ZWxpdGFubyBlIEFzc29jaWF0aUBlbXBlcmFkb3I" }, { "date": "2026-10-29", "name": "LA PROFUMERIA SRL", "country": "IT", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/TEEgUFJPRlVNRVJJQSBTUkxAZW1wZXJhZG9y" }, { "date": "2026-10-29", "name": "MAA Group Consulting Engineers", "country": "??", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/TUFBIEdyb3VwIENvbnN1bHRpbmcgRW5naW5lZXJzQGVtcGVyYWRvcg" }, { "date": "2026-10-27", "name": "TWICE SRL", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/VFdJQ0UgU1JMQGVtcGVyYWRvcg" }, { "date": "2026-10-26", "name": "Afflelou", "country": "FR", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/QWZmbGVsb3VAZW1wZXJhZG9y" }, { "date": "2026-10-26", "name": "TRANSPORTES JIMENEZ and REYES JIM REY S.A.", "country": "MX", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/VFJBTlNQT1JURVMgSklNRU5FWiBhbmQgUkVZRVMgSklNIFJFWSBTLkEuQGVtcGVyYWRvcg" }, { "date": "2026-10-25", "name": "A-RMS", "country": "??", "sectors": [ "government" ], "url": "https://www.ransomware.live/id/QS1STVNAZW1wZXJhZG9y" }, { "date": "2026-10-25", "name": "AyT COMPUTERS SRL", "country": "??", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/QXlUIENPTVBVVEVSUyBTUkxAZW1wZXJhZG9y" }, { "date": "2026-10-25", "name": "AB InBev", "country": "BE", "sectors": [ "agriculture" ], "url": "https://www.ransomware.live/id/QUIgSW5CZXZAZW1wZXJhZG9y" }, { "date": "2026-10-24", "name": "Phoenix S&S GmbH", "country": "DE", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/UGhvZW5peCBTJlMgR21iSEBlbXBlcmFkb3I" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "nightspire", "group": "nightspire", "name": "nightspire", "note": null, "attck": [], "activity": { "postings": 54, "first": "2026-08-12", "last": "2026-11-07", "countries": { "IT": 3, "GB": 3, "ES": 2, "AR": 1, "??": 11, "US": 15, "TR": 3, "AE": 2, "DE": 1, "DZ": 1, "VN": 1, "UY": 1, "CO": 3, "TH": 1, "BR": 2, "EG": 1, "TW": 2, "HK": 1 }, "sectors": { "services": 7, "unknown": 10, "healthcare": 8, "education": 5, "energy": 2, "technology": 4, "transportation": 7, "agriculture": 1, "manufacturing": 5, "consumer": 5 }, "recent": [ { "date": "2026-11-07", "name": "IMD Group", "country": "IT", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/SU1EIEdyb3VwQG5pZ2h0c3BpcmU" }, { "date": "2026-11-07", "name": "Meller Group", "country": "GB", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/TWVsbGVyIEdyb3VwQG5pZ2h0c3BpcmU" }, { "date": "2026-11-07", "name": "Gestimed", "country": "ES", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/R2VzdGltZWRAbmlnaHRzcGlyZQ" }, { "date": "2026-11-02", "name": "REFSA S.A.", "country": "AR", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/UkVGU0EgUy5BLkBuaWdodHNwaXJl" }, { "date": "2026-10-31", "name": "**F*A *.A", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/KipGKkEgKi5BQG5pZ2h0c3BpcmU" }, { "date": "2026-10-18", "name": "U**IN* Group", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/VSoqSU4qIEdyb3VwQG5pZ2h0c3BpcmU" }, { "date": "2026-10-15", "name": "S*o**n* Public Schools", "country": "??", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/UypvKipuKiBQdWJsaWMgU2Nob29sc0BuaWdodHNwaXJl" }, { "date": "2026-10-14", "name": "Colorado Texas", "country": "US", "sectors": [ "energy" ], "url": "https://www.ransomware.live/id/Q29sb3JhZG8gVGV4YXNAbmlnaHRzcGlyZQ" }, { "date": "2026-10-14", "name": "***o* **s**e** Solutions", "country": "??", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/KioqbyogKipzKiplKiogU29sdXRpb25zQG5pZ2h0c3BpcmU" }, { "date": "2026-10-12", "name": "Cognosis Limited", "country": "GB", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/Q29nbm9zaXMgTGltaXRlZEBuaWdodHNwaXJl" }, { "date": "2026-10-12", "name": "G** Re******* Ltd", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/RyoqIFJlKioqKioqKiBMdGRAbmlnaHRzcGlyZQ" }, { "date": "2026-10-12", "name": "Spo****** Public Schools", "country": "??", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/U3BvKioqKioqIFB1YmxpYyBTY2hvb2xzQG5pZ2h0c3BpcmU" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "auditteam", "group": "auditteam", "name": "AuditTeam", "note": null, "attck": [], "activity": { "postings": 52, "first": "2026-08-18", "last": "2026-11-05", "countries": { "CN": 1, "ES": 2, "NL": 1, "SG": 1, "??": 2, "GB": 4, "IT": 9, "AE": 3, "IN": 2, "RU": 13, "JP": 2, "UA": 2, "KR": 4, "AR": 2, "DE": 2, "CO": 2 }, "sectors": { "technology": 12, "manufacturing": 4, "unknown": 28, "services": 2, "finance": 2, "education": 2, "consumer": 1, "transportation": 1 }, "recent": [ { "date": "2026-11-05", "name": "kx***om", "country": "CN", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/a3gqKipvbUBBdWRpdFRlYW0" }, { "date": "2026-10-31", "name": "Cabka", "country": "ES", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/Q2Fia2FAQXVkaXRUZWFt" }, { "date": "2026-10-31", "name": "Pe***CT", "country": "NL", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/UGUqKipDVEBBdWRpdFRlYW0" }, { "date": "2026-10-31", "name": "jl***om", "country": "SG", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/amwqKipvbUBBdWRpdFRlYW0" }, { "date": "2026-10-31", "name": "hn***rg", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/aG4qKipyZ0BBdWRpdFRlYW0" }, { "date": "2026-10-31", "name": "ro***up", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/cm8qKip1cEBBdWRpdFRlYW0" }, { "date": "2026-10-26", "name": "Safe Data Storage", "country": "GB", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/U2FmZSBEYXRhIFN0b3JhZ2VAQXVkaXRUZWFt" }, { "date": "2026-10-23", "name": "ADL Lift Services Limited", "country": "GB", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/QURMIExpZnQgU2VydmljZXMgTGltaXRlZEBBdWRpdFRlYW0" }, { "date": "2026-10-23", "name": "Zena Office", "country": "IT", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/WmVuYSBPZmZpY2VAQXVkaXRUZWFt" }, { "date": "2026-10-23", "name": "Ca***ka", "country": "ES", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Q2EqKiprYUBBdWRpdFRlYW0" }, { "date": "2026-10-13", "name": "Admirals Trading", "country": "AE", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/QWRtaXJhbHMgVHJhZGluZ0BBdWRpdFRlYW0" }, { "date": "2026-10-13", "name": "AD***ed", "country": "GB", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/QUQqKiplZEBBdWRpdFRlYW0" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "majinahanashi", "group": "majinahanashi", "name": "Majinahanashi", "note": null, "attck": [], "activity": { "postings": 50, "first": "2026-08-12", "last": "2026-10-31", "countries": { "IE": 1, "US": 3, "IT": 7, "??": 11, "GB": 4, "CO": 3, "IN": 3, "FR": 2, "PT": 2, "DE": 2, "CH": 2, "LT": 2, "PL": 1, "CL": 2, "TR": 1, "MY": 2, "ES": 1, "TH": 1 }, "sectors": { "services": 1, "manufacturing": 10, "energy": 3, "consumer": 12, "agriculture": 3, "unknown": 17, "healthcare": 2, "technology": 2 }, "recent": [ { "date": "2026-10-31", "name": "Jons Civil Engineering Company Ltd. (JCEL)", "country": "IE", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/Sm9ucyBDaXZpbCBFbmdpbmVlcmluZyBDb21wYW55IEx0ZC4gKEpDRUwpQE1hamluYWhhbmFzaGk" }, { "date": "2026-10-26", "name": "Bi-silque", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/Qmktc2lscXVlQE1hamluYWhhbmFzaGk" }, { "date": "2026-10-24", "name": "Albertin Alcide e Figli S.n.c.", "country": "IT", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/QWxiZXJ0aW4gQWxjaWRlIGUgRmlnbGkgUy5uLmMuQE1hamluYWhhbmFzaGk" }, { "date": "2026-10-24", "name": "SA BAUFER V.F", "country": "??", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/U0EgQkFVRkVSIFYuRkBNYWppbmFoYW5hc2hp" }, { "date": "2026-10-24", "name": "Tema Energy S.r.l.", "country": "IT", "sectors": [ "energy" ], "url": "https://www.ransomware.live/id/VGVtYSBFbmVyZ3kgUy5yLmwuQE1hamluYWhhbmFzaGk" }, { "date": "2026-10-24", "name": "CFG SERRAMENTI S.r.l.", "country": "IT", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/Q0ZHIFNFUlJBTUVOVEkgUy5yLmwuQE1hamluYWhhbmFzaGk" }, { "date": "2026-10-24", "name": "i2r Packaging Solutions Limited", "country": "GB", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/aTJyIFBhY2thZ2luZyBTb2x1dGlvbnMgTGltaXRlZEBNYWppbmFoYW5hc2hp" }, { "date": "2026-10-24", "name": "Asia Market Ltd", "country": "??", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/QXNpYSBNYXJrZXQgTHRkQE1hamluYWhhbmFzaGk" }, { "date": "2026-10-17", "name": "Robert Hitchins Limited", "country": "GB", "sectors": [ "agriculture" ], "url": "https://www.ransomware.live/id/Um9iZXJ0IEhpdGNoaW5zIExpbWl0ZWRATWFqaW5haGFuYXNoaQ" }, { "date": "2026-10-10", "name": "PIO PIO", "country": "CO", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/UElPIFBJT0BNYWppbmFoYW5hc2hp" }, { "date": "2026-10-10", "name": "BONJOUR GROUP", "country": "IN", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Qk9OSk9VUiBHUk9VUEBNYWppbmFoYW5hc2hp" }, { "date": "2026-10-10", "name": "KT RESTAURANT", "country": "??", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/S1QgUkVTVEFVUkFOVEBNYWppbmFoYW5hc2hp" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "clop", "group": "clop", "name": "Cl0p", "note": null, "attck": [ { "id": "S0611", "name": "Clop", "kind": "malware", "url": "https://attack.mitre.org/software/S0611" } ], "activity": { "postings": 48, "first": "2026-08-12", "last": "2026-10-21", "countries": { "US": 23, "GB": 2, "MX": 2, "ES": 1, "SK": 1, "IT": 3, "IN": 4, "AU": 1, "HU": 1, "KZ": 1, "PE": 1, "CN": 1, "FI": 1, "CH": 1, "TW": 1, "IR": 1, "CA": 1, "NL": 1, "??": 1 }, "sectors": { "services": 3, "manufacturing": 7, "technology": 11, "unknown": 9, "agriculture": 1, "government": 1, "transportation": 1, "consumer": 10, "finance": 2, "education": 1, "healthcare": 2 }, "recent": [ { "date": "2026-10-21", "name": "LEGAL-RECORDS.US", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/TEVHQUwtUkVDT1JEUy5VU0BjbG9w" }, { "date": "2026-09-10", "name": "HENRYPRATT.COM", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/SEVOUllQUkFUVC5DT01AY2xvcA==" }, { "date": "2026-09-10", "name": "HARLEY-DAVIDSON.COM", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/SEFSTEVZLURBVklEU09OLkNPTUBjbG9w" }, { "date": "2026-08-14", "name": "ZEBRA.COM", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/WkVCUkEuQ09NQGNsb3A=" }, { "date": "2026-08-12", "name": "AOL.COM", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/QU9MLkNPTUBjbG9w" }, { "date": "2026-08-12", "name": "GATE7LLC.COMGBBEV.COM", "country": "GB", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/R0FURTdMTEMuQ09NR0JCRVYuQ09NQGNsb3A=" }, { "date": "2026-08-12", "name": "ENTERATEK.MXESBERBEVERAGE.COM", "country": "MX", "sectors": [ "agriculture" ], "url": "https://www.ransomware.live/id/RU5URVJBVEVLLk1YRVNCRVJCRVZFUkFHRS5DT01AY2xvcA==" }, { "date": "2026-08-12", "name": "NUVITIA.COM", "country": "ES", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/TlVWSVRJQS5DT01AY2xvcA==" }, { "date": "2026-08-12", "name": "IPMSOLUTIONS.SK", "country": "SK", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/SVBNU09MVVRJT05TLlNLQGNsb3A=" }, { "date": "2026-08-12", "name": "ECCELLENT.COM", "country": "IT", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/RUNDRUxMRU5ULkNPTUBjbG9w" }, { "date": "2026-08-12", "name": "STNET.IT", "country": "IT", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/U1RORVQuSVRAY2xvcA==" }, { "date": "2026-08-12", "name": "QCPL.IN", "country": "IN", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/UUNQTC5JTkBjbG9w" } ] }, "convergences": [], "reports": [ { "url": "https://unit42.paloaltonetworks.com/unwrapping-retail-cyber-threats/", "publisher": "Unit 42", "published": "2026-10-28", "title": "Unwrapping Retail Peak Season Cyber Threats", "origin": "feed", "primary": false }, { "url": "https://asec.ahnlab.com/en/95764/", "publisher": "AhnLab ASEC", "published": "2026-10-11", "title": "September 2026 Dark Web Breach Incident Trend Report", "origin": "feed", "primary": false }, { "url": "https://asec.ahnlab.com/en/95949/", "publisher": "AhnLab ASEC", "published": "2026-10-11", "title": "September 2026 Threat Trend Report on Ransomware", "origin": "feed", "primary": false }, { "url": "https://www.guidepointsecurity.com/blog/ransomware-insights-q3-2026/", "publisher": "GuidePoint GRIT", "published": "2026-10-08", "title": "GRIT Q3 2026 Ransomware and Cyber Threat Insights Report: Top Takeaways", "origin": "feed", "primary": false }, { "url": "https://www.intel471.com/blog/follow-the-money-the-financial-sectors-threat-landscape-in-2026", "publisher": "Intel 471", "published": "2026-09-10", "title": "Follow the Money: The Financial Sector's Threat Landscape in 2026", "origin": "feed", "primary": false }, { "url": "https://www.recordedfuture.com/blog/mexico-cybersecurity-plan", "publisher": "Recorded Future Insikt", "published": "2026-08-25", "title": "Mexico’s Cybersecurity Plan 2025-2030: Turning Ambition Into Defense", "origin": "feed", "primary": false }, { "url": "https://www.recordedfuture.com/blog/july-2026-cve-landscape", "publisher": "Recorded Future Insikt", "published": "2026-08-07", "title": "July 2026 CVE Landscape", "origin": "feed", "primary": false } ], "techniques": [ { "id": "T1027.002", "name": "Software Packing", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 1, "related": 94 }, { "id": "T1057", "name": "Process Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 8, "related": 0 }, { "id": "T1059.003", "name": "Windows Command Shell", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 46, "related": 94 }, { "id": "T1083", "name": "File and Directory Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 24, "related": 0 }, { "id": "T1106", "name": "Native API", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 14, "related": 0 }, { "id": "T1112", "name": "Modify Registry", "tactics": [ "defense-impairment", "persistence" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 94, "related": 0 }, { "id": "T1135", "name": "Network Share Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 7, "related": 0 }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 18, "related": 0 }, { "id": "T1218.007", "name": "Msiexec", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 10, "related": 153 }, { "id": "T1486", "name": "Data Encrypted for Impact", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 16, "related": 0 }, { "id": "T1489", "name": "Service Stop", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 20, "related": 0 }, { "id": "T1490", "name": "Inhibit System Recovery", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 27, "related": 0 }, { "id": "T1497.003", "name": "Time Based Checks", "tactics": [ "stealth", "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1518.001", "name": "Security Software Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 8, "related": 4 }, { "id": "T1553.002", "name": "Code Signing", "tactics": [ "defense-impairment" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 1, "related": 4 }, { "id": "T1614.001", "name": "System Language Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 2, "related": 0 }, { "id": "T1685", "name": "Disable or Modify Tools", "tactics": [ "defense-impairment" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 162, "related": 44 } ], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 17, "defendable": 17, "covered": 16, "uncovered": [ "T1497.003" ] } }, { "slug": "play", "group": "play", "name": "Play", "note": null, "attck": [ { "id": "G1040", "name": "Play", "kind": "intrusion-set", "url": "https://attack.mitre.org/groups/G1040" }, { "id": "S1162", "name": "Playcrypt", "kind": "malware", "url": "https://attack.mitre.org/software/S1162" } ], "activity": { "postings": 48, "first": "2026-08-17", "last": "2026-11-04", "countries": { "AR": 1, "US": 24, "CA": 5, "??": 5, "DK": 1, "BE": 1, "HK": 1, "DE": 4, "GB": 1, "MN": 1, "BR": 1, "IE": 1, "RS": 1, "LV": 1 }, "sectors": { "manufacturing": 12, "finance": 5, "technology": 10, "transportation": 1, "consumer": 4, "services": 5, "healthcare": 2, "unknown": 5, "agriculture": 3, "energy": 1 }, "recent": [ { "date": "2026-11-04", "name": "Aripack", "country": "AR", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/QXJpcGFja0BwbGF5" }, { "date": "2026-11-04", "name": "StrucSure Home Warranty", "country": "US", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/U3RydWNTdXJlIEhvbWUgV2FycmFudHlAcGxheQ" }, { "date": "2026-11-04", "name": "Standard Sand & Silica", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/U3RhbmRhcmQgU2FuZCAmIFNpbGljYUBwbGF5" }, { "date": "2026-11-04", "name": "Misura", "country": "CA", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/TWlzdXJhQHBsYXk" }, { "date": "2026-11-04", "name": "AVIR", "country": "??", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/QVZJUkBwbGF5" }, { "date": "2026-10-27", "name": "Tailormade Logistics", "country": "DK", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/VGFpbG9ybWFkZSBMb2dpc3RpY3NAcGxheQ" }, { "date": "2026-10-27", "name": "Coast 2 Coast", "country": "US", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/Q29hc3QgMiBDb2FzdEBwbGF5" }, { "date": "2026-10-27", "name": "VPC Builders", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/VlBDIEJ1aWxkZXJzQHBsYXk" }, { "date": "2026-10-27", "name": "Hygiena", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/SHlnaWVuYUBwbGF5" }, { "date": "2026-10-27", "name": "Money Concepts Capital", "country": "US", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/TW9uZXkgQ29uY2VwdHMgQ2FwaXRhbEBwbGF5" }, { "date": "2026-10-27", "name": "MicroSearch", "country": "??", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/TWljcm9TZWFyY2hAcGxheQ" }, { "date": "2026-10-27", "name": "QLC", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/UUxDQHBsYXk" } ] }, "convergences": [], "reports": [ { "url": "https://www.intel471.com/blog/a-new-era-of-bulletproof-hosting-providers-emerge", "publisher": "Intel 471", "published": "2026-08-19", "title": "A New Era of Bulletproof Hosting Providers Emerge", "origin": "feed", "primary": false } ], "techniques": [ { "id": "T1003.001", "name": "LSASS Memory", "tactics": [ "credential-access" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 79, "related": 36 }, { "id": "T1016", "name": "System Network Configuration Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 11, "related": 0 }, { "id": "T1018", "name": "Remote System Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 17, "related": 0 }, { "id": "T1021.002", "name": "SMB/Windows Admin Shares", "tactics": [ "lateral-movement" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 38, "related": 10 }, { "id": "T1027.010", "name": "Command Obfuscation", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 10, "related": 94 }, { "id": "T1030", "name": "Data Transfer Size Limits", "tactics": [ "exfiltration" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 2, "related": 0 }, { "id": "T1048", "name": "Exfiltration Over Alternative Protocol", "tactics": [ "exfiltration" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 12, "related": 10 }, { "id": "T1057", "name": "Process Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 8, "related": 0 }, { "id": "T1059.001", "name": "PowerShell", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 220, "related": 94 }, { "id": "T1059.003", "name": "Windows Command Shell", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 46, "related": 94 }, { "id": "T1070.004", "name": "File Deletion", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 15, "related": 20 }, { "id": "T1078", "name": "Valid Accounts", "tactics": [ "stealth", "persistence", "privilege-escalation", "initial-access" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 55, "related": 54 }, { "id": "T1078.002", "name": "Domain Accounts", "tactics": [ "stealth", "persistence", "privilege-escalation", "initial-access" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 5, "related": 55 }, { "id": "T1078.003", "name": "Local Accounts", "tactics": [ "stealth", "persistence", "privilege-escalation", "initial-access" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 5, "related": 55 }, { "id": "T1082", "name": "System Information Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 33, "related": 0 }, { "id": "T1083", "name": "File and Directory Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 24, "related": 0 }, { "id": "T1105", "name": "Ingress Tool Transfer", "tactics": [ "command-and-control" ], "sources": [ "attck" ], "structural": false, "own": [ "t1204-004-clickfix-run-dialog-execution" ], "community": 87, "related": 0 }, { "id": "T1133", "name": "External Remote Services", "tactics": [ "persistence", "initial-access" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 20, "related": 0 }, { "id": "T1190", "name": "Exploit Public-Facing Application", "tactics": [ "initial-access" ], "sources": [ "attck" ], "structural": false, "own": [ "t1190-peoplesoft-psemhub-encoded-path-exploitation" ], "community": 147, "related": 0 }, { "id": "T1486", "name": "Data Encrypted for Impact", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 16, "related": 0 }, { "id": "T1490", "name": "Inhibit System Recovery", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 27, "related": 0 }, { "id": "T1518.001", "name": "Security Software Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 8, "related": 4 }, { "id": "T1560.001", "name": "Archive via Utility", "tactics": [ "collection" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 17, "related": 4 }, { "id": "T1587.001", "name": "Malware", "tactics": [ "resource-development" ], "sources": [ "attck" ], "structural": true, "own": [], "community": 11, "related": 6 }, { "id": "T1588.002", "name": "Tool", "tactics": [ "resource-development" ], "sources": [ "attck" ], "structural": true, "own": [], "community": 9, "related": 2 }, { "id": "T1657", "name": "Financial Theft", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1685", "name": "Disable or Modify Tools", "tactics": [ "defense-impairment" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 162, "related": 44 }, { "id": "T1685.005", "name": "Clear Windows Event Logs", "tactics": [ "defense-impairment" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 8, "related": 162 } ], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 28, "defendable": 26, "covered": 25, "uncovered": [ "T1657" ] } }, { "slug": "booba-project", "group": "booba project", "name": "Booba Project", "note": null, "attck": [], "activity": { "postings": 47, "first": "2026-08-24", "last": "2026-11-03", "countries": { "GB": 2, "SE": 1, "US": 32, "FR": 1, "CA": 3, "BE": 1, "PK": 1, "BR": 1, "IT": 1, "??": 1, "MD": 1, "RU": 1, "MX": 1 }, "sectors": { "unknown": 4, "healthcare": 16, "government": 11, "manufacturing": 1, "finance": 2, "education": 8, "services": 3, "consumer": 1, "technology": 1, "insurance": 1 }, "recent": [ { "date": "2026-11-03", "name": "Boardman Park", "country": "GB", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Qm9hcmRtYW4gUGFya0BCb29iYSBQcm9qZWN0" }, { "date": "2026-11-03", "name": "Vetstoria", "country": "SE", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/VmV0c3RvcmlhQEJvb2JhIFByb2plY3Q" }, { "date": "2026-11-03", "name": "City of Edgewater", "country": "US", "sectors": [ "government" ], "url": "https://www.ransomware.live/id/Q2l0eSBvZiBFZGdld2F0ZXJAQm9vYmEgUHJvamVjdA" }, { "date": "2026-11-03", "name": "DROUIN SAS", "country": "FR", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/RFJPVUlOIFNBU0BCb29iYSBQcm9qZWN0" }, { "date": "2026-10-29", "name": "LifeFone", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/TGlmZUZvbmVAQm9vYmEgUHJvamVjdA" }, { "date": "2026-10-29", "name": "National Association of Credit Management", "country": "US", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/TmF0aW9uYWwgQXNzb2NpYXRpb24gb2YgQ3JlZGl0IE1hbmFnZW1lbnRAQm9vYmEgUHJvamVjdA" }, { "date": "2026-10-29", "name": "California School Boards Association", "country": "US", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/Q2FsaWZvcm5pYSBTY2hvb2wgQm9hcmRzIEFzc29jaWF0aW9uQEJvb2JhIFByb2plY3Q" }, { "date": "2026-10-29", "name": "South Weber City", "country": "US", "sectors": [ "government" ], "url": "https://www.ransomware.live/id/U291dGggV2ViZXIgQ2l0eUBCb29iYSBQcm9qZWN0" }, { "date": "2026-10-29", "name": "Programs for Parents, Inc.", "country": "US", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/UHJvZ3JhbXMgZm9yIFBhcmVudHMsIEluYy5AQm9vYmEgUHJvamVjdA" }, { "date": "2026-10-29", "name": "Circleville Police Department", "country": "US", "sectors": [ "government" ], "url": "https://www.ransomware.live/id/Q2lyY2xldmlsbGUgUG9saWNlIERlcGFydG1lbnRAQm9vYmEgUHJvamVjdA" }, { "date": "2026-10-29", "name": "Terrebonne Parish Government", "country": "US", "sectors": [ "government" ], "url": "https://www.ransomware.live/id/VGVycmVib25uZSBQYXJpc2ggR292ZXJubWVudEBCb29iYSBQcm9qZWN0" }, { "date": "2026-10-27", "name": "RCOA- Regent Christian Online Academy", "country": "CA", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/UkNPQS0gUmVnZW50IENocmlzdGlhbiBPbmxpbmUgQWNhZGVteUBCb29iYSBQcm9qZWN0" } ] }, "convergences": [ { "name": "BASS Medical Group", "flagged": "2026-10-28", "classes": [ "leak", "notice" ], "curated": false, "hand_picked": false } ], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "wallstreet", "group": "wallstreet", "name": "Wallstreet", "note": null, "attck": [], "activity": { "postings": 43, "first": "2026-08-10", "last": "2026-10-30", "countries": { "US": 24, "GB": 3, "SE": 10, "DE": 1, "SA": 2, "DK": 1, "SV": 1, "IR": 1 }, "sectors": { "healthcare": 10, "manufacturing": 7, "government": 1, "insurance": 1, "education": 5, "transportation": 1, "services": 6, "unknown": 8, "finance": 1, "energy": 2, "consumer": 1, "technology": 1 }, "recent": [ { "date": "2026-10-30", "name": "Suburban Orthopaedics", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/U3VidXJiYW4gT3J0aG9wYWVkaWNzQFdhbGxzdHJlZXQ" }, { "date": "2026-10-28", "name": "Fortrex", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/Rm9ydHJleEBXYWxsc3RyZWV0" }, { "date": "2026-10-27", "name": "Bristol City Council", "country": "GB", "sectors": [ "government" ], "url": "https://www.ransomware.live/id/QnJpc3RvbCBDaXR5IENvdW5jaWxAV2FsbHN0cmVldA" }, { "date": "2026-10-23", "name": "Prism Medical Products", "country": "US", "sectors": [ "healthcare", "insurance" ], "url": "https://www.ransomware.live/id/UHJpc20gTWVkaWNhbCBQcm9kdWN0c0BXYWxsc3RyZWV0" }, { "date": "2026-10-16", "name": "Girl Scouts of Eastern Massachusetts", "country": "US", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/R2lybCBTY291dHMgb2YgRWFzdGVybiBNYXNzYWNodXNldHRzQFdhbGxzdHJlZXQ" }, { "date": "2026-10-15", "name": "TGM Manufacturing, Inc", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/VEdNIE1hbnVmYWN0dXJpbmcsIEluY0BXYWxsc3RyZWV0" }, { "date": "2026-10-14", "name": "E-Z Pack Trucks", "country": "US", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/RS1aIFBhY2sgVHJ1Y2tzQFdhbGxzdHJlZXQ" }, { "date": "2026-10-14", "name": "Green Clinic", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/R3JlZW4gQ2xpbmljQFdhbGxzdHJlZXQ" }, { "date": "2026-10-13", "name": "Ahlqvist & Almqvist Arkitekter AB", "country": "SE", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/QWhscXZpc3QgJiBBbG1xdmlzdCBBcmtpdGVrdGVyIEFCQFdhbGxzdHJlZXQ" }, { "date": "2026-10-13", "name": "Englunds Konsultbyrå AB", "country": "SE", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/RW5nbHVuZHMgS29uc3VsdGJ5csOlIEFCQFdhbGxzdHJlZXQ" }, { "date": "2026-10-13", "name": "Spectrum Arkitekter AB", "country": "SE", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/U3BlY3RydW0gQXJraXRla3RlciBBQkBXYWxsc3RyZWV0" }, { "date": "2026-10-13", "name": "Vendus Sweden AB", "country": "SE", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/VmVuZHVzIFN3ZWRlbiBBQkBXYWxsc3RyZWV0" } ] }, "convergences": [ { "name": "Goldston Oil Corporation", "flagged": "2026-10-03", "classes": [ "leak", "notice" ], "curated": false, "hand_picked": false }, { "name": "Baraga County Memorial Hospital", "flagged": "2026-08-22", "classes": [ "leak", "notice" ], "curated": false, "hand_picked": false } ], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "rhysida", "group": "rhysida", "name": "rhysida", "note": null, "attck": [], "activity": { "postings": 43, "first": "2026-08-13", "last": "2026-11-07", "countries": { "CH": 1, "US": 14, "??": 13, "MX": 1, "MY": 2, "BE": 1, "DE": 5, "VN": 1, "SE": 1, "PH": 1, "FR": 1, "HU": 1, "AU": 1 }, "sectors": { "finance": 4, "unknown": 8, "services": 11, "insurance": 1, "education": 3, "manufacturing": 3, "energy": 3, "government": 2, "technology": 2, "healthcare": 5, "consumer": 2 }, "recent": [ { "date": "2026-11-07", "name": "Treuhand & Immobilien Abt AG", "country": "CH", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/VHJldWhhbmQgJiBJbW1vYmlsaWVuIEFidCBBR0ByaHlzaWRh" }, { "date": "2026-11-04", "name": "El Cajon, CA", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/RWwgQ2Fqb24sIENBQHJoeXNpZGE" }, { "date": "2026-11-04", "name": "Juge, Napolitano, Ruli, Putfark & Pittman", "country": "??", "sectors": [ "services", "insurance" ], "url": "https://www.ransomware.live/id/SnVnZSwgTmFwb2xpdGFubywgUnVsaSwgUHV0ZmFyayAmIFBpdHRtYW5Acmh5c2lkYQ" }, { "date": "2026-11-03", "name": "Here at Pope and Johnson County Title Company", "country": "??", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/SGVyZSBhdCBQb3BlIGFuZCBKb2huc29uIENvdW50eSBUaXRsZSBDb21wYW55QHJoeXNpZGE" }, { "date": "2026-10-31", "name": "Phoenix Charter Academy", "country": "US", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/UGhvZW5peCBDaGFydGVyIEFjYWRlbXlAcmh5c2lkYQ" }, { "date": "2026-10-30", "name": "Cipsa Industrias Sa De Cv", "country": "MX", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/Q2lwc2EgSW5kdXN0cmlhcyBTYSBEZSBDdkByaHlzaWRh" }, { "date": "2026-10-30", "name": "INTI International University & Colleges", "country": "MY", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/SU5USSBJbnRlcm5hdGlvbmFsIFVuaXZlcnNpdHkgJiBDb2xsZWdlc0ByaHlzaWRh" }, { "date": "2026-10-29", "name": "INTAX, Inc.", "country": "??", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/SU5UQVgsIEluYy5Acmh5c2lkYQ" }, { "date": "2026-10-29", "name": "ClaimTek Systems", "country": "??", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/Q2xhaW1UZWsgU3lzdGVtc0ByaHlzaWRh" }, { "date": "2026-10-28", "name": "Noelker and Hull", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/Tm9lbGtlciBhbmQgSHVsbEByaHlzaWRh" }, { "date": "2026-10-27", "name": "Machelen (Belgium)", "country": "BE", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/TWFjaGVsZW4gKEJlbGdpdW0pQHJoeXNpZGE" }, { "date": "2026-10-26", "name": "MISC Group", "country": "MY", "sectors": [ "energy" ], "url": "https://www.ransomware.live/id/TUlTQyBHcm91cEByaHlzaWRh" } ] }, "convergences": [ { "name": "The Lawson Roofing Co Inc.", "flagged": "2026-07-23", "classes": [ "leak", "notice" ], "curated": false, "hand_picked": false } ], "reports": [ { "url": "https://www.sophos.com/en-us/blog/terminalfix-and-lorem-ipsum-loader-enable-covert-tunneling", "publisher": "Sophos X-Ops", "published": "2026-09-30", "title": "TerminalFix and Lorem Ipsum Loader enable covert tunneling", "origin": "feed", "primary": false } ], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "everest", "group": "everest", "name": "Everest", "note": null, "attck": [], "activity": { "postings": 43, "first": "2026-08-17", "last": "2026-10-27", "countries": { "??": 15, "SG": 1, "IT": 3, "GB": 1, "US": 4, "DE": 2, "JP": 3, "KR": 1, "AT": 1, "NO": 1, "NL": 1, "AE": 1, "SE": 1, "ZA": 1, "BE": 1, "TW": 1, "PE": 1, "FR": 2, "ES": 1, "CA": 1 }, "sectors": { "technology": 11, "services": 10, "energy": 1, "manufacturing": 7, "healthcare": 5, "unknown": 4, "transportation": 2, "agriculture": 1, "education": 1, "finance": 1 }, "recent": [ { "date": "2026-10-27", "name": "OR Technology", "country": "??", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/T1IgVGVjaG5vbG9neUBldmVyZXN0" }, { "date": "2026-10-27", "name": "Burris & MacOmber", "country": "??", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/QnVycmlzICYgTWFjT21iZXJAZXZlcmVzdA" }, { "date": "2026-10-27", "name": "Energy Storage Terminal in Singapore", "country": "SG", "sectors": [ "energy" ], "url": "https://www.ransomware.live/id/RW5lcmd5IFN0b3JhZ2UgVGVybWluYWwgaW4gU2luZ2Fwb3JlQGV2ZXJlc3Q" }, { "date": "2026-10-27", "name": "Point Robotics", "country": "??", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/UG9pbnQgUm9ib3RpY3NAZXZlcmVzdA" }, { "date": "2026-10-27", "name": "Natuzzi", "country": "IT", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/TmF0dXp6aUBldmVyZXN0" }, { "date": "2026-10-27", "name": "TECNA ICE", "country": "IT", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/VEVDTkEgSUNFQGV2ZXJlc3Q" }, { "date": "2026-10-27", "name": "MediSolution", "country": "??", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/TWVkaVNvbHV0aW9uQGV2ZXJlc3Q" }, { "date": "2026-10-27", "name": "SleepEx LabRetriever", "country": "??", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/U2xlZXBFeCBMYWJSZXRyaWV2ZXJAZXZlcmVzdA" }, { "date": "2026-10-22", "name": "PWC", "country": "GB", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/UFdDQGV2ZXJlc3Q" }, { "date": "2026-10-22", "name": "Linebarger Goggan Blair & Sampson", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/TGluZWJhcmdlciBHb2dnYW4gQmxhaXIgJiBTYW1wc29uQGV2ZXJlc3Q" }, { "date": "2026-10-21", "name": "PLD Group", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/UExEIEdyb3VwQGV2ZXJlc3Q" }, { "date": "2026-10-21", "name": "Lindauer Dornier", "country": "DE", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/TGluZGF1ZXIgRG9ybmllckBldmVyZXN0" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "medusalocker", "group": "medusalocker", "name": "medusalocker", "note": null, "attck": [], "activity": { "postings": 43, "first": "2026-08-16", "last": "2026-11-04", "countries": { "US": 4, "CO": 1, "??": 11, "IN": 3, "GB": 2, "CA": 2, "CH": 2, "BR": 2, "ZA": 2, "BD": 1, "ES": 2, "FR": 2, "CZ": 1, "BG": 1, "CN": 1, "AE": 1, "TH": 1, "MX": 1, "GH": 1, "AU": 1, "DE": 1 }, "sectors": { "technology": 7, "unknown": 13, "manufacturing": 8, "services": 2, "education": 1, "consumer": 4, "transportation": 2, "finance": 1, "government": 1, "agriculture": 2, "energy": 1, "healthcare": 1 }, "recent": [ { "date": "2026-11-04", "name": "Msn", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/TXNuQG1lZHVzYWxvY2tlcg" }, { "date": "2026-11-04", "name": "Dian", "country": "CO", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/RGlhbkBtZWR1c2Fsb2NrZXI" }, { "date": "2026-11-04", "name": "baiapai", "country": "??", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/YmFpYXBhaUBtZWR1c2Fsb2NrZXI" }, { "date": "2026-11-04", "name": "Vinitgloves", "country": "IN", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/VmluaXRnbG92ZXNAbWVkdXNhbG9ja2Vy" }, { "date": "2026-11-04", "name": "Jatl", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/SmF0bEBtZWR1c2Fsb2NrZXI" }, { "date": "2026-11-04", "name": "Geetees", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/R2VldGVlc0BtZWR1c2Fsb2NrZXI" }, { "date": "2026-11-04", "name": "Ruixiang Jidian", "country": "??", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/UnVpeGlhbmcgSmlkaWFuQG1lZHVzYWxvY2tlcg" }, { "date": "2026-11-04", "name": "Kde", "country": "??", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/S2RlQG1lZHVzYWxvY2tlcg" }, { "date": "2026-11-04", "name": "Jobmongers", "country": "GB", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/Sm9ibW9uZ2Vyc0BtZWR1c2Fsb2NrZXI" }, { "date": "2026-11-04", "name": "baeaqab", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/YmFlYXFhYkBtZWR1c2Fsb2NrZXI" }, { "date": "2026-11-04", "name": "Ulaval", "country": "CA", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/VWxhdmFsQG1lZHVzYWxvY2tlcg" }, { "date": "2026-11-04", "name": "On", "country": "CH", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/T25AbWVkdXNhbG9ja2Vy" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "panzer", "group": "panzer", "name": "Panzer", "note": null, "attck": [], "activity": { "postings": 43, "first": "2026-08-10", "last": "2026-10-28", "countries": { "IT": 3, "BJ": 1, "PK": 1, "FR": 4, "??": 11, "SG": 1, "DE": 5, "US": 1, "BR": 3, "PY": 1, "PE": 1, "BG": 1, "ES": 2, "SA": 1, "ID": 2, "PT": 1, "RS": 1, "KR": 1, "CZ": 1, "TH": 1 }, "sectors": { "services": 8, "healthcare": 2, "energy": 1, "technology": 7, "education": 3, "manufacturing": 7, "unknown": 6, "government": 5, "agriculture": 3, "finance": 1 }, "recent": [ { "date": "2026-10-28", "name": "PQE Group", "country": "IT", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/UFFFIEdyb3VwQFBhbnplcg" }, { "date": "2026-10-25", "name": "Yodingenierie", "country": "BJ", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/WW9kaW5nZW5pZXJpZUBQYW56ZXI" }, { "date": "2026-10-24", "name": "Family Planning Association of Pakistan", "country": "PK", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/RmFtaWx5IFBsYW5uaW5nIEFzc29jaWF0aW9uIG9mIFBha2lzdGFuQFBhbnplcg" }, { "date": "2026-10-13", "name": "Valode & Pistre", "country": "FR", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/VmFsb2RlICYgUGlzdHJlQFBhbnplcg" }, { "date": "2026-10-13", "name": "Zenidoc", "country": "??", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/WmVuaWRvY0BQYW56ZXI" }, { "date": "2026-10-09", "name": "Supreme Energy", "country": "SG", "sectors": [ "energy" ], "url": "https://www.ransomware.live/id/U3VwcmVtZSBFbmVyZ3lAUGFuemVy" }, { "date": "2026-10-09", "name": "solutend", "country": "??", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/c29sdXRlbmRAUGFuemVy" }, { "date": "2026-10-07", "name": "University of Rostock", "country": "DE", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/VW5pdmVyc2l0eSBvZiBSb3N0b2NrQFBhbnplcg" }, { "date": "2026-10-06", "name": "EDFelectronics", "country": "??", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/RURGZWxlY3Ryb25pY3NAUGFuemVy" }, { "date": "2026-10-06", "name": "SweetRush", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/U3dlZXRSdXNoQFBhbnplcg" }, { "date": "2026-10-02", "name": "Paessolucoes", "country": "BR", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/UGFlc3NvbHVjb2VzQFBhbnplcg" }, { "date": "2026-10-02", "name": "Paessolucoes", "country": "BR", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/UGFlc3NvbHVjb2VzQFBhbnplcg==" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "braincipher", "group": "braincipher", "name": "Brain Cipher", "note": null, "attck": [], "activity": { "postings": 41, "first": "2026-08-31", "last": "2026-11-06", "countries": { "DE": 3, "CA": 3, "US": 20, "??": 4, "GB": 3, "IE": 1, "AR": 1, "BR": 1, "BG": 1, "ES": 2, "NL": 1, "AE": 1 }, "sectors": { "manufacturing": 2, "finance": 5, "healthcare": 7, "services": 10, "agriculture": 1, "technology": 5, "unknown": 10, "transportation": 1 }, "recent": [ { "date": "2026-11-06", "name": "Mutares.com", "country": "DE", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/TXV0YXJlcy5jb21AQnJhaW5DaXBoZXI" }, { "date": "2026-11-04", "name": "fbc.ca", "country": "CA", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/ZmJjLmNhQEJyYWluQ2lwaGVy" }, { "date": "2026-11-04", "name": "hamiltonhealthcenter.com", "country": "CA", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/aGFtaWx0b25oZWFsdGhjZW50ZXIuY29tQEJyYWluQ2lwaGVy" }, { "date": "2026-11-04", "name": "hhjcpa.com", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/aGhqY3BhLmNvbUBCcmFpbkNpcGhlcg" }, { "date": "2026-11-04", "name": "prairieridge.net", "country": "US", "sectors": [ "agriculture" ], "url": "https://www.ransomware.live/id/cHJhaXJpZXJpZGdlLm5ldEBCcmFpbkNpcGhlcg" }, { "date": "2026-11-04", "name": "ciscocems.com", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/Y2lzY29jZW1zLmNvbUBCcmFpbkNpcGhlcg" }, { "date": "2026-11-04", "name": "parkell.com", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/cGFya2VsbC5jb21AQnJhaW5DaXBoZXI" }, { "date": "2026-11-04", "name": "tritonclaims.com", "country": "US", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/dHJpdG9uY2xhaW1zLmNvbUBCcmFpbkNpcGhlcg" }, { "date": "2026-11-04", "name": "cadorath.com", "country": "DE", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Y2Fkb3JhdGguY29tQEJyYWluQ2lwaGVy" }, { "date": "2026-11-04", "name": "spearcenter.com", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/c3BlYXJjZW50ZXIuY29tQEJyYWluQ2lwaGVy" }, { "date": "2026-11-04", "name": "myronl.com", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/bXlyb25sLmNvbUBCcmFpbkNpcGhlcg" }, { "date": "2026-11-04", "name": "megastarfinancial.com", "country": "??", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/bWVnYXN0YXJmaW5hbmNpYWwuY29tQEJyYWluQ2lwaGVy" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "dragonforce", "group": "dragonforce", "name": "DragonForce", "note": null, "attck": [], "activity": { "postings": 30, "first": "2026-08-11", "last": "2026-10-27", "countries": { "UA": 1, "US": 11, "CA": 2, "PE": 1, "TW": 2, "BR": 3, "FR": 2, "??": 1, "TH": 1, "AR": 2, "GB": 2, "AE": 1, "PL": 1 }, "sectors": { "technology": 4, "energy": 2, "manufacturing": 6, "education": 1, "consumer": 3, "healthcare": 2, "unknown": 8, "insurance": 1, "services": 2, "finance": 2 }, "recent": [ { "date": "2026-10-27", "name": "Zhito Technology", "country": "UA", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/WmhpdG8gVGVjaG5vbG9neUBkcmFnb25mb3JjZQ" }, { "date": "2026-10-26", "name": "Inside Passage Electric Cooperative, Inc", "country": "US", "sectors": [ "energy" ], "url": "https://www.ransomware.live/id/SW5zaWRlIFBhc3NhZ2UgRWxlY3RyaWMgQ29vcGVyYXRpdmUsIEluY0BkcmFnb25mb3JjZQ" }, { "date": "2026-10-17", "name": "oakgrovetech", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/b2FrZ3JvdmV0ZWNoQGRyYWdvbmZvcmNl" }, { "date": "2026-10-14", "name": "Lane Equipment", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/TGFuZSBFcXVpcG1lbnRAZHJhZ29uZm9yY2U" }, { "date": "2026-10-12", "name": "Canadian Mennonite University (CMU)", "country": "CA", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/Q2FuYWRpYW4gTWVubm9uaXRlIFVuaXZlcnNpdHkgKENNVSlAZHJhZ29uZm9yY2U" }, { "date": "2026-10-11", "name": "TQC S.A.", "country": "PE", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/VFFDIFMuQS5AZHJhZ29uZm9yY2U" }, { "date": "2026-10-10", "name": "TEXMA International Co., Ltd", "country": "TW", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/VEVYTUEgSW50ZXJuYXRpb25hbCBDby4sIEx0ZEBkcmFnb25mb3JjZQ" }, { "date": "2026-10-07", "name": "Petrosul Distribuidora, Transportadora e Comércio de Combustíveis Ltda.", "country": "BR", "sectors": [ "energy" ], "url": "https://www.ransomware.live/id/UGV0cm9zdWwgRGlzdHJpYnVpZG9yYSwgVHJhbnNwb3J0YWRvcmEgZSBDb23DqXJjaW8gZGUgQ29tYnVzdMOtdmVpcyBMdGRhLkBkcmFnb25mb3JjZQ" }, { "date": "2026-10-07", "name": "RÉSO", "country": "FR", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/UsOJU09AZHJhZ29uZm9yY2U" }, { "date": "2026-09-24", "name": "winfashion", "country": "??", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/d2luZmFzaGlvbkBkcmFnb25mb3JjZQ==" }, { "date": "2026-09-24", "name": "Arizona Vascular Medical Equipment, Inc", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/QXJpem9uYSBWYXNjdWxhciBNZWRpY2FsIEVxdWlwbWVudCwgSW5jQGRyYWdvbmZvcmNl" }, { "date": "2026-09-24", "name": "BMGP Groupe", "country": "FR", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Qk1HUCBHcm91cGVAZHJhZ29uZm9yY2U=" } ] }, "convergences": [ { "name": "RUS Industrial, LLC", "flagged": "2026-08-08", "classes": [ "leak", "notice" ], "curated": false, "hand_picked": false } ], "reports": [ { "url": "https://reliaquest.com/blog/psts-industry-defense-gap-is-architectural-what-to-do-about-it/", "publisher": "ReliaQuest", "published": "2026-11-06", "title": "The PSTS Industry’s Defense Gap Is Architectural. Here’s What to Do About It.", "origin": "feed", "primary": false }, { "url": "https://reliaquest.com/blog/threat-spotlight-ransomware-and-cyber-extortion-in-q3-2026/", "publisher": "ReliaQuest", "published": "2026-11-03", "title": "Ransomware and Cyber Extortion in Q3 2026", "origin": "feed", "primary": false }, { "url": "https://flare.io/learn/resources/blog/the-com-ecosystem-actors-attribution", "publisher": "Flare", "published": "2026-10-20", "title": "Arachnophobia: How Fear, Branding, and Bad Attribution Distorted The Com", "origin": "feed", "primary": false }, { "url": "https://asec.ahnlab.com/en/95949/", "publisher": "AhnLab ASEC", "published": "2026-10-11", "title": "September 2026 Threat Trend Report on Ransomware", "origin": "feed", "primary": false }, { "url": "https://flare.io/learn/resources/blog/healthcare-ransomware-attack-surface", "publisher": "Flare", "published": "2026-10-08", "title": "Healthcare Is Cybercrime’s Highest-Value Target: Ransomware, Exposure, and the Expanding Attack Surface", "origin": "feed", "primary": false }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments/", "publisher": "Microsoft Threat Intelligence", "published": "2026-09-24", "title": "Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments", "origin": "feed", "primary": false } ], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "aurora", "group": "aurora", "name": "Aurora", "note": null, "attck": [], "activity": { "postings": 29, "first": "2026-08-11", "last": "2026-10-30", "countries": { "??": 3, "GB": 3, "DE": 4, "IT": 2, "CH": 1, "US": 12, "ES": 1, "DK": 1, "AR": 1, "AT": 1 }, "sectors": { "manufacturing": 9, "unknown": 3, "services": 6, "insurance": 2, "agriculture": 1, "transportation": 3, "consumer": 4, "technology": 2, "healthcare": 1 }, "recent": [ { "date": "2026-10-30", "name": "Rapid Manufacturing", "country": "??", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/UmFwaWQgTWFudWZhY3R1cmluZ0BhdXJvcmE" }, { "date": "2026-10-28", "name": "EWM Group", "country": "GB", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/RVdNIEdyb3VwQGF1cm9yYQ" }, { "date": "2026-10-28", "name": "Meleghy Automotive & Cie. GmbH", "country": "DE", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/TWVsZWdoeSBBdXRvbW90aXZlICYgQ2llLiBHbWJIQGF1cm9yYQ" }, { "date": "2026-10-27", "name": "GreenbergFarrow", "country": "??", "sectors": [ "services", "insurance" ], "url": "https://www.ransomware.live/id/R3JlZW5iZXJnRmFycm93QGF1cm9yYQ" }, { "date": "2026-10-26", "name": "Ernesto Malvestiti S.p.A.", "country": "IT", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/RXJuZXN0byBNYWx2ZXN0aXRpIFMucC5BLkBhdXJvcmE" }, { "date": "2026-10-23", "name": "ARX Group SA", "country": "CH", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/QVJYIEdyb3VwIFNBQGF1cm9yYQ" }, { "date": "2026-10-21", "name": "Allmand-Smith Limited", "country": "GB", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/QWxsbWFuZC1TbWl0aCBMaW1pdGVkQGF1cm9yYQ" }, { "date": "2026-10-20", "name": "Duarte Nursery, Inc.", "country": "US", "sectors": [ "agriculture" ], "url": "https://www.ransomware.live/id/RHVhcnRlIE51cnNlcnksIEluYy5AYXVyb3Jh" }, { "date": "2026-10-19", "name": "POWERsonic Industries Inc.", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/UE9XRVJzb25pYyBJbmR1c3RyaWVzIEluYy5AYXVyb3Jh" }, { "date": "2026-10-16", "name": "Adams Warehouse & Delivery, Inc.", "country": "US", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/QWRhbXMgV2FyZWhvdXNlICYgRGVsaXZlcnksIEluYy5AYXVyb3Jh" }, { "date": "2026-10-14", "name": "Estrategias BigMat S.L.U.", "country": "ES", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/RXN0cmF0ZWdpYXMgQmlnTWF0IFMuTC5VLkBhdXJvcmE" }, { "date": "2026-10-13", "name": "The Buckner Company, Inc.", "country": "US", "sectors": [ "unknown", "insurance" ], "url": "https://www.ransomware.live/id/VGhlIEJ1Y2tuZXIgQ29tcGFueSwgSW5jLkBhdXJvcmE" } ] }, "convergences": [], "reports": [ { "url": "https://www.sophos.com/en-us/blog/ai-used-in-aur0ra-ransomware-testing-and-execution", "publisher": "Sophos X-Ops", "published": "2026-10-29", "title": "AI used in Aur0ra ransomware testing and execution", "origin": "feed", "primary": false } ], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "orova", "group": "orova", "name": "Orova", "note": null, "attck": [], "activity": { "postings": 28, "first": "2026-08-11", "last": "2026-11-03", "countries": { "SG": 5, "MY": 4, "US": 3, "TW": 6, "IN": 4, "HK": 6 }, "sectors": { "technology": 8, "services": 3, "unknown": 7, "manufacturing": 4, "healthcare": 1, "consumer": 4, "energy": 1 }, "recent": [ { "date": "2026-11-03", "name": "Detronics Pte Ltd", "country": "SG", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/RGV0cm9uaWNzIFB0ZSBMdGRAT3JvdmE" }, { "date": "2026-11-03", "name": "Bright Property Service", "country": "MY", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/QnJpZ2h0IFByb3BlcnR5IFNlcnZpY2VAT3JvdmE" }, { "date": "2026-11-03", "name": "Orient Corporation", "country": "SG", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/T3JpZW50IENvcnBvcmF0aW9uQE9yb3Zh" }, { "date": "2026-11-03", "name": "MARDEC Berhad", "country": "MY", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/TUFSREVDIEJlcmhhZEBPcm92YQ" }, { "date": "2026-11-03", "name": "Hydrogel Vision Corporation", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/SHlkcm9nZWwgVmlzaW9uIENvcnBvcmF0aW9uQE9yb3Zh" }, { "date": "2026-11-03", "name": "Raffles United Holdings Pte Ltd", "country": "SG", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/UmFmZmxlcyBVbml0ZWQgSG9sZGluZ3MgUHRlIEx0ZEBPcm92YQ" }, { "date": "2026-11-02", "name": "Harry's International", "country": "SG", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/SGFycnkncyBJbnRlcm5hdGlvbmFsQE9yb3Zh" }, { "date": "2026-10-23", "name": "Wah Chan Consolidated Sdn Bhd", "country": "MY", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/V2FoIENoYW4gQ29uc29saWRhdGVkIFNkbiBCaGRAT3JvdmE" }, { "date": "2026-10-23", "name": "Trevi Technology", "country": "TW", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/VHJldmkgVGVjaG5vbG9neUBPcm92YQ" }, { "date": "2026-10-13", "name": "Durga Bearings", "country": "IN", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/RHVyZ2EgQmVhcmluZ3NAT3JvdmE" }, { "date": "2026-10-13", "name": "Codar (Pte) Ltd", "country": "SG", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/Q29kYXIgKFB0ZSkgTHRkQE9yb3Zh" }, { "date": "2026-10-13", "name": "Alfameli Group", "country": "MY", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/QWxmYW1lbGkgR3JvdXBAT3JvdmE" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "pear", "group": "pear", "name": "Pear", "note": null, "attck": [], "activity": { "postings": 27, "first": "2026-08-20", "last": "2026-11-05", "countries": { "US": 25, "JM": 2 }, "sectors": { "manufacturing": 3, "unknown": 3, "healthcare": 7, "finance": 4, "technology": 4, "agriculture": 2, "insurance": 1, "consumer": 3, "services": 1 }, "recent": [ { "date": "2026-11-05", "name": "Bridgestone HosePower, LLC", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/QnJpZGdlc3RvbmUgSG9zZVBvd2VyLCBMTENAcGVhcg" }, { "date": "2026-11-04", "name": "gWorks", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Z1dvcmtzQHBlYXI" }, { "date": "2026-11-04", "name": "Palm Vascular Centers", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/UGFsbSBWYXNjdWxhciBDZW50ZXJzQHBlYXI" }, { "date": "2026-11-02", "name": "Neiman & Company, Inc.", "country": "US", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/TmVpbWFuICYgQ29tcGFueSwgSW5jLkBwZWFy" }, { "date": "2026-10-28", "name": "Cyrious Software", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/Q3lyaW91cyBTb2Z0d2FyZUBwZWFy" }, { "date": "2026-10-23", "name": "Fresh Farms", "country": "US", "sectors": [ "agriculture" ], "url": "https://www.ransomware.live/id/RnJlc2ggRmFybXNAcGVhcg" }, { "date": "2026-10-21", "name": "Adobe Insurance Brokers, LLC", "country": "US", "sectors": [ "finance", "insurance" ], "url": "https://www.ransomware.live/id/QWRvYmUgSW5zdXJhbmNlIEJyb2tlcnMsIExMQ0BwZWFy" }, { "date": "2026-10-16", "name": "Macfarlan Capital Partners", "country": "US", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/TWFjZmFybGFuIENhcGl0YWwgUGFydG5lcnNAcGVhcg" }, { "date": "2026-10-16", "name": "Solar Communications International", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/U29sYXIgQ29tbXVuaWNhdGlvbnMgSW50ZXJuYXRpb25hbEBwZWFy" }, { "date": "2026-10-16", "name": "Caretaker Landscape and Tree Management", "country": "US", "sectors": [ "agriculture" ], "url": "https://www.ransomware.live/id/Q2FyZXRha2VyIExhbmRzY2FwZSBhbmQgVHJlZSBNYW5hZ2VtZW50QHBlYXI" }, { "date": "2026-09-30", "name": "Software Answers, a Banyan Software Company", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/U29mdHdhcmUgQW5zd2VycywgYSBCYW55YW4gU29mdHdhcmUgQ29tcGFueUBwZWFy" }, { "date": "2026-09-28", "name": "Kellys Home Center", "country": "US", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/S2VsbHlzIEhvbWUgQ2VudGVyQHBlYXI=" } ] }, "convergences": [ { "name": "Next Level Medical, LLC", "flagged": "2026-09-10", "classes": [ "leak", "notice" ], "curated": false, "hand_picked": false }, { "name": "Mogren, Glessner & Ahrens, P.S.", "flagged": "2026-09-04", "classes": [ "leak", "notice" ], "curated": false, "hand_picked": false } ], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "metaencryptor", "group": "metaencryptor", "name": "metaencryptor", "note": null, "attck": [], "activity": { "postings": 27, "first": "2026-08-23", "last": "2026-10-12", "countries": { "US": 17, "ID": 1, "JP": 3, "KR": 2, "CA": 2, "SG": 1, "DE": 1 }, "sectors": { "healthcare": 6, "technology": 4, "energy": 2, "services": 3, "manufacturing": 7, "government": 1, "unknown": 2, "transportation": 1, "agriculture": 1 }, "recent": [ { "date": "2026-10-12", "name": "MyMichigan Health", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/TXlNaWNoaWdhbiBIZWFsdGhAbWV0YWVuY3J5cHRvcg" }, { "date": "2026-10-12", "name": "VIATechnik", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/VklBVGVjaG5pa0BtZXRhZW5jcnlwdG9y" }, { "date": "2026-09-25", "name": "GE Vernova Inc.", "country": "US", "sectors": [ "energy" ], "url": "https://www.ransomware.live/id/R0UgVmVybm92YSBJbmMuQG1ldGFlbmNyeXB0b3I=" }, { "date": "2026-09-25", "name": "PKF Hadiwinata", "country": "ID", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/UEtGIEhhZGl3aW5hdGFAbWV0YWVuY3J5cHRvcg==" }, { "date": "2026-09-25", "name": "Platinum Healthcare Staffing", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/UGxhdGludW0gSGVhbHRoY2FyZSBTdGFmZmluZ0BtZXRhZW5jcnlwdG9y" }, { "date": "2026-09-21", "name": "Astemo, Ltd.", "country": "JP", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/QXN0ZW1vLCBMdGQuQG1ldGFlbmNyeXB0b3I=" }, { "date": "2026-09-21", "name": "Hudson MD Group, LLC", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/SHVkc29uIE1EIEdyb3VwLCBMTENAbWV0YWVuY3J5cHRvcg==" }, { "date": "2026-09-21", "name": "Bruker Corporation", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/QnJ1a2VyIENvcnBvcmF0aW9uQG1ldGFlbmNyeXB0b3I=" }, { "date": "2026-09-21", "name": "Flex Ltd", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/RmxleCBMdGRAbWV0YWVuY3J5cHRvcg==" }, { "date": "2026-09-21", "name": "HyVision System. Inc", "country": "KR", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/SHlWaXNpb24gU3lzdGVtLiBJbmNAbWV0YWVuY3J5cHRvcg==" }, { "date": "2026-09-21", "name": "Visual Intelligence, Inc.", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/VmlzdWFsIEludGVsbGlnZW5jZSwgSW5jLkBtZXRhZW5jcnlwdG9y" }, { "date": "2026-09-17", "name": "Beckman Coulter, Inc", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/QmVja21hbiBDb3VsdGVyLCBJbmNAbWV0YWVuY3J5cHRvcg==" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "vexy-ransomware", "group": "vexy ransomware", "name": "Vexy Ransomware", "note": null, "attck": [], "activity": { "postings": 26, "first": "2026-09-03", "last": "2026-11-05", "countries": { "VN": 2, "BG": 1, "BD": 1, "US": 3, "??": 1, "IN": 6, "BR": 3, "AU": 1, "TL": 1, "KE": 1, "IT": 1, "JP": 1, "GB": 1, "AR": 1, "MX": 1, "EC": 1 }, "sectors": { "technology": 9, "unknown": 4, "consumer": 6, "energy": 1, "finance": 1, "insurance": 1, "education": 1, "manufacturing": 3, "transportation": 1 }, "recent": [ { "date": "2026-11-05", "name": "ZipAI", "country": "VN", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/WmlwQUlAVmV4eSBSYW5zb213YXJl" }, { "date": "2026-10-31", "name": "System Soft", "country": "BG", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/U3lzdGVtIFNvZnRAVmV4eSBSYW5zb213YXJl" }, { "date": "2026-10-31", "name": "JHAMF Group", "country": "BD", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/SkhBTUYgR3JvdXBAVmV4eSBSYW5zb213YXJl" }, { "date": "2026-10-17", "name": "polisee Inc", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/cG9saXNlZSBJbmNAVmV4eSBSYW5zb213YXJl" }, { "date": "2026-10-16", "name": "Data-Core Systems", "country": "??", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/RGF0YS1Db3JlIFN5c3RlbXNAVmV4eSBSYW5zb213YXJl" }, { "date": "2026-10-15", "name": "Enchanted Fine Jewellery", "country": "IN", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/RW5jaGFudGVkIEZpbmUgSmV3ZWxsZXJ5QFZleHkgUmFuc29td2FyZQ" }, { "date": "2026-10-13", "name": "Guarufilme", "country": "BR", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/R3VhcnVmaWxtZUBWZXh5IFJhbnNvbXdhcmU" }, { "date": "2026-10-06", "name": "KOOKABARRA JUICE", "country": "AU", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/S09PS0FCQVJSQSBKVUlDRUBWZXh5IFJhbnNvbXdhcmU" }, { "date": "2026-09-30", "name": "Summit Electric Supply", "country": "US", "sectors": [ "energy" ], "url": "https://www.ransomware.live/id/U3VtbWl0IEVsZWN0cmljIFN1cHBseUBWZXh5IFJhbnNvbXdhcmU=" }, { "date": "2026-09-29", "name": "Groupe Proxitel", "country": "TL", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/R3JvdXBlIFByb3hpdGVsQFZleHkgUmFuc29td2FyZQ==" }, { "date": "2026-09-25", "name": "Majani Insurance Brokers", "country": "KE", "sectors": [ "finance", "insurance" ], "url": "https://www.ransomware.live/id/TWFqYW5pIEluc3VyYW5jZSBCcm9rZXJzQFZleHkgUmFuc29td2FyZQ==" }, { "date": "2026-09-19", "name": "Quy Nhon University", "country": "VN", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/UXV5IE5ob24gVW5pdmVyc2l0eUBWZXh5IFJhbnNvbXdhcmU=" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "zawoo", "group": "zawoo", "name": "ZaWoo", "note": null, "attck": [], "activity": { "postings": 25, "first": "2026-08-30", "last": "2026-09-24", "countries": { "FR": 6, "NZ": 2, "DE": 11, "US": 1, "CN": 1, "CZ": 1, "BR": 1, "CA": 1, "AT": 1 }, "sectors": { "services": 5, "healthcare": 1, "manufacturing": 4, "energy": 1, "unknown": 5, "technology": 5, "consumer": 4 }, "recent": [ { "date": "2026-09-24", "name": "agiliance.fr", "country": "FR", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/YWdpbGlhbmNlLmZyQFphV29v" }, { "date": "2026-09-24", "name": "www.francare.com", "country": "FR", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/d3d3LmZyYW5jYXJlLmNvbUBaYVdvbw==" }, { "date": "2026-09-24", "name": "amb-pvc.com", "country": "FR", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/YW1iLXB2Yy5jb21AWmFXb28=" }, { "date": "2026-09-19", "name": "HEOLIS", "country": "FR", "sectors": [ "energy" ], "url": "https://www.ransomware.live/id/SEVPTElTQFphV29v" }, { "date": "2026-09-19", "name": "FRANCARETRAD", "country": "FR", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/RlJBTkNBUkVUUkFEQFphV29v" }, { "date": "2026-09-19", "name": "ambpvc", "country": "FR", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/YW1icHZjQFphV29v" }, { "date": "2026-08-31", "name": "zenithtechnology.co.nz", "country": "NZ", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/emVuaXRodGVjaG5vbG9neS5jby5uekBaYVdvbw==" }, { "date": "2026-08-31", "name": "fes-sport.de", "country": "DE", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/ZmVzLXNwb3J0LmRlQFphV29v" }, { "date": "2026-08-31", "name": "esopartnerscpa.com", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/ZXNvcGFydG5lcnNjcGEuY29tQFphV29v" }, { "date": "2026-08-30", "name": "zenithtechnology", "country": "NZ", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/emVuaXRodGVjaG5vbG9neUBaYVdvbw==" }, { "date": "2026-08-30", "name": "fessport", "country": "DE", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/ZmVzc3BvcnRAWmFXb28=" }, { "date": "2026-08-30", "name": "esopartnerscpa", "country": "CN", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/ZXNvcGFydG5lcnNjcGFAWmFXb28=" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "genesis", "group": "genesis", "name": "genesis", "note": null, "attck": [], "activity": { "postings": 24, "first": "2026-08-10", "last": "2026-11-06", "countries": { "US": 21, "CA": 1, "??": 2 }, "sectors": { "manufacturing": 3, "technology": 2, "finance": 1, "services": 6, "healthcare": 7, "unknown": 4, "consumer": 1 }, "recent": [ { "date": "2026-11-06", "name": "Xinos Construction", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/WGlub3MgQ29uc3RydWN0aW9uQGdlbmVzaXM" }, { "date": "2026-11-06", "name": "Insation Technologies", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/SW5zYXRpb24gVGVjaG5vbG9naWVzQGdlbmVzaXM" }, { "date": "2026-10-30", "name": "Acclaim Companies / JCJ Investment", "country": "US", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/QWNjbGFpbSBDb21wYW5pZXMgLyBKQ0ogSW52ZXN0bWVudEBnZW5lc2lz" }, { "date": "2026-10-30", "name": "Gilliam & Associates, P.C", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/R2lsbGlhbSAmIEFzc29jaWF0ZXMsIFAuQ0BnZW5lc2lz" }, { "date": "2026-10-30", "name": "Facts N Figures", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/RmFjdHMgTiBGaWd1cmVzQGdlbmVzaXM" }, { "date": "2026-10-30", "name": "Illinois Work Injury Resource Center (IWIRC)", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/SWxsaW5vaXMgV29yayBJbmp1cnkgUmVzb3VyY2UgQ2VudGVyIChJV0lSQylAZ2VuZXNpcw" }, { "date": "2026-10-30", "name": "Psychometrics Canada", "country": "CA", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/UHN5Y2hvbWV0cmljcyBDYW5hZGFAZ2VuZXNpcw" }, { "date": "2026-10-30", "name": "Louisiana Crane & Construction", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/TG91aXNpYW5hIENyYW5lICYgQ29uc3RydWN0aW9uQGdlbmVzaXM" }, { "date": "2026-10-30", "name": "Aliqout Association", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/QWxpcW91dCBBc3NvY2lhdGlvbkBnZW5lc2lz" }, { "date": "2026-10-30", "name": "EAS Engineering", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/RUFTIEVuZ2luZWVyaW5nQGdlbmVzaXM" }, { "date": "2026-10-30", "name": "Fred H Beck & Associates", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/RnJlZCBIIEJlY2sgJiBBc3NvY2lhdGVzQGdlbmVzaXM" }, { "date": "2026-10-28", "name": "A&B Lab", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/QSZCIExhYkBnZW5lc2lz" } ] }, "convergences": [ { "name": "Interim HealthCare Inc.", "flagged": "2026-09-11", "classes": [ "leak", "litigation", "notice" ], "curated": false, "hand_picked": false } ], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "lamashtu", "group": "lamashtu", "name": "lamashtu", "note": null, "attck": [], "activity": { "postings": 24, "first": "2026-09-30", "last": "2026-10-24", "countries": { "FR": 3, "DE": 11, "ES": 4, "MX": 2, "??": 1, "IT": 1, "US": 1, "AU": 1 }, "sectors": { "consumer": 1, "manufacturing": 9, "agriculture": 1, "energy": 2, "unknown": 5, "transportation": 3, "healthcare": 1, "finance": 1, "technology": 1 }, "recent": [ { "date": "2026-10-24", "name": "Vins Viallet", "country": "FR", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/VmlucyBWaWFsbGV0QGxhbWFzaHR1" }, { "date": "2026-10-22", "name": "Hecker Holzsystembau", "country": "DE", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/SGVja2VyIEhvbHpzeXN0ZW1iYXVAbGFtYXNodHU" }, { "date": "2026-10-22", "name": "Gräfliches Hofbrauhaus Freising", "country": "DE", "sectors": [ "agriculture" ], "url": "https://www.ransomware.live/id/R3LDpGZsaWNoZXMgSG9mYnJhdWhhdXMgRnJlaXNpbmdAbGFtYXNodHU" }, { "date": "2026-10-22", "name": "VERGI Muenster", "country": "DE", "sectors": [ "energy" ], "url": "https://www.ransomware.live/id/VkVSR0kgTXVlbnN0ZXJAbGFtYXNodHU" }, { "date": "2026-10-21", "name": "FuG-Gruppe", "country": "DE", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/RnVHLUdydXBwZUBsYW1hc2h0dQ" }, { "date": "2026-10-21", "name": "MECA-PRECIS", "country": "FR", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/TUVDQS1QUkVDSVNAbGFtYXNodHU" }, { "date": "2026-10-21", "name": "WEPOS Chemie", "country": "DE", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/V0VQT1MgQ2hlbWllQGxhbWFzaHR1" }, { "date": "2026-10-05", "name": "Fluge Audiovisuales", "country": "ES", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Rmx1Z2UgQXVkaW92aXN1YWxlc0BsYW1hc2h0dQ" }, { "date": "2026-10-05", "name": "Fluge Audiovisuales", "country": "ES", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Rmx1Z2UgQXVkaW92aXN1YWxlc0BsYW1hc2h0dQ==" }, { "date": "2026-10-05", "name": "Bender Tribunenbau", "country": "DE", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/QmVuZGVyIFRyaWJ1bmVuYmF1QGxhbWFzaHR1" }, { "date": "2026-10-05", "name": "TRANS LOGROÑO SOCIEDAD ANONIMA", "country": "ES", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/VFJBTlMgTE9HUk/DkU8gU09DSUVEQUQgQU5PTklNQUBsYW1hc2h0dQ" }, { "date": "2026-10-05", "name": "TRANS LOGROÑO SOCIEDAD ANONIMA", "country": "ES", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/VFJBTlMgTE9HUk/DkU8gU09DSUVEQUQgQU5PTklNQUBsYW1hc2h0dQ==" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "shinyhunters", "group": "shinyhunters", "name": "ShinyHunters", "note": null, "attck": [ { "id": "G1057", "name": "ShinyHunters", "kind": "intrusion-set", "url": "https://attack.mitre.org/groups/G1057" } ], "activity": { "postings": 22, "first": "2026-08-14", "last": "2026-09-24", "countries": { "??": 4, "DE": 1, "US": 13, "CH": 2, "SE": 1, "IL": 1 }, "sectors": { "unknown": 3, "healthcare": 8, "manufacturing": 1, "government": 1, "agriculture": 1, "finance": 2, "technology": 5, "consumer": 1 }, "recent": [ { "date": "2026-09-24", "name": "Final statement re PSA", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/RmluYWwgc3RhdGVtZW50IHJlIFBTQUBzaGlueWh1bnRlcnM=" }, { "date": "2026-09-22", "name": "Fresenius Medical Care", "country": "DE", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/RnJlc2VuaXVzIE1lZGljYWwgQ2FyZUBzaGlueWh1bnRlcnM=" }, { "date": "2026-09-22", "name": "PSA - READ THIS NOW", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/UFNBIC0gUkVBRCBUSElTIE5PV0BzaGlueWh1bnRlcnM=" }, { "date": "2026-09-17", "name": "Qi****", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/UWkqKioqQHNoaW55aHVudGVycw==" }, { "date": "2026-09-13", "name": "Kimberly-Clark", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/S2ltYmVybHktQ2xhcmtAc2hpbnlodW50ZXJz" }, { "date": "2026-09-07", "name": "State of Florida DMV", "country": "US", "sectors": [ "government" ], "url": "https://www.ransomware.live/id/U3RhdGUgb2YgRmxvcmlkYSBETVZAc2hpbnlodW50ZXJz" }, { "date": "2026-09-07", "name": "Medela.com", "country": "CH", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/TWVkZWxhLmNvbUBzaGlueWh1bnRlcnM=" }, { "date": "2026-08-29", "name": "Neogen Corporation", "country": "US", "sectors": [ "agriculture" ], "url": "https://www.ransomware.live/id/TmVvZ2VuIENvcnBvcmF0aW9uQHNoaW55aHVudGVycw==" }, { "date": "2026-08-28", "name": "McKesson Corporation", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/TWNLZXNzb24gQ29ycG9yYXRpb25Ac2hpbnlodW50ZXJz" }, { "date": "2026-08-28", "name": "Elekta AB", "country": "SE", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/RWxla3RhIEFCQHNoaW55aHVudGVycw==" }, { "date": "2026-08-28", "name": "Jack Henry & Associates", "country": "US", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/SmFjayBIZW5yeSAmIEFzc29jaWF0ZXNAc2hpbnlodW50ZXJz" }, { "date": "2026-08-23", "name": "CyrusOne, LLC.", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/Q3lydXNPbmUsIExMQy5Ac2hpbnlodW50ZXJz" } ] }, "convergences": [ { "name": "NovoCure Ltd", "flagged": "2026-09-02", "classes": [ "filing", "leak", "notice" ], "curated": false, "hand_picked": false }, { "name": "McKesson Corporation", "flagged": "2026-08-29", "classes": [ "filing", "leak", "litigation", "press", "report" ], "curated": false, "hand_picked": false }, { "name": "Metabase", "flagged": "2026-08-15", "classes": [ "leak", "report" ], "curated": false, "hand_picked": false }, { "name": "RingCentral, Inc.", "flagged": "2026-07-30", "classes": [ "leak", "litigation", "report" ], "curated": false, "hand_picked": true }, { "name": "Ernst & Young LLP", "flagged": "2026-07-28", "classes": [ "leak", "litigation", "notice" ], "curated": false, "hand_picked": false }, { "name": "Fluke Corporation", "flagged": "2026-07-11", "classes": [ "leak", "notice" ], "curated": false, "hand_picked": false } ], "reports": [ { "url": "https://unit42.paloaltonetworks.com/europes-refrigeration-systems-attacks/", "publisher": "Unit 42", "published": "2026-11-06", "title": "Turning Up the Heat: Inside the Attacks on Europe’s Refrigeration System", "origin": "feed", "primary": true }, { "url": "https://flare.io/learn/resources/blog/shinyhunters-arrests-brand-name-fight", "publisher": "Flare", "published": "2026-11-04", "title": "Aftermath of the September ShinyHunters Arrests: Battle Over the Brand Name", "origin": "feed", "primary": true }, { "url": "https://www.malwarebytes.com/blog/data-breaches/2026/10/hackers-steal-and-publish-data-on-41000-homeland-security-workers", "publisher": "Malwarebytes Labs", "published": "2026-10-30", "title": "Hackers steal and publish data on 41,000 Homeland Security workers", "origin": "feed", "primary": false }, { "url": "https://unit42.paloaltonetworks.com/unwrapping-retail-cyber-threats/", "publisher": "Unit 42", "published": "2026-10-28", "title": "Unwrapping Retail Peak Season Cyber Threats", "origin": "feed", "primary": true }, { "url": "https://reliaquest.com/blog/threat-spotlight-residential-proxies-mask-social-engineering-attacks/", "publisher": "ReliaQuest", "published": "2026-10-28", "title": "Residential Proxies Mask Social-Engineering Attacks", "origin": "feed", "primary": false }, { "url": "https://flare.io/learn/resources/blog/ai-cybercrime-economics-ransomware-extortion", "publisher": "Flare", "published": "2026-10-26", "title": "Who Pays When AI Makes Cybercrime Cheaper? Inside the New Economics of Ransomware and Extortion", "origin": "feed", "primary": false }, { "url": "https://research.checkpoint.com/2026/26th-october-threat-intelligence-report/", "publisher": "Check Point Research", "published": "2026-10-26", "title": "26th October – Threat Intelligence Report", "origin": "feed", "primary": false }, { "url": "https://flare.io/learn/resources/blog/the-com-ecosystem-actors-attribution", "publisher": "Flare", "published": "2026-10-20", "title": "Arachnophobia: How Fear, Branding, and Bad Attribution Distorted The Com", "origin": "feed", "primary": true }, { "url": "https://www.sophos.com/en-us/blog/graph-reconnaissance-and-servicenow-user-enumeration-in-a-modern-identity-intrusion", "publisher": "Sophos X-Ops", "published": "2026-10-19", "title": "Graph reconnaissance and ServiceNow user enumeration in a modern identity intrusion", "origin": "feed", "primary": false }, { "url": "https://blog.talosintelligence.com/the-q3-vulnerability-pulse-discovery-exploitation/", "publisher": "Cisco Talos", "published": "2026-10-15", "title": "The Q3 Vulnerability Pulse: Discovery ≠ Exploitation", "origin": "feed", "primary": false }, { "url": "https://flare.io/learn/resources/blog/identity-exposure-management-ai-attacks", "publisher": "Flare", "published": "2026-10-13", "title": "Navigating the Waves of AI-Powered Identity Attacks: Lessons From One Year of Identity Exposure Management", "origin": "feed", "primary": false }, { "url": "https://www.recordedfuture.com/blog/september-2026-cve-landscape", "publisher": "Recorded Future Insikt", "published": "2026-10-13", "title": "September 2026 CVE Landscape", "origin": "feed", "primary": false }, { "url": "https://www.sekoia.com/blog/with-sekoia-intelligence-we-gave-you-half-the-picture-heres-the-other-half", "publisher": "Sekoia TDR", "published": "2026-10-12", "title": "Introducing Sekoia Digital Risk: Track Identity-Led Breaches", "origin": "feed", "primary": false }, { "url": "https://asec.ahnlab.com/en/95764/", "publisher": "AhnLab ASEC", "published": "2026-10-11", "title": "September 2026 Dark Web Breach Incident Trend Report", "origin": "feed", "primary": false }, { "url": "https://asec.ahnlab.com/en/95770/", "publisher": "AhnLab ASEC", "published": "2026-10-11", "title": "September 2026 Dark Web Threat Actor Trend Report", "origin": "feed", "primary": false }, { "url": "https://asec.ahnlab.com/en/95949/", "publisher": "AhnLab ASEC", "published": "2026-10-11", "title": "September 2026 Threat Trend Report on Ransomware", "origin": "feed", "primary": false }, { "url": "https://asec.ahnlab.com/en/96155/", "publisher": "AhnLab ASEC", "published": "2026-10-11", "title": "Security Issues in the Korean & Global Financial Sector in September 2026", "origin": "feed", "primary": false }, { "url": "https://www.guidepointsecurity.com/blog/ransomware-insights-q3-2026/", "publisher": "GuidePoint GRIT", "published": "2026-10-08", "title": "GRIT Q3 2026 Ransomware and Cyber Threat Insights Report: Top Takeaways", "origin": "feed", "primary": false }, { "url": "https://asec.ahnlab.com/en/95669/", "publisher": "AhnLab ASEC", "published": "2026-09-30", "title": "Ransom & Dark Web Issues Week 1, October 2026", "origin": "feed", "primary": false }, { "url": "https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/", "publisher": "Google Threat Intelligence", "published": "2026-09-25", "title": "ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft", "origin": "feed", "primary": true }, { "url": "https://www.sekoia.com/blog/gotta-breach-em-all-the-journey-of-shinyhunters", "publisher": "Sekoia TDR", "published": "2026-09-24", "title": "Gotta Breach 'Em All! The Journey Of ShinyHunters", "origin": "feed", "primary": true }, { "url": "https://www.halcyon.ai/blog/halcyon-in-the-news-cynthia-kaiser-shinyhunters-fbi-breach", "publisher": "Halcyon", "published": "2026-09-24", "title": "Halcyon in the News: Cynthia Kaiser on the ShinyHunters Breach of the FBI", "origin": "feed", "primary": true }, { "url": "https://research.checkpoint.com/2026/14th-september-threat-intelligence-report/", "publisher": "Check Point Research", "published": "2026-09-14", "title": "14th September – Threat Intelligence Report", "origin": "feed", "primary": false }, { "url": "https://flare.io/learn/resources/blog/shinyhunters-claims-impersonation-campaign", "publisher": "Flare", "published": "2026-09-10", "title": "ShinyHunters Claims Impersonation Campaign: 61 Domains Found", "origin": "manual", "primary": true }, { "url": "https://www.miragesecurity.ai/blog/shinyhunters-vishing-playbook", "publisher": "MirageSec", "published": "2026-09-10", "title": "Inside the ShinyHunters vishing playbook: two captured Okta clones and a passkey bypass", "origin": "manual", "primary": true }, { "url": "https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai/", "publisher": "Google Threat Intelligence", "published": "2026-09-08", "title": "GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI", "origin": "feed", "primary": false }, { "url": "https://health-isac.org/urgent-threat-alert-shinyhunters-vishing-campaigns-and-domain-impersonation/", "publisher": "Health-ISAC", "published": "2026-09-03", "title": "Urgent Threat Alert: ShinyHunters Vishing Campaigns and Domain Impersonation", "origin": "manual", "primary": true }, { "url": "https://mind.io/blog/mckesson-breach-sensitive-unstructured-data-risk", "publisher": "Mind", "published": "2026-09-01", "title": "McKesson breach: the risk of sensitive unstructured data", "origin": "manual", "primary": true }, { "url": "https://www.bleepingcomputer.com/news/security/reliaquest-confirms-failed-data-theft-attack-after-shinyhunters-breach/", "publisher": "BleepingComputer", "published": "2026-08-24", "title": "ReliaQuest confirms failed data-theft attack after ShinyHunters breach", "origin": "manual", "primary": true }, { "url": "https://www.theregister.com/cyber-crime/2026/08/24/shinyhunters-and-reliaquest-trade-blows-over-claimed-breach/5291702", "publisher": "The Register", "published": "2026-08-24", "title": "ShinyHunters and ReliaQuest trade blows over claimed breach", "origin": "manual", "primary": true }, { "url": "https://www.huntress.com/blog/black-hat-def-con-standouts", "publisher": "Huntress", "published": "2026-08-14", "title": "10 Hacker Summer Camp Standouts at Black Hat and DEF CON", "origin": "feed", "primary": false }, { "url": "https://www.huntress.com/blog/why-is-education-under-attack", "publisher": "Huntress", "published": "2026-08-13", "title": "Education Under Attack: The Pattern Behind Recent University Breaches", "origin": "feed", "primary": false }, { "url": "https://www.bridewell.com/insights/blogs/detail/vishing-call-to-a-shared-com-ecosystem", "publisher": "Bridewell", "published": "2026-07-29", "title": "From a Vishing Call to a Shared Shared Com Ecosystem Kit | BCON Collective by Bridewell", "origin": "manual", "primary": true } ], "techniques": [ { "id": "T1016", "name": "System Network Configuration Discovery", "tactics": [ "discovery" ], "sources": [ "attck", "report" ], "structural": false, "own": [], "community": 11, "related": 0 }, { "id": "T1018", "name": "Remote System Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 17, "related": 0 }, { "id": "T1027", "name": "Obfuscated Files or Information", "tactics": [ "stealth" ], "sources": [ "report" ], "structural": false, "own": [], "community": 94, "related": 32 }, { "id": "T1036.005", "name": "Match Legitimate Resource Name or Location", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [ "t1557-recaptcha-skinned-turnstile-gate" ], "community": 21, "related": 40 }, { "id": "T1048", "name": "Exfiltration Over Alternative Protocol", "tactics": [ "exfiltration" ], "sources": [ "report" ], "structural": false, "own": [], "community": 12, "related": 10 }, { "id": "T1059.003", "name": "Windows Command Shell", "tactics": [ "execution" ], "sources": [ "report" ], "structural": false, "own": [], "community": 46, "related": 94 }, { "id": "T1059.004", "name": "Unix Shell", "tactics": [ "execution" ], "sources": [ "report" ], "structural": false, "own": [], "community": 18, "related": 94 }, { "id": "T1059.007", "name": "JavaScript", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 29, "related": 94 }, { "id": "T1059.009", "name": "Cloud API", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 3, "related": 94 }, { "id": "T1069.003", "name": "Cloud Groups", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 1, "related": 3 }, { "id": "T1072", "name": "Software Deployment Tools", "tactics": [ "execution", "lateral-movement" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 4, "related": 0 }, { "id": "T1078", "name": "Valid Accounts", "tactics": [ "stealth", "persistence", "privilege-escalation", "initial-access" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 55, "related": 54 }, { "id": "T1078.002", "name": "Domain Accounts", "tactics": [ "stealth", "persistence", "privilege-escalation", "initial-access" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 5, "related": 55 }, { "id": "T1078.004", "name": "Cloud Accounts", "tactics": [ "stealth", "persistence", "privilege-escalation", "initial-access" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 40, "related": 55 }, { "id": "T1082", "name": "System Information Discovery", "tactics": [ "discovery" ], "sources": [ "attck", "report" ], "structural": false, "own": [], "community": 33, "related": 0 }, { "id": "T1083", "name": "File and Directory Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 24, "related": 0 }, { "id": "T1090", "name": "Proxy", "tactics": [ "command-and-control" ], "sources": [ "report" ], "structural": false, "own": [], "community": 22, "related": 12 }, { "id": "T1090.003", "name": "Multi-hop Proxy", "tactics": [ "command-and-control" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 3, "related": 22 }, { "id": "T1105", "name": "Ingress Tool Transfer", "tactics": [ "command-and-control" ], "sources": [ "attck" ], "structural": false, "own": [ "t1204-004-clickfix-run-dialog-execution" ], "community": 87, "related": 0 }, { "id": "T1110", "name": "Brute Force", "tactics": [ "credential-access" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 25, "related": 4 }, { "id": "T1190", "name": "Exploit Public-Facing Application", "tactics": [ "initial-access" ], "sources": [ "attck", "report" ], "structural": false, "own": [ "t1190-peoplesoft-psemhub-encoded-path-exploitation" ], "community": 147, "related": 0 }, { "id": "T1195.001", "name": "Compromise Software Dependencies and Development Tools", "tactics": [ "initial-access" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 2, "related": 1 }, { "id": "T1203", "name": "Exploitation for Client Execution", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 35, "related": 0 }, { "id": "T1210", "name": "Exploitation of Remote Services", "tactics": [ "lateral-movement" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 15, "related": 0 }, { "id": "T1213.003", "name": "Code Repositories", "tactics": [ "collection" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 5, "related": 7 }, { "id": "T1213.006", "name": "Databases", "tactics": [ "collection" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 7 }, { "id": "T1219", "name": "Remote Access Tools", "tactics": [ "command-and-control" ], "sources": [ "attck", "report" ], "structural": false, "own": [ "t1505-003-peoplesoft-psemhub-webshell-drop" ], "community": 6, "related": 46 }, { "id": "T1485", "name": "Data Destruction", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 20, "related": 0 }, { "id": "T1491.001", "name": "Internal Defacement", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 4, "related": 0 }, { "id": "T1505.003", "name": "Web Shell", "tactics": [ "persistence" ], "sources": [ "report" ], "structural": false, "own": [ "t1505-003-peoplesoft-psemhub-webshell-drop" ], "community": 34, "related": 1 }, { "id": "T1528", "name": "Steal Application Access Token", "tactics": [ "credential-access" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 14, "related": 0 }, { "id": "T1530", "name": "Data from Cloud Storage", "tactics": [ "collection" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1550.001", "name": "Application Access Token", "tactics": [ "lateral-movement" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 4, "related": 4 }, { "id": "T1552.001", "name": "Credentials In Files", "tactics": [ "credential-access" ], "sources": [ "attck", "report" ], "structural": false, "own": [], "community": 24, "related": 13 }, { "id": "T1560.002", "name": "Archive via Library", "tactics": [ "collection" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 4 }, { "id": "T1566", "name": "Phishing", "tactics": [ "initial-access" ], "sources": [ "report" ], "structural": false, "own": [], "community": 14, "related": 28 }, { "id": "T1567", "name": "Exfiltration Over Web Service", "tactics": [ "exfiltration" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 12, "related": 16 }, { "id": "T1573.002", "name": "Asymmetric Cryptography", "tactics": [ "command-and-control" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 6 }, { "id": "T1580", "name": "Cloud Infrastructure Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 1, "related": 0 }, { "id": "T1583.001", "name": "Domains", "tactics": [ "resource-development" ], "sources": [ "attck" ], "structural": true, "own": [ "t1583-001-claims-registration-conjunction" ], "community": 0, "related": 0 }, { "id": "T1583.004", "name": "Server", "tactics": [ "resource-development" ], "sources": [ "attck" ], "structural": true, "own": [], "community": 0, "related": 0 }, { "id": "T1585.002", "name": "Email Accounts", "tactics": [ "resource-development" ], "sources": [ "attck" ], "structural": true, "own": [], "community": 0, "related": 0 }, { "id": "T1587.004", "name": "Exploits", "tactics": [ "resource-development" ], "sources": [ "attck" ], "structural": true, "own": [], "community": 0, "related": 6 }, { "id": "T1588.002", "name": "Tool", "tactics": [ "resource-development" ], "sources": [ "attck" ], "structural": true, "own": [], "community": 9, "related": 2 }, { "id": "T1588.007", "name": "Artificial Intelligence", "tactics": [ "resource-development" ], "sources": [ "attck" ], "structural": true, "own": [], "community": 0, "related": 2 }, { "id": "T1589.001", "name": "Credentials", "tactics": [ "reconnaissance" ], "sources": [ "attck" ], "structural": true, "own": [], "community": 0, "related": 2 }, { "id": "T1593.003", "name": "Code Repositories", "tactics": [ "reconnaissance" ], "sources": [ "attck" ], "structural": true, "own": [], "community": 2, "related": 0 }, { "id": "T1595.002", "name": "Vulnerability Scanning", "tactics": [ "reconnaissance" ], "sources": [ "attck", "report" ], "structural": true, "own": [], "community": 1, "related": 3 }, { "id": "T1596.003", "name": "Digital Certificates", "tactics": [ "reconnaissance" ], "sources": [ "report" ], "structural": true, "own": [], "community": 0, "related": 0 }, { "id": "T1596.005", "name": "Scan Databases", "tactics": [ "reconnaissance" ], "sources": [ "report" ], "structural": true, "own": [], "community": 0, "related": 0 }, { "id": "T1598", "name": "Phishing for Information", "tactics": [ "reconnaissance" ], "sources": [ "attck", "report" ], "structural": true, "own": [], "community": 0, "related": 1 }, { "id": "T1598.003", "name": "Spearphishing Link", "tactics": [ "reconnaissance" ], "sources": [ "attck" ], "structural": true, "own": [], "community": 0, "related": 0 }, { "id": "T1619", "name": "Cloud Storage Object Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 1, "related": 0 }, { "id": "T1657", "name": "Financial Theft", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1684", "name": "Social Engineering", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 0 } ], "cves": [ { "id": "CVE-2024-34102", "in_kev": true, "ransomware_use": false, "epss": 0.99994, "vendor": "Adobe", "product": "Commerce and Magento Open Source" }, { "id": "CVE-2026-109618", "in_kev": true, "ransomware_use": false, "epss": 0.99999, "vendor": "PHP Group", "product": "PHP" }, { "id": "CVE-2026-109619", "in_kev": true, "ransomware_use": false, "epss": 0.99999, "vendor": "PHP Group", "product": "PHP" }, { "id": "CVE-2026-35273", "in_kev": true, "ransomware_use": true, "epss": 0.96678, "vendor": "Oracle", "product": "PeopleSoft Enterprise PeopleTools" } ], "indicators": { "list": [ { "type": "domain", "value": "winmanage-me.network", "source": "https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/" }, { "type": "ipv4", "value": "104.219.234.138", "source": "https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/" }, { "type": "ipv4", "value": "162.219.30.165", "source": "https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/" }, { "type": "ipv4", "value": "5.199.162.157", "source": "https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/" }, { "type": "sha256", "value": "2bee941fb40519d0d1ec52bd79a8f63fc65aac6455c8f2d6b668e3360dfdb5d7", "source": "https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/" }, { "type": "sha256", "value": "3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3", "source": "https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/" }, { "type": "sha256", "value": "419c571ee38b7e7266d130c4b6bbc4dd0ef44d6e5f3bc02cc2cf73b762f07c86", "source": "https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/" }, { "type": "sha256", "value": "48b4a0827da7bbfce9fb52464f8a659dea7a035189c52c506c0bfb4b1c3fe494", "source": "https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/" }, { "type": "sha256", "value": "a4e525d8825c1bac6dd934ef2c008b5fb9988289190b5b98d854799e07e207e4", "source": "https://www.sekoia.com/blog/gotta-breach-em-all-the-journey-of-shinyhunters" }, { "type": "sha256", "value": "ba14419beb2ec0bb94cab6298c14d7fb3e1d819366fe378290c0c2a4d97f7e07", "source": "https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/" }, { "type": "sha256", "value": "d5efdf6f35e9c6edcad5fbec707e6c88570c9d8796bf089c29303d591b94e384", "source": "https://www.sekoia.com/blog/gotta-breach-em-all-the-journey-of-shinyhunters" }, { "type": "sha256", "value": "fa210f015399de16bf7cb1e05856d179dfaabb1ecc9bb5fd277f94972a3bdc43", "source": "https://www.sekoia.com/blog/gotta-breach-em-all-the-journey-of-shinyhunters" } ], "withheld": 2 }, "rules": [ "t1059-peoplesoft-psemhub-payload-execution", "t1098-005-hypervisor-mfa-device-enrollment", "t1190-peoplesoft-psemhub-encoded-path-exploitation", "t1557-non-okta-host-oktaverify-svg", "t1505-003-peoplesoft-psemhub-webshell-drop", "t1583-001-claims-registration-conjunction", "t1557-recaptcha-skinned-turnstile-gate", "t1557-aitm-cross-asn-session-mfa", "t1557-claims-kit-single-letter-c2-xenc" ], "coverage": { "techniques": 55, "defendable": 42, "covered": 36, "uncovered": [ "T1213.006", "T1530", "T1560.002", "T1573.002", "T1657", "T1684" ] } }, { "slug": "global-secret-group", "group": "global secret group", "name": "Global Secret Group", "note": null, "attck": [], "activity": { "postings": 22, "first": "2026-08-10", "last": "2026-11-04", "countries": { "US": 17, "IL": 1, "??": 1, "IN": 2, "GR": 1 }, "sectors": { "manufacturing": 5, "energy": 1, "education": 2, "services": 1, "unknown": 5, "finance": 3, "transportation": 1, "consumer": 2, "government": 1, "healthcare": 1, "insurance": 1 }, "recent": [ { "date": "2026-11-04", "name": "Kontron North America", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/S29udHJvbiBOb3J0aCBBbWVyaWNhQEdsb2JhbCBTZWNyZXQgR3JvdXA" }, { "date": "2026-10-29", "name": "TDS Telecommunications LLC.", "country": "US", "sectors": [ "energy" ], "url": "https://www.ransomware.live/id/VERTIFRlbGVjb21tdW5pY2F0aW9ucyBMTEMuQEdsb2JhbCBTZWNyZXQgR3JvdXA" }, { "date": "2026-10-28", "name": "The Anglican International School", "country": "IL", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/VGhlIEFuZ2xpY2FuIEludGVybmF0aW9uYWwgU2Nob29sQEdsb2JhbCBTZWNyZXQgR3JvdXA" }, { "date": "2026-10-20", "name": "Graves Fireplaces, Inc.", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/R3JhdmVzIEZpcmVwbGFjZXMsIEluYy5AR2xvYmFsIFNlY3JldCBHcm91cA" }, { "date": "2026-10-19", "name": "Rosenberg & Pittinsky", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/Um9zZW5iZXJnICYgUGl0dGluc2t5QEdsb2JhbCBTZWNyZXQgR3JvdXA" }, { "date": "2026-10-19", "name": "Seminole Schools", "country": "US", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/U2VtaW5vbGUgU2Nob29sc0BHbG9iYWwgU2VjcmV0IEdyb3Vw" }, { "date": "2026-10-05", "name": "Turn5", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/VHVybjVAR2xvYmFsIFNlY3JldCBHcm91cA" }, { "date": "2026-09-21", "name": "Allied Supply Co.", "country": "??", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/QWxsaWVkIFN1cHBseSBDby5AR2xvYmFsIFNlY3JldCBHcm91cA==" }, { "date": "2026-09-21", "name": "Kjla", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/S2psYUBHbG9iYWwgU2VjcmV0IEdyb3Vw" }, { "date": "2026-09-10", "name": "CO-OP URBAN BANK LTD", "country": "IN", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/Q08tT1AgVVJCQU4gQkFOSyBMVERAR2xvYmFsIFNlY3JldCBHcm91cA==" }, { "date": "2026-09-09", "name": "Mesan USA", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/TWVzYW4gVVNBQEdsb2JhbCBTZWNyZXQgR3JvdXA=" }, { "date": "2026-09-01", "name": "Quality Resource Pvt", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/UXVhbGl0eSBSZXNvdXJjZSBQdnRAR2xvYmFsIFNlY3JldCBHcm91cA==" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "whitearmor", "group": "whitearmor", "name": "Whitearmor", "note": null, "attck": [], "activity": { "postings": 22, "first": "2026-10-23", "last": "2026-11-07", "countries": { "DK": 1, "GB": 1, "??": 10, "US": 6, "PH": 1, "DE": 1, "AR": 1, "CN": 1 }, "sectors": { "transportation": 5, "manufacturing": 2, "unknown": 5, "technology": 6, "consumer": 3, "government": 1 }, "recent": [ { "date": "2026-11-07", "name": "maersk", "country": "DK", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/bWFlcnNrQFdoaXRlYXJtb3I" }, { "date": "2026-11-04", "name": "Unilever", "country": "GB", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/VW5pbGV2ZXJAV2hpdGVhcm1vcg" }, { "date": "2026-11-03", "name": "Project Trojan Horse", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/UHJvamVjdCBUcm9qYW4gSG9yc2VAV2hpdGVhcm1vcg" }, { "date": "2026-11-01", "name": "AmplifAI (GoDaddy instance)", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/QW1wbGlmQUkgKEdvRGFkZHkgaW5zdGFuY2UpQFdoaXRlYXJtb3I" }, { "date": "2026-10-31", "name": "Gamdom V2", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/R2FtZG9tIFYyQFdoaXRlYXJtb3I" }, { "date": "2026-10-30", "name": "KTU Shipyard", "country": "PH", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/S1RVIFNoaXB5YXJkQFdoaXRlYXJtb3I" }, { "date": "2026-10-29", "name": "rolly.io", "country": "??", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/cm9sbHkuaW9AV2hpdGVhcm1vcg" }, { "date": "2026-10-28", "name": "wagyu.xyz unfairness", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/d2FneXUueHl6IHVuZmFpcm5lc3NAV2hpdGVhcm1vcg" }, { "date": "2026-10-28", "name": "Echo.com", "country": "DE", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/RWNoby5jb21AV2hpdGVhcm1vcg" }, { "date": "2026-10-28", "name": "Ryder", "country": "US", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/UnlkZXJAV2hpdGVhcm1vcg" }, { "date": "2026-10-27", "name": "https://t.me/whitearmorxd", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/aHR0cHM6Ly90Lm1lL3doaXRlYXJtb3J4ZEBXaGl0ZWFybW9y" }, { "date": "2026-10-27", "name": "wagyu.xyz", "country": "??", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/d2FneXUueHl6QFdoaXRlYXJtb3I" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "interlock", "group": "interlock", "name": "Interlock", "note": null, "attck": [], "activity": { "postings": 21, "first": "2026-08-11", "last": "2026-10-21", "countries": { "US": 17, "CL": 1, "??": 3 }, "sectors": { "education": 4, "manufacturing": 3, "services": 2, "healthcare": 4, "energy": 1, "consumer": 1, "unknown": 3, "government": 1, "finance": 1, "technology": 1 }, "recent": [ { "date": "2026-10-21", "name": "Coastal Alabama Community College", "country": "US", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/Q29hc3RhbCBBbGFiYW1hIENvbW11bml0eSBDb2xsZWdlQGludGVybG9jaw" }, { "date": "2026-10-12", "name": "Pedigo Products, Inc.", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/UGVkaWdvIFByb2R1Y3RzLCBJbmMuQGludGVybG9jaw" }, { "date": "2026-10-12", "name": "Valenti Management", "country": "CL", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/VmFsZW50aSBNYW5hZ2VtZW50QGludGVybG9jaw" }, { "date": "2026-10-12", "name": "Concord Eye Center", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/Q29uY29yZCBFeWUgQ2VudGVyQGludGVybG9jaw" }, { "date": "2026-10-12", "name": "Greentech Environmental", "country": "??", "sectors": [ "energy" ], "url": "https://www.ransomware.live/id/R3JlZW50ZWNoIEVudmlyb25tZW50YWxAaW50ZXJsb2Nr" }, { "date": "2026-10-12", "name": "Engineers Contractors Fabricators Inc. (ECF)", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/RW5naW5lZXJzIENvbnRyYWN0b3JzIEZhYnJpY2F0b3JzIEluYy4gKEVDRilAaW50ZXJsb2Nr" }, { "date": "2026-10-12", "name": "Nu-Quest Distribution Inc", "country": "US", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/TnUtUXVlc3QgRGlzdHJpYnV0aW9uIEluY0BpbnRlcmxvY2s" }, { "date": "2026-10-09", "name": "Shalom Christian Academy", "country": "US", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/U2hhbG9tIENocmlzdGlhbiBBY2FkZW15QGludGVybG9jaw" }, { "date": "2026-10-07", "name": "Riviera Healthcare Center", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/Uml2aWVyYSBIZWFsdGhjYXJlIENlbnRlckBpbnRlcmxvY2s" }, { "date": "2026-10-05", "name": "H&L Manufacturing", "country": "??", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/SCZMIE1hbnVmYWN0dXJpbmdAaW50ZXJsb2Nr" }, { "date": "2026-10-05", "name": "O2 Dental Group", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/TzIgRGVudGFsIEdyb3VwQGludGVybG9jaw" }, { "date": "2026-09-30", "name": "Blaise C. Bender, PC", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/QmxhaXNlIEMuIEJlbmRlciwgUENAaW50ZXJsb2Nr" } ] }, "convergences": [ { "name": "Gardiner Family Chiropractic, PC", "flagged": "2026-08-15", "classes": [ "leak", "notice" ], "curated": false, "hand_picked": false } ], "reports": [ { "url": "https://blog.talosintelligence.com/ir-trends-q3-2026/", "publisher": "Cisco Talos", "published": "2026-10-29", "title": "IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases", "origin": "feed", "primary": false }, { "url": "https://www.recordedfuture.com/research/h1-2026-malware-vulnerability-trends", "publisher": "Recorded Future Insikt", "published": "2026-09-03", "title": "H1 2026 Malware Vulnerability Trends", "origin": "feed", "primary": false } ], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "dark-project", "group": "dark project", "name": "Dark Project", "note": null, "attck": [], "activity": { "postings": 21, "first": "2026-08-24", "last": "2026-11-05", "countries": { "US": 19, "TR": 1, "BR": 1 }, "sectors": { "consumer": 4, "agriculture": 2, "healthcare": 3, "unknown": 2, "manufacturing": 7, "services": 3 }, "recent": [ { "date": "2026-11-05", "name": "Custom Bakehouse", "country": "US", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/Q3VzdG9tIEJha2Vob3VzZUBEYXJrIFByb2plY3Q" }, { "date": "2026-11-04", "name": "Homestead Creamery", "country": "US", "sectors": [ "agriculture" ], "url": "https://www.ransomware.live/id/SG9tZXN0ZWFkIENyZWFtZXJ5QERhcmsgUHJvamVjdA" }, { "date": "2026-11-04", "name": "Food Bank of Central Louisiana", "country": "US", "sectors": [ "agriculture" ], "url": "https://www.ransomware.live/id/Rm9vZCBCYW5rIG9mIENlbnRyYWwgTG91aXNpYW5hQERhcmsgUHJvamVjdA" }, { "date": "2026-11-04", "name": "Simplehuman", "country": "US", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/U2ltcGxlaHVtYW5ARGFyayBQcm9qZWN0" }, { "date": "2026-10-20", "name": "Beach Eye Medical Group", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/QmVhY2ggRXllIE1lZGljYWwgR3JvdXBARGFyayBQcm9qZWN0" }, { "date": "2026-10-20", "name": "Asensus Surgical", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/QXNlbnN1cyBTdXJnaWNhbEBEYXJrIFByb2plY3Q" }, { "date": "2026-10-20", "name": "The Excalibur Group", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/VGhlIEV4Y2FsaWJ1ciBHcm91cEBEYXJrIFByb2plY3Q" }, { "date": "2026-10-12", "name": "Franklin Miller Inc.", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/RnJhbmtsaW4gTWlsbGVyIEluYy5ARGFyayBQcm9qZWN0" }, { "date": "2026-10-12", "name": "PennEastern Architects LCC", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/UGVubkVhc3Rlcm4gQXJjaGl0ZWN0cyBMQ0NARGFyayBQcm9qZWN0" }, { "date": "2026-10-12", "name": "Claire's Inc.", "country": "US", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/Q2xhaXJlJ3MgSW5jLkBEYXJrIFByb2plY3Q" }, { "date": "2026-09-15", "name": "Cumar Marble & Granite", "country": "TR", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/Q3VtYXIgTWFyYmxlICYgR3Jhbml0ZUBEYXJrIFByb2plY3Q=" }, { "date": "2026-09-09", "name": "Specchem LLC", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/U3BlY2NoZW0gTExDQERhcmsgUHJvamVjdA==" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "eclipse", "group": "eclipse", "name": "Eclipse", "note": null, "attck": [], "activity": { "postings": 21, "first": "2026-08-16", "last": "2026-11-06", "countries": { "MX": 1, "SG": 5, "TW": 1, "JP": 2, "BR": 2, "IN": 4, "US": 4, "FR": 1, "IT": 1 }, "sectors": { "transportation": 3, "healthcare": 2, "unknown": 4, "manufacturing": 3, "services": 2, "technology": 3, "education": 1, "agriculture": 1, "consumer": 2 }, "recent": [ { "date": "2026-11-06", "name": "Comercial en Fletes México, S.A. de C.V.", "country": "MX", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/Q29tZXJjaWFsIGVuIEZsZXRlcyBNw6l4aWNvLCBTLkEuIGRlIEMuVi5ARWNsaXBzZQ" }, { "date": "2026-10-17", "name": "PART2 Global AirFreight International", "country": "SG", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/UEFSVDIgR2xvYmFsIEFpckZyZWlnaHQgSW50ZXJuYXRpb25hbEBFY2xpcHNl" }, { "date": "2026-10-14", "name": "Taiwan Otsuka Pharmaceutical", "country": "TW", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/VGFpd2FuIE90c3VrYSBQaGFybWFjZXV0aWNhbEBFY2xpcHNl" }, { "date": "2026-10-14", "name": "japantimes.co.jp", "country": "JP", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/amFwYW50aW1lcy5jby5qcEBFY2xpcHNl" }, { "date": "2026-10-08", "name": "dipecarr.com.br", "country": "BR", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/ZGlwZWNhcnIuY29tLmJyQEVjbGlwc2U" }, { "date": "2026-10-08", "name": "simplexengg.in", "country": "IN", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/c2ltcGxleGVuZ2cuaW5ARWNsaXBzZQ" }, { "date": "2026-10-08", "name": "sanjoseattorneys.com", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/c2Fuam9zZWF0dG9ybmV5cy5jb21ARWNsaXBzZQ" }, { "date": "2026-10-08", "name": "DIPECARR", "country": "BR", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/RElQRUNBUlJARWNsaXBzZQ" }, { "date": "2026-10-08", "name": "Global AirFreight International", "country": "SG", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/R2xvYmFsIEFpckZyZWlnaHQgSW50ZXJuYXRpb25hbEBFY2xpcHNl" }, { "date": "2026-10-05", "name": "part02.simplexengg.in", "country": "IN", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/cGFydDAyLnNpbXBsZXhlbmdnLmluQEVjbGlwc2U" }, { "date": "2026-09-30", "name": "The Japan Times", "country": "JP", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/VGhlIEphcGFuIFRpbWVzQEVjbGlwc2U=" }, { "date": "2026-09-14", "name": "Dublin City Schools GA", "country": "US", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/RHVibGluIENpdHkgU2Nob29scyBHQUBFY2xpcHNl" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "coinbasecartel", "group": "coinbasecartel", "name": "Coinbase Cartel", "note": null, "attck": [], "activity": { "postings": 20, "first": "2026-08-13", "last": "2026-08-23", "countries": { "DE": 1, "US": 7, "CN": 1, "NZ": 1, "AR": 1, "FR": 1, "??": 3, "PH": 1, "ID": 2, "GB": 1, "JP": 1 }, "sectors": { "consumer": 1, "healthcare": 1, "manufacturing": 2, "finance": 5, "insurance": 1, "transportation": 1, "services": 6, "unknown": 1, "agriculture": 3 }, "recent": [ { "date": "2026-08-23", "name": "Westwing Group SE", "country": "DE", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/V2VzdHdpbmcgR3JvdXAgU0VAY29pbmJhc2VjYXJ0ZWw=" }, { "date": "2026-08-22", "name": "Integrated Health Systems", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/SW50ZWdyYXRlZCBIZWFsdGggU3lzdGVtc0Bjb2luYmFzZWNhcnRlbA==" }, { "date": "2026-08-22", "name": "RXPE Group", "country": "CN", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/UlhQRSBHcm91cEBjb2luYmFzZWNhcnRlbA==" }, { "date": "2026-08-22", "name": "Tower Insurance", "country": "NZ", "sectors": [ "finance", "insurance" ], "url": "https://www.ransomware.live/id/VG93ZXIgSW5zdXJhbmNlQGNvaW5iYXNlY2FydGVs" }, { "date": "2026-08-22", "name": "Flecha Bus", "country": "AR", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/RmxlY2hhIEJ1c0Bjb2luYmFzZWNhcnRlbA==" }, { "date": "2026-08-22", "name": "OTEIS Conseil & Ingénierie", "country": "FR", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/T1RFSVMgQ29uc2VpbCAmIEluZ8OpbmllcmllQGNvaW5iYXNlY2FydGVs" }, { "date": "2026-08-22", "name": "Longhorn Investments", "country": "??", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/TG9uZ2hvcm4gSW52ZXN0bWVudHNAY29pbmJhc2VjYXJ0ZWw=" }, { "date": "2026-08-22", "name": "Kessler Creative", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/S2Vzc2xlciBDcmVhdGl2ZUBjb2luYmFzZWNhcnRlbA==" }, { "date": "2026-08-22", "name": "Klasko Immigration Law Partners", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/S2xhc2tvIEltbWlncmF0aW9uIExhdyBQYXJ0bmVyc0Bjb2luYmFzZWNhcnRlbA==" }, { "date": "2026-08-22", "name": "Patel", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/UGF0ZWxAY29pbmJhc2VjYXJ0ZWw=" }, { "date": "2026-08-22", "name": "Abacus Advisors", "country": "??", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/QWJhY3VzIEFkdmlzb3JzQGNvaW5iYXNlY2FydGVs" }, { "date": "2026-08-22", "name": "LifeBank Microfinance Foundation", "country": "PH", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/TGlmZUJhbmsgTWljcm9maW5hbmNlIEZvdW5kYXRpb25AY29pbmJhc2VjYXJ0ZWw=" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "chaos", "group": "chaos", "name": "Chaos", "note": "Not ATT&CK S0220, an unrelated Linux backdoor.", "attck": [], "activity": { "postings": 19, "first": "2026-08-25", "last": "2026-11-03", "countries": { "US": 12, "GB": 3, "TW": 1, "AU": 1, "NL": 1, "CN": 1 }, "sectors": { "manufacturing": 7, "consumer": 1, "healthcare": 5, "services": 2, "unknown": 4 }, "recent": [ { "date": "2026-11-03", "name": "darrequipment.com", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/ZGFycmVxdWlwbWVudC5jb21AY2hhb3M" }, { "date": "2026-10-23", "name": "mickeybody.com", "country": "US", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/bWlja2V5Ym9keS5jb21AY2hhb3M" }, { "date": "2026-10-09", "name": "astranahealth.com", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/YXN0cmFuYWhlYWx0aC5jb21AY2hhb3M" }, { "date": "2026-10-01", "name": "parkdental.com", "country": "GB", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/cGFya2RlbnRhbC5jb21AY2hhb3M=" }, { "date": "2026-09-29", "name": "advantech.com", "country": "TW", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/YWR2YW50ZWNoLmNvbUBjaGFvcw==" }, { "date": "2026-09-29", "name": "carolinaasthma.com", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/Y2Fyb2xpbmFhc3RobWEuY29tQGNoYW9z" }, { "date": "2026-09-17", "name": "expresspros.com", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/ZXhwcmVzc3Byb3MuY29tQGNoYW9z" }, { "date": "2026-09-14", "name": "glasfloss.com", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/Z2xhc2Zsb3NzLmNvbUBjaGFvcw==" }, { "date": "2026-09-14", "name": "steelhausinc.com", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/c3RlZWxoYXVzaW5jLmNvbUBjaGFvcw==" }, { "date": "2026-09-10", "name": "mankatoclinic.com", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/bWFua2F0b2NsaW5pYy5jb21AY2hhb3M=" }, { "date": "2026-09-10", "name": "artiflexmfg.com", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/YXJ0aWZsZXhtZmcuY29tQGNoYW9z" }, { "date": "2026-09-08", "name": "copeplastics.com", "country": "GB", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/Y29wZXBsYXN0aWNzLmNvbUBjaGFvcw==" } ] }, "convergences": [ { "name": "Park Dental Partners, Inc.", "flagged": "2026-10-14", "classes": [ "filing", "leak", "notice" ], "curated": true, "hand_picked": false }, { "name": "Opportune LLP", "flagged": "2026-09-19", "classes": [ "leak", "notice" ], "curated": false, "hand_picked": false } ], "reports": [ { "url": "https://arcticwolf.com/resources/blog/threat-actors-abuse-microsoft-teams-external-chat-for-initial-access/", "publisher": "Arctic Wolf", "published": "2026-10-26", "title": "Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access", "origin": "feed", "primary": false }, { "url": "https://www.huntress.com/blog/fake-gta6-download-malware-analysis", "publisher": "Huntress", "published": "2026-09-09", "title": "Grand Theft Auto VI hype leads to malware", "origin": "feed", "primary": false } ], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "payload", "group": "payload", "name": "payload", "note": null, "attck": [], "activity": { "postings": 18, "first": "2026-08-11", "last": "2026-11-03", "countries": { "DE": 9, "??": 3, "FR": 1, "CH": 4, "JO": 1 }, "sectors": { "manufacturing": 7, "consumer": 3, "education": 1, "government": 1, "services": 2, "unknown": 1, "technology": 2, "finance": 1 }, "recent": [ { "date": "2026-11-03", "name": "Stahlbau Mann GmbH", "country": "DE", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/U3RhaGxiYXUgTWFubiBHbWJIQHBheWxvYWQ" }, { "date": "2026-10-31", "name": "Straze Garden Center", "country": "??", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/U3RyYXplIEdhcmRlbiBDZW50ZXJAcGF5bG9hZA" }, { "date": "2026-10-31", "name": "Kraft Lernen", "country": "DE", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/S3JhZnQgTGVybmVuQHBheWxvYWQ" }, { "date": "2026-10-31", "name": "SALEG (Sachsen-Anhaltische Landesentwicklungsgesellschaft mbH)", "country": "DE", "sectors": [ "government" ], "url": "https://www.ransomware.live/id/U0FMRUcgKFNhY2hzZW4tQW5oYWx0aXNjaGUgTGFuZGVzZW50d2lja2x1bmdzZ2VzZWxsc2NoYWZ0IG1iSClAcGF5bG9hZA" }, { "date": "2026-10-28", "name": "Hauhinco", "country": "DE", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/SGF1aGluY29AcGF5bG9hZA" }, { "date": "2026-10-28", "name": "Marbre Design", "country": "FR", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/TWFyYnJlIERlc2lnbkBwYXlsb2Fk" }, { "date": "2026-10-26", "name": "Glückauf-Vermessung GmbH", "country": "DE", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/R2zDvGNrYXVmLVZlcm1lc3N1bmcgR21iSEBwYXlsb2Fk" }, { "date": "2026-10-26", "name": "Miletic GmbH", "country": "DE", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/TWlsZXRpYyBHbWJIQHBheWxvYWQ" }, { "date": "2026-10-26", "name": "Edelstahl-Mechanik GmbH", "country": "DE", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/RWRlbHN0YWhsLU1lY2hhbmlrIEdtYkhAcGF5bG9hZA" }, { "date": "2026-10-20", "name": "BW Office World", "country": "??", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/QlcgT2ZmaWNlIFdvcmxkQHBheWxvYWQ" }, { "date": "2026-10-20", "name": "Brüninghoff Group", "country": "DE", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/QnLDvG5pbmdob2ZmIEdyb3VwQHBheWxvYWQ" }, { "date": "2026-10-08", "name": "Boullard Musique", "country": "CH", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/Qm91bGxhcmQgTXVzaXF1ZUBwYXlsb2Fk" } ] }, "convergences": [], "reports": [ { "url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "publisher": "Kaspersky Securelist", "published": "2026-09-21", "title": "Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO", "origin": "feed", "primary": true } ], "techniques": [ { "id": "T1005", "name": "Data from Local System", "tactics": [ "collection" ], "sources": [ "report" ], "structural": false, "own": [], "community": 14, "related": 0 }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "tactics": [ "privilege-escalation" ], "sources": [ "report" ], "structural": false, "own": [], "community": 30, "related": 0 }, { "id": "T1070.001", "name": "T1070.001", "tactics": [], "sources": [ "report" ], "structural": false, "own": [], "community": 0, "related": 20 }, { "id": "T1071", "name": "Application Layer Protocol", "tactics": [ "command-and-control" ], "sources": [ "report" ], "structural": false, "own": [], "community": 7, "related": 59 }, { "id": "T1078", "name": "Valid Accounts", "tactics": [ "stealth", "persistence", "privilege-escalation", "initial-access" ], "sources": [ "report" ], "structural": false, "own": [], "community": 55, "related": 54 }, { "id": "T1078.002", "name": "Domain Accounts", "tactics": [ "stealth", "persistence", "privilege-escalation", "initial-access" ], "sources": [ "report" ], "structural": false, "own": [], "community": 5, "related": 55 }, { "id": "T1133", "name": "External Remote Services", "tactics": [ "persistence", "initial-access" ], "sources": [ "report" ], "structural": false, "own": [], "community": 20, "related": 0 }, { "id": "T1484.001", "name": "Group Policy Modification", "tactics": [ "defense-impairment", "privilege-escalation" ], "sources": [ "report" ], "structural": false, "own": [], "community": 6, "related": 1 }, { "id": "T1489", "name": "Service Stop", "tactics": [ "impact" ], "sources": [ "report" ], "structural": false, "own": [], "community": 20, "related": 0 }, { "id": "T1490", "name": "Inhibit System Recovery", "tactics": [ "impact" ], "sources": [ "report" ], "structural": false, "own": [], "community": 27, "related": 0 }, { "id": "T1491.001", "name": "Internal Defacement", "tactics": [ "impact" ], "sources": [ "report" ], "structural": false, "own": [], "community": 4, "related": 0 }, { "id": "T1531", "name": "Account Access Removal", "tactics": [ "impact" ], "sources": [ "report" ], "structural": false, "own": [], "community": 9, "related": 0 }, { "id": "T1562.001", "name": "T1562.001", "tactics": [], "sources": [ "report" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1562.004", "name": "T1562.004", "tactics": [], "sources": [ "report" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1685", "name": "Disable or Modify Tools", "tactics": [ "defense-impairment" ], "sources": [ "report" ], "structural": false, "own": [], "community": 162, "related": 44 }, { "id": "T1685.005", "name": "Clear Windows Event Logs", "tactics": [ "defense-impairment" ], "sources": [ "report" ], "structural": false, "own": [], "community": 8, "related": 162 }, { "id": "T1686", "name": "Disable or Modify System Firewall", "tactics": [ "defense-impairment" ], "sources": [ "report" ], "structural": false, "own": [], "community": 7, "related": 27 } ], "cves": [], "indicators": { "list": [ { "type": "ipv4", "value": "104.164.55.46", "source": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/" }, { "type": "ipv4", "value": "104.28.162.228", "source": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/" }, { "type": "ipv4", "value": "104.28.163.162", "source": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/" }, { "type": "ipv4", "value": "146.70.117.239", "source": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/" }, { "type": "ipv4", "value": "149.102.229.154", "source": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/" }, { "type": "ipv4", "value": "192.42.116.12", "source": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/" }, { "type": "ipv4", "value": "192.42.116.50", "source": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/" }, { "type": "ipv4", "value": "192.42.116.52", "source": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/" }, { "type": "ipv4", "value": "192.42.116.56", "source": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/" }, { "type": "ipv4", "value": "192.42.116.97", "source": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/" }, { "type": "ipv4", "value": "37.19.210.12", "source": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/" }, { "type": "ipv4", "value": "64.190.76.14", "source": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/" } ], "withheld": 0 }, "rules": [], "coverage": { "techniques": 17, "defendable": 17, "covered": 14, "uncovered": [ "T1070.001", "T1562.001", "T1562.004" ] } }, { "slug": "anubis", "group": "anubis", "name": "Anubis", "note": null, "attck": [], "activity": { "postings": 17, "first": "2026-08-10", "last": "2026-11-07", "countries": { "DE": 4, "US": 6, "??": 6, "GB": 1 }, "sectors": { "manufacturing": 5, "healthcare": 6, "unknown": 1, "services": 3, "technology": 1, "finance": 1 }, "recent": [ { "date": "2026-11-07", "name": "Kahler Automation", "country": "DE", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/S2FobGVyIEF1dG9tYXRpb25AYW51Ymlz" }, { "date": "2026-10-28", "name": "Santiam Hospital & Clinics", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/U2FudGlhbSBIb3NwaXRhbCAmIENsaW5pY3NAYW51Ymlz" }, { "date": "2026-10-25", "name": "Newcomer Cremations, Funerals & Receptions", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/TmV3Y29tZXIgQ3JlbWF0aW9ucywgRnVuZXJhbHMgJiBSZWNlcHRpb25zQGFudWJpcw" }, { "date": "2026-10-20", "name": "Fisher59", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/RmlzaGVyNTlAYW51Ymlz" }, { "date": "2026-10-09", "name": "Mynd", "country": "??", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/TXluZEBhbnViaXM" }, { "date": "2026-10-07", "name": "Leadec", "country": "DE", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/TGVhZGVjQGFudWJpcw" }, { "date": "2026-09-22", "name": "Gaedke & Partner Steuerberatung", "country": "DE", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/R2FlZGtlICYgUGFydG5lciBTdGV1ZXJiZXJhdHVuZ0BhbnViaXM=" }, { "date": "2026-09-21", "name": "Summa Gold", "country": "??", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/U3VtbWEgR29sZEBhbnViaXM=" }, { "date": "2026-09-18", "name": "Quest Group", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/UXVlc3QgR3JvdXBAYW51Ymlz" }, { "date": "2026-09-14", "name": "Better Accounting Solutions", "country": "??", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/QmV0dGVyIEFjY291bnRpbmcgU29sdXRpb25zQGFudWJpcw==" }, { "date": "2026-09-09", "name": "Gellibrand Support Services", "country": "??", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/R2VsbGlicmFuZCBTdXBwb3J0IFNlcnZpY2VzQGFudWJpcw==" }, { "date": "2026-09-02", "name": "Marlborough Partners", "country": "GB", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/TWFybGJvcm91Z2ggUGFydG5lcnNAYW51Ymlz" } ] }, "convergences": [ { "name": "Fisher59, LLC", "flagged": "2026-11-07", "classes": [ "leak", "notice" ], "curated": false, "hand_picked": false }, { "name": "Interim HealthCare Inc.", "flagged": "2026-09-11", "classes": [ "leak", "litigation", "notice" ], "curated": false, "hand_picked": false } ], "reports": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments/", "publisher": "Microsoft Threat Intelligence", "published": "2026-09-24", "title": "Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments", "origin": "feed", "primary": false } ], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "byod", "group": "byod", "name": "BYOD", "note": null, "attck": [], "activity": { "postings": 17, "first": "2026-10-05", "last": "2026-11-05", "countries": { "??": 9, "GB": 1, "US": 4, "SG": 1, "MY": 2 }, "sectors": { "consumer": 4, "education": 3, "unknown": 2, "technology": 4, "finance": 1, "services": 1, "manufacturing": 2 }, "recent": [ { "date": "2026-11-05", "name": "First and Final Warning - IHG Hotels & Resorts (Estate)", "country": "??", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/Rmlyc3QgYW5kIEZpbmFsIFdhcm5pbmcgLSBJSEcgSG90ZWxzICYgUmVzb3J0cyAoRXN0YXRlKUBCWU9E" }, { "date": "2026-11-04", "name": "IHG Hotels & Resorts (Estate)", "country": "GB", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/SUhHIEhvdGVscyAmIFJlc29ydHMgKEVzdGF0ZSlAQllPRA" }, { "date": "2026-11-02", "name": "Michigan State University", "country": "US", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/TWljaGlnYW4gU3RhdGUgVW5pdmVyc2l0eUBCWU9E" }, { "date": "2026-10-27", "name": "UPDATE: UNM", "country": "??", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/VVBEQVRFOiBVTk1AQllPRA" }, { "date": "2026-10-26", "name": "University of New Mexico", "country": "US", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/VW5pdmVyc2l0eSBvZiBOZXcgTWV4aWNvQEJZT0Q" }, { "date": "2026-10-17", "name": "Decorolala - 500 Line Sample", "country": "??", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/RGVjb3JvbGFsYSAtIDUwMCBMaW5lIFNhbXBsZUBCWU9E" }, { "date": "2026-10-13", "name": "Decorolala", "country": "??", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/RGVjb3JvbGFsYUBCWU9E" }, { "date": "2026-10-08", "name": "Some semi-samples Of Liberty X TMO cause we got yappatrons on twitter", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/U29tZSBzZW1pLXNhbXBsZXMgT2YgTGliZXJ0eSBYIFRNTyBjYXVzZSB3ZSBnb3QgeWFwcGF0cm9ucyBvbiB0d2l0dGVyQEJZT0Q" }, { "date": "2026-10-07", "name": "TMobile", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/VE1vYmlsZUBCWU9E" }, { "date": "2026-10-07", "name": "Gate | Crypto Exchange", "country": "SG", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/R2F0ZSB8IENyeXB0byBFeGNoYW5nZUBCWU9E" }, { "date": "2026-10-05", "name": "Standpointe / Trinite Solutions", "country": "??", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/U3RhbmRwb2ludGUgLyBUcmluaXRlIFNvbHV0aW9uc0BCWU9E" }, { "date": "2026-10-05", "name": "Franklin Empire", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/RnJhbmtsaW4gRW1waXJlQEJZT0Q" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "iah6477", "group": "iah6477", "name": "iah6477", "note": null, "attck": [], "activity": { "postings": 16, "first": "2026-08-20", "last": "2026-10-18", "countries": { "US": 10, "??": 5, "GB": 1 }, "sectors": { "services": 3, "agriculture": 2, "manufacturing": 5, "unknown": 1, "consumer": 3, "finance": 1, "technology": 1 }, "recent": [ { "date": "2026-10-18", "name": "mckenneys", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/bWNrZW5uZXlzQGlhaDY0Nzc" }, { "date": "2026-10-15", "name": "hilmar-cheese", "country": "US", "sectors": [ "agriculture" ], "url": "https://www.ransomware.live/id/aGlsbWFyLWNoZWVzZUBpYWg2NDc3" }, { "date": "2026-10-15", "name": "middleby", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/bWlkZGxlYnlAaWFoNjQ3Nw" }, { "date": "2026-10-15", "name": "sunshine-mills", "country": "??", "sectors": [ "agriculture" ], "url": "https://www.ransomware.live/id/c3Vuc2hpbmUtbWlsbHNAaWFoNjQ3Nw" }, { "date": "2026-10-15", "name": "hensley", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/aGVuc2xleUBpYWg2NDc3" }, { "date": "2026-10-15", "name": "buckle", "country": "??", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/YnVja2xlQGlhaDY0Nzc" }, { "date": "2026-10-15", "name": "camden-living", "country": "GB", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/Y2FtZGVuLWxpdmluZ0BpYWg2NDc3" }, { "date": "2026-10-15", "name": "alera", "country": "??", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/YWxlcmFAaWFoNjQ3Nw" }, { "date": "2026-09-15", "name": "veritiv", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/dmVyaXRpdkBpYWg2NDc3" }, { "date": "2026-08-29", "name": "swagelok", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/c3dhZ2Vsb2tAaWFoNjQ3Nw==" }, { "date": "2026-08-29", "name": "trc-companies", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/dHJjLWNvbXBhbmllc0BpYWg2NDc3" }, { "date": "2026-08-26", "name": "proampac", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/cHJvYW1wYWNAaWFoNjQ3Nw==" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "deadlock", "group": "deadlock", "name": "DeadLock", "note": null, "attck": [], "activity": { "postings": 14, "first": "2026-08-10", "last": "2026-10-24", "countries": { "US": 4, "DE": 1, "ZA": 2, "ES": 1, "IT": 1, "GR": 1, "GB": 1, "TW": 1, "TR": 1, "PH": 1 }, "sectors": { "manufacturing": 5, "unknown": 5, "healthcare": 1, "agriculture": 1, "services": 1, "transportation": 1 }, "recent": [ { "date": "2026-10-24", "name": "Trinity Custom Homes", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/VHJpbml0eSBDdXN0b20gSG9tZXNARGVhZGxvY2s" }, { "date": "2026-10-23", "name": "Hensel Elektrik", "country": "DE", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/SGVuc2VsIEVsZWt0cmlrQERlYWRsb2Nr" }, { "date": "2026-10-12", "name": "Aeroklas Duys / Duys Engineering Group", "country": "ZA", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/QWVyb2tsYXMgRHV5cyAvIER1eXMgRW5naW5lZXJpbmcgR3JvdXBARGVhZGxvY2s" }, { "date": "2026-10-09", "name": "Saber1", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/U2FiZXIxQERlYWRsb2Nr" }, { "date": "2026-10-09", "name": "idi pharma", "country": "ES", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/aWRpIHBoYXJtYUBEZWFkbG9jaw" }, { "date": "2026-10-06", "name": "Greggio Argento", "country": "IT", "sectors": [ "agriculture" ], "url": "https://www.ransomware.live/id/R3JlZ2dpbyBBcmdlbnRvQERlYWRsb2Nr" }, { "date": "2026-10-02", "name": "UNION FA", "country": "GR", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/VU5JT04gRkFARGVhZGxvY2s=" }, { "date": "2026-10-02", "name": "Far West Contractors", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/RmFyIFdlc3QgQ29udHJhY3RvcnNARGVhZGxvY2s=" }, { "date": "2026-08-24", "name": "SHAHEEN LAW GROUP PLC - Richmond, Virginia, USA", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/U0hBSEVFTiBMQVcgR1JPVVAgUExDIC0gUmljaG1vbmQsIFZpcmdpbmlhLCBVU0FARGVhZGxvY2s=" }, { "date": "2026-08-24", "name": "FBC", "country": "ZA", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/RkJDQERlYWRsb2Nr" }, { "date": "2026-08-20", "name": "JP Molyneux Studio", "country": "GB", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/SlAgTW9seW5ldXggU3R1ZGlvQERlYWRsb2Nr" }, { "date": "2026-08-19", "name": "UFOC", "country": "TW", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/VUZPQ0BEZWFkbG9jaw==" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "hyflock", "group": "hyflock", "name": "HYFLOCK", "note": null, "attck": [], "activity": { "postings": 13, "first": "2026-10-13", "last": "2026-11-02", "countries": { "TR": 2, "US": 2, "GA": 1, "VN": 1, "CA": 1, "BR": 1, "SA": 1, "NG": 1, "IN": 1, "??": 1, "EC": 1 }, "sectors": { "manufacturing": 2, "technology": 3, "healthcare": 1, "unknown": 3, "finance": 1, "energy": 1, "consumer": 1, "government": 1 }, "recent": [ { "date": "2026-11-02", "name": "Ateşsan Ambalaj", "country": "TR", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/QXRlxZ9zYW4gQW1iYWxhakBIWUZMT0NL" }, { "date": "2026-11-01", "name": "hitech group", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/aGl0ZWNoIGdyb3VwQEhZRkxPQ0s" }, { "date": "2026-10-25", "name": "Aesthetic Dental Designs, P.A", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/QWVzdGhldGljIERlbnRhbCBEZXNpZ25zLCBQLkFASFlGTE9DSw" }, { "date": "2026-10-21", "name": "gabonmeca.com leak incident", "country": "GA", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/Z2Fib25tZWNhLmNvbSBsZWFrIGluY2lkZW50QEhZRkxPQ0s" }, { "date": "2026-10-21", "name": "dangvuongcac", "country": "VN", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/ZGFuZ3Z1b25nY2FjQEhZRkxPQ0s" }, { "date": "2026-10-13", "name": "YYC Advisors", "country": "CA", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/WVlDIEFkdmlzb3JzQEhZRkxPQ0s" }, { "date": "2026-10-13", "name": "Cooper Tec Solutions", "country": "BR", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/Q29vcGVyIFRlYyBTb2x1dGlvbnNASFlGTE9DSw" }, { "date": "2026-10-13", "name": "nodhom.com", "country": "SA", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/bm9kaG9tLmNvbUBIWUZMT0NL" }, { "date": "2026-10-13", "name": "IGPL", "country": "NG", "sectors": [ "energy" ], "url": "https://www.ransomware.live/id/SUdQTEBIWUZMT0NL" }, { "date": "2026-10-13", "name": "ocean beverages", "country": "IN", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/b2NlYW4gYmV2ZXJhZ2VzQEhZRkxPQ0s" }, { "date": "2026-10-13", "name": "tdotnet", "country": "??", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/dGRvdG5ldEBIWUZMT0NL" }, { "date": "2026-10-13", "name": "Ecuador police headquarters", "country": "EC", "sectors": [ "government" ], "url": "https://www.ransomware.live/id/RWN1YWRvciBwb2xpY2UgaGVhZHF1YXJ0ZXJzQEhZRkxPQ0s" } ] }, "convergences": [], "reports": [ { "url": "https://asec.ahnlab.com/en/95933/", "publisher": "AhnLab ASEC", "published": "2026-10-20", "title": "Ransom & Dark Web Issues Week 4, October 2026", "origin": "feed", "primary": false } ], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "spacebears", "group": "spacebears", "name": "spacebears", "note": null, "attck": [], "activity": { "postings": 13, "first": "2026-08-10", "last": "2026-10-22", "countries": { "US": 5, "IT": 3, "PT": 1, "DE": 1, "CZ": 1, "MX": 1, "CH": 1 }, "sectors": { "services": 2, "healthcare": 4, "manufacturing": 2, "consumer": 3, "unknown": 1, "agriculture": 1 }, "recent": [ { "date": "2026-10-22", "name": "SGLA (Schwartz, Giannini, Lantsberger & Adamson)", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/U0dMQSAoU2Nod2FydHosIEdpYW5uaW5pLCBMYW50c2JlcmdlciAmIEFkYW1zb24pQHNwYWNlYmVhcnM" }, { "date": "2026-10-15", "name": "Alma Center Servizi Medicali S.r.l.", "country": "IT", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/QWxtYSBDZW50ZXIgU2Vydml6aSBNZWRpY2FsaSBTLnIubC5Ac3BhY2ViZWFycw" }, { "date": "2026-10-15", "name": "Holistic Health Group, Inc. (d/b/a Suncrafted)", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/SG9saXN0aWMgSGVhbHRoIEdyb3VwLCBJbmMuIChkL2IvYSBTdW5jcmFmdGVkKUBzcGFjZWJlYXJz" }, { "date": "2026-09-23", "name": "Tomix / Grupo JOPER", "country": "PT", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/VG9taXggLyBHcnVwbyBKT1BFUkBzcGFjZWJlYXJz" }, { "date": "2026-09-05", "name": "D-MAX Engineering, Inc", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/RC1NQVggRW5naW5lZXJpbmcsIEluY0BzcGFjZWJlYXJz" }, { "date": "2026-09-04", "name": "Sports Endeavors", "country": "US", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/U3BvcnRzIEVuZGVhdm9yc0BzcGFjZWJlYXJz" }, { "date": "2026-09-04", "name": "Schwartz, Giannini, Lantsberger & Adamson (SGLA)", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/U2Nod2FydHosIEdpYW5uaW5pLCBMYW50c2JlcmdlciAmIEFkYW1zb24gKFNHTEEpQHNwYWNlYmVhcnM=" }, { "date": "2026-09-03", "name": "Studio Oculistico Ciraci", "country": "IT", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/U3R1ZGlvIE9jdWxpc3RpY28gQ2lyYWNpQHNwYWNlYmVhcnM=" }, { "date": "2026-08-22", "name": "holzmarkt chemnitz", "country": "DE", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/aG9sem1hcmt0IGNoZW1uaXR6QHNwYWNlYmVhcnM=" }, { "date": "2026-08-22", "name": "Freelom", "country": "CZ", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/RnJlZWxvbUBzcGFjZWJlYXJz" }, { "date": "2026-08-15", "name": "SEARS (Grupo Sanborns)", "country": "MX", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/U0VBUlMgKEdydXBvIFNhbmJvcm5zKUBzcGFjZWJlYXJz" }, { "date": "2026-08-12", "name": "Basso Fedele & Figli S.r.l. (Olio Basso) / Villa Raiano", "country": "IT", "sectors": [ "agriculture" ], "url": "https://www.ransomware.live/id/QmFzc28gRmVkZWxlICYgRmlnbGkgUy5yLmwuIChPbGlvIEJhc3NvKSAvIFZpbGxhIFJhaWFub0BzcGFjZWJlYXJz" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "barracuda", "group": "barracuda", "name": "Barracuda", "note": null, "attck": [], "activity": { "postings": 12, "first": "2026-08-15", "last": "2026-11-01", "countries": { "TR": 2, "DK": 1, "HR": 1, "EC": 1, "??": 2, "AR": 1, "US": 2, "KR": 1, "BR": 1 }, "sectors": { "technology": 2, "transportation": 2, "agriculture": 1, "manufacturing": 2, "unknown": 2, "healthcare": 2, "services": 1 }, "recent": [ { "date": "2026-11-01", "name": "EVINOKS", "country": "TR", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/RVZJTk9LU0BCYXJyYWN1ZGE" }, { "date": "2026-10-28", "name": "Femern Link Contractors", "country": "DK", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/RmVtZXJuIExpbmsgQ29udHJhY3RvcnNAQmFycmFjdWRh" }, { "date": "2026-10-09", "name": "Ministarstvo poljoprivrede, šumarstva i ribarstva", "country": "HR", "sectors": [ "agriculture" ], "url": "https://www.ransomware.live/id/TWluaXN0YXJzdHZvIHBvbGpvcHJpdnJlZGUsIMWhdW1hcnN0dmEgaSByaWJhcnN0dmFAQmFycmFjdWRh" }, { "date": "2026-10-02", "name": "Automovil Club del Ecuador ANETA", "country": "EC", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/QXV0b21vdmlsIENsdWIgZGVsIEVjdWFkb3IgQU5FVEFAQmFycmFjdWRh" }, { "date": "2026-09-26", "name": "International Chemical Co.", "country": "??", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/SW50ZXJuYXRpb25hbCBDaGVtaWNhbCBDby5AQmFycmFjdWRh" }, { "date": "2026-09-24", "name": "Solucioning S.A.", "country": "AR", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/U29sdWNpb25pbmcgUy5BLkBCYXJyYWN1ZGE=" }, { "date": "2026-09-23", "name": "Abtach Ltd.", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/QWJ0YWNoIEx0ZC5AQmFycmFjdWRh" }, { "date": "2026-09-13", "name": "i2i-systems", "country": "TR", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/aTJpLXN5c3RlbXNAQmFycmFjdWRh" }, { "date": "2026-08-23", "name": "Skyline Implants & Periodontics", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/U2t5bGluZSBJbXBsYW50cyAmIFBlcmlvZG9udGljc0BCYXJyYWN1ZGE=" }, { "date": "2026-08-23", "name": "Namyang Industrial Co., Ltd.", "country": "KR", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/TmFteWFuZyBJbmR1c3RyaWFsIENvLiwgTHRkLkBCYXJyYWN1ZGE=" }, { "date": "2026-08-23", "name": "Clinical Associates of the Finger Lakes (CAFL)", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/Q2xpbmljYWwgQXNzb2NpYXRlcyBvZiB0aGUgRmluZ2VyIExha2VzIChDQUZMKUBCYXJyYWN1ZGE=" }, { "date": "2026-08-15", "name": "VR Advogados", "country": "BR", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/VlIgQWR2b2dhZG9zQEJhcnJhY3VkYQ==" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "doommageddon", "group": "doommageddon", "name": "Doommageddon", "note": null, "attck": [], "activity": { "postings": 12, "first": "2026-08-28", "last": "2026-11-04", "countries": { "TR": 5, "??": 4, "IN": 2, "US": 1 }, "sectors": { "manufacturing": 2, "unknown": 5, "technology": 1, "education": 1, "transportation": 2, "government": 1 }, "recent": [ { "date": "2026-11-04", "name": "ASLAN TEKSTİL ve KONFEKSİYON San.ve Tic. A.Ş.", "country": "TR", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/QVNMQU4gVEVLU1TEsEwgdmUgS09ORkVLU8SwWU9OIFNhbi52ZSBUaWMuIEEuxZ4uQERvb21tYWdlZGRvbg" }, { "date": "2026-10-30", "name": "A***** T******", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/QSoqKioqIFQqKioqKipARG9vbW1hZ2VkZG9u" }, { "date": "2026-10-26", "name": "Referans Lab Ref-Lab", "country": "TR", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/UmVmZXJhbnMgTGFiIFJlZi1MYWJARG9vbW1hZ2VkZG9u" }, { "date": "2026-10-23", "name": "R*********b R**-L**", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/UioqKioqKioqKmIgUioqLUwqKkBEb29tbWFnZWRkb24" }, { "date": "2026-10-05", "name": "ENKA Schools", "country": "TR", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/RU5LQSBTY2hvb2xzQERvb21tYWdlZGRvbg" }, { "date": "2026-10-05", "name": "Cam Group LLC", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Q2FtIEdyb3VwIExMQ0BEb29tbWFnZWRkb24" }, { "date": "2026-09-28", "name": "Goodrich Logistics", "country": "??", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/R29vZHJpY2ggTG9naXN0aWNzQERvb21tYWdlZGRvbg==" }, { "date": "2026-09-28", "name": "Chem Process Systems Pvt. Ltd.", "country": "IN", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/Q2hlbSBQcm9jZXNzIFN5c3RlbXMgUHZ0LiBMdGQuQERvb21tYWdlZGRvbg==" }, { "date": "2026-09-21", "name": "Charlottesville Police Department", "country": "US", "sectors": [ "government" ], "url": "https://www.ransomware.live/id/Q2hhcmxvdHRlc3ZpbGxlIFBvbGljZSBEZXBhcnRtZW50QERvb21tYWdlZGRvbg==" }, { "date": "2026-09-13", "name": "INCOR Group", "country": "IN", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/SU5DT1IgR3JvdXBARG9vbW1hZ2VkZG9u" }, { "date": "2026-08-28", "name": "SITTNAK Lojistik A.Ş.", "country": "TR", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/U0lUVE5BSyBMb2ppc3RpayBBLsWeLkBEb29tbWFnZWRkb24=" }, { "date": "2026-08-28", "name": "Akpera Gayrimenkul Yatırım A.Ş.", "country": "TR", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/QWtwZXJhIEdheXJpbWVua3VsIFlhdMSxcsSxbSBBLsWeLkBEb29tbWFnZWRkb24=" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "helix", "group": "helix", "name": "Helix", "note": null, "attck": [], "activity": { "postings": 12, "first": "2026-08-16", "last": "2026-10-21", "countries": { "US": 12 }, "sectors": { "consumer": 1, "manufacturing": 5, "education": 1, "healthcare": 1, "services": 2, "energy": 2 }, "recent": [ { "date": "2026-10-21", "name": "Westrock Coffee", "country": "US", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/V2VzdHJvY2sgQ29mZmVlQEhlbGl4" }, { "date": "2026-10-21", "name": "Hypertherm", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/SHlwZXJ0aGVybUBIZWxpeA" }, { "date": "2026-10-19", "name": "American Campus", "country": "US", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/QW1lcmljYW4gQ2FtcHVzQEhlbGl4" }, { "date": "2026-10-18", "name": "Southwire", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/U291dGh3aXJlQEhlbGl4" }, { "date": "2026-10-18", "name": "Quikrete", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/UXVpa3JldGVASGVsaXg" }, { "date": "2026-10-17", "name": "Personify Health", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/UGVyc29uaWZ5IEhlYWx0aEBIZWxpeA" }, { "date": "2026-10-17", "name": "Bay Alarm", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/QmF5IEFsYXJtQEhlbGl4" }, { "date": "2026-10-17", "name": "Smith Douglas Homes", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/U21pdGggRG91Z2xhcyBIb21lc0BIZWxpeA" }, { "date": "2026-10-17", "name": "Rheem Global", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/UmhlZW0gR2xvYmFsQEhlbGl4" }, { "date": "2026-08-22", "name": "AmSpec", "country": "US", "sectors": [ "energy" ], "url": "https://www.ransomware.live/id/QW1TcGVjQEhlbGl4" }, { "date": "2026-08-19", "name": "Delek US", "country": "US", "sectors": [ "energy" ], "url": "https://www.ransomware.live/id/RGVsZWsgVVNASGVsaXg=" }, { "date": "2026-08-16", "name": "Kennedy Jenks", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/S2VubmVkeSBKZW5rc0BIZWxpeA==" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "threeam", "group": "threeam", "name": "3AM", "note": null, "attck": [], "activity": { "postings": 11, "first": "2026-08-19", "last": "2026-10-09", "countries": { "US": 4, "GB": 1, "CO": 1, "AR": 1, "DE": 1, "AU": 1, "MD": 1, "MX": 1 }, "sectors": { "transportation": 1, "manufacturing": 3, "healthcare": 1, "technology": 2, "services": 1, "education": 1, "unknown": 2 }, "recent": [ { "date": "2026-10-09", "name": "fleetworksinc.com", "country": "US", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/ZmxlZXR3b3Jrc2luYy5jb21AdGhyZWVhbQ" }, { "date": "2026-09-28", "name": "safescaffolding.net", "country": "GB", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/c2FmZXNjYWZmb2xkaW5nLm5ldEB0aHJlZWFt" }, { "date": "2026-09-28", "name": "coosalud.com", "country": "CO", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/Y29vc2FsdWQuY29tQHRocmVlYW0=" }, { "date": "2026-09-28", "name": "pistonespersan.com.ar", "country": "AR", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/cGlzdG9uZXNwZXJzYW4uY29tLmFyQHRocmVlYW0=" }, { "date": "2026-09-28", "name": "midwestbit.com", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/bWlkd2VzdGJpdC5jb21AdGhyZWVhbQ==" }, { "date": "2026-09-28", "name": "apexus.com", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/YXBleHVzLmNvbUB0aHJlZWFt" }, { "date": "2026-09-28", "name": "bhn-expertise.com", "country": "DE", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/YmhuLWV4cGVydGlzZS5jb21AdGhyZWVhbQ==" }, { "date": "2026-09-28", "name": "stjames.wa.edu.au", "country": "AU", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/c3RqYW1lcy53YS5lZHUuYXVAdGhyZWVhbQ==" }, { "date": "2026-09-21", "name": "newmantractor.com", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/bmV3bWFudHJhY3Rvci5jb21AdGhyZWVhbQ==" }, { "date": "2026-08-30", "name": "wmdn.net", "country": "MD", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/d21kbi5uZXRAdGhyZWVhbQ==" }, { "date": "2026-08-19", "name": "mecasem.org", "country": "MX", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/bWVjYXNlbS5vcmdAdGhyZWVhbQ==" } ] }, "convergences": [ { "name": "Mogren, Glessner & Ahrens, P.S.", "flagged": "2026-09-04", "classes": [ "leak", "notice" ], "curated": false, "hand_picked": false } ], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "arcusmedia", "group": "arcusmedia", "name": "arcusmedia", "note": null, "attck": [], "activity": { "postings": 11, "first": "2026-08-24", "last": "2026-10-09", "countries": { "BR": 3, "CA": 2, "MX": 1, "PE": 1, "??": 3, "CR": 1 }, "sectors": { "unknown": 3, "manufacturing": 2, "agriculture": 2, "technology": 2, "government": 1, "services": 1 }, "recent": [ { "date": "2026-10-09", "name": "AETHOS", "country": "BR", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/QUVUSE9TQGFyY3VzbWVkaWE" }, { "date": "2026-10-09", "name": "mblllp", "country": "CA", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/bWJsbGxwQGFyY3VzbWVkaWE" }, { "date": "2026-10-09", "name": "Ladrillera Mecanizada", "country": "MX", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/TGFkcmlsbGVyYSBNZWNhbml6YWRhQGFyY3VzbWVkaWE" }, { "date": "2026-09-27", "name": "Pantaneiro Capas", "country": "BR", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/UGFudGFuZWlybyBDYXBhc0BhcmN1c21lZGlh" }, { "date": "2026-09-23", "name": "AGROFRUTO SAC", "country": "PE", "sectors": [ "agriculture" ], "url": "https://www.ransomware.live/id/QUdST0ZSVVRPIFNBQ0BhcmN1c21lZGlh" }, { "date": "2026-09-19", "name": "Schneider’s Computing", "country": "CA", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/U2NobmVpZGVy4oCZcyBDb21wdXRpbmdAYXJjdXNtZWRpYQ==" }, { "date": "2026-09-19", "name": "AKAZZO", "country": "BR", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/QUtBWlpPQGFyY3VzbWVkaWE=" }, { "date": "2026-09-16", "name": "ARDA", "country": "??", "sectors": [ "government" ], "url": "https://www.ransomware.live/id/QVJEQUBhcmN1c21lZGlh" }, { "date": "2026-09-15", "name": "Asada Sarapiqu", "country": "CR", "sectors": [ "agriculture" ], "url": "https://www.ransomware.live/id/QXNhZGEgU2FyYXBpcXVAYXJjdXNtZWRpYQ==" }, { "date": "2026-08-24", "name": "ManagementPro", "country": "??", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/TWFuYWdlbWVudFByb0BhcmN1c21lZGlh" }, { "date": "2026-08-24", "name": "Mark’Techno", "country": "??", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/TWFya+KAmVRlY2hub0BhcmN1c21lZGlh" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "insomnia", "group": "insomnia", "name": "insomnia", "note": null, "attck": [], "activity": { "postings": 11, "first": "2026-08-17", "last": "2026-10-05", "countries": { "US": 11 }, "sectors": { "healthcare": 5, "services": 3, "unknown": 2, "technology": 1 }, "recent": [ { "date": "2026-10-05", "name": "Praxis EMR", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/UHJheGlzIEVNUkBpbnNvbW5pYQ" }, { "date": "2026-09-15", "name": "Wiggins, Childs, Pantazis, Fisher, & Goldfarb LLC", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/V2lnZ2lucywgQ2hpbGRzLCBQYW50YXppcywgRmlzaGVyLCAmIEdvbGRmYXJiIExMQ0BpbnNvbW5pYQ==" }, { "date": "2026-09-14", "name": "Metropolitan Community Health Services", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/TWV0cm9wb2xpdGFuIENvbW11bml0eSBIZWFsdGggU2VydmljZXNAaW5zb21uaWE=" }, { "date": "2026-09-14", "name": "Massey, Stotser & Nichols", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/TWFzc2V5LCBTdG90c2VyICYgTmljaG9sc0BpbnNvbW5pYQ==" }, { "date": "2026-09-07", "name": "NorthShore Health Centers", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/Tm9ydGhTaG9yZSBIZWFsdGggQ2VudGVyc0BpbnNvbW5pYQ==" }, { "date": "2026-09-03", "name": "Maglin, Miskiv & Associates", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/TWFnbGluLCBNaXNraXYgJiBBc3NvY2lhdGVzQGluc29tbmlh" }, { "date": "2026-09-02", "name": "N***************", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/TioqKioqKioqKioqKioqKkBpbnNvbW5pYQ==" }, { "date": "2026-08-31", "name": "Metro Tulsa Foot", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/TWV0cm8gVHVsc2EgRm9vdEBpbnNvbW5pYQ==" }, { "date": "2026-08-19", "name": "Aurora Health Management", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/QXVyb3JhIEhlYWx0aCBNYW5hZ2VtZW50QGluc29tbmlh" }, { "date": "2026-08-19", "name": "***********", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/KioqKioqKioqKipAaW5zb21uaWE=" }, { "date": "2026-08-17", "name": "Codinter", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/Q29kaW50ZXJAaW5zb21uaWE=" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "kazu", "group": "kazu", "name": "kazu", "note": null, "attck": [], "activity": { "postings": 11, "first": "2026-08-23", "last": "2026-09-07", "countries": { "CA": 2, "US": 3, "AR": 1, "BR": 2, "PK": 1, "MX": 2 }, "sectors": { "education": 2, "healthcare": 8, "services": 1 }, "recent": [ { "date": "2026-09-07", "name": "MSM Unify: Global Education Platform - CA", "country": "CA", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/TVNNIFVuaWZ5OiBHbG9iYWwgRWR1Y2F0aW9uIFBsYXRmb3JtIC0gQ0FAa2F6dQ==" }, { "date": "2026-09-05", "name": "Spirit Cultural Exchange - US", "country": "US", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/U3Bpcml0IEN1bHR1cmFsIEV4Y2hhbmdlIC0gVVNAa2F6dQ==" }, { "date": "2026-08-23", "name": "PappyJoe: Healthcare Management System", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/UGFwcHlKb2U6IEhlYWx0aGNhcmUgTWFuYWdlbWVudCBTeXN0ZW1Aa2F6dQ==" }, { "date": "2026-08-23", "name": "Instituto Ferrero de Neurología y Sueño", "country": "AR", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/SW5zdGl0dXRvIEZlcnJlcm8gZGUgTmV1cm9sb2fDrWEgeSBTdWXDsW9Aa2F6dQ==" }, { "date": "2026-08-23", "name": "Brazil Mobilemed: Cloud PACS Platform", "country": "BR", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/QnJhemlsIE1vYmlsZW1lZDogQ2xvdWQgUEFDUyBQbGF0Zm9ybUBrYXp1" }, { "date": "2026-08-23", "name": "Canada Yocale: Appointment Management System", "country": "CA", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/Q2FuYWRhIFlvY2FsZTogQXBwb2ludG1lbnQgTWFuYWdlbWVudCBTeXN0ZW1Aa2F6dQ==" }, { "date": "2026-08-23", "name": "PawlyClinic: Digital Veterinary Care Platform", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/UGF3bHlDbGluaWM6IERpZ2l0YWwgVmV0ZXJpbmFyeSBDYXJlIFBsYXRmb3JtQGthenU=" }, { "date": "2026-08-23", "name": "Dr Akbar Niazi Teaching Hospital", "country": "PK", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/RHIgQWtiYXIgTmlhemkgVGVhY2hpbmcgSG9zcGl0YWxAa2F6dQ==" }, { "date": "2026-08-23", "name": "Centro Médico Especializado OSI: Healthcare Solutions", "country": "MX", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/Q2VudHJvIE3DqWRpY28gRXNwZWNpYWxpemFkbyBPU0k6IEhlYWx0aGNhcmUgU29sdXRpb25zQGthenU=" }, { "date": "2026-08-23", "name": "Meducar: Telemedicine and Patient Management System", "country": "BR", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/TWVkdWNhcjogVGVsZW1lZGljaW5lIGFuZCBQYXRpZW50IE1hbmFnZW1lbnQgU3lzdGVtQGthenU=" }, { "date": "2026-08-23", "name": "ConsultorioMovil: Telemedicine and Healthcare System", "country": "MX", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/Q29uc3VsdG9yaW9Nb3ZpbDogVGVsZW1lZGljaW5lIGFuZCBIZWFsdGhjYXJlIFN5c3RlbUBrYXp1" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "scarlettgroup", "group": "scarlettgroup", "name": "Scarlettgroup", "note": null, "attck": [], "activity": { "postings": 11, "first": "2026-10-08", "last": "2026-11-04", "countries": { "US": 6, "??": 1, "CA": 1, "IN": 2, "MY": 1 }, "sectors": { "manufacturing": 1, "healthcare": 2, "consumer": 2, "finance": 1, "services": 1, "government": 1, "technology": 2, "education": 1 }, "recent": [ { "date": "2026-11-04", "name": "sigsauer.com", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/c2lnc2F1ZXIuY29tQFNjYXJsZXR0Z3JvdXA" }, { "date": "2026-11-03", "name": "medinahealthcare.net", "country": "??", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/bWVkaW5haGVhbHRoY2FyZS5uZXRAU2NhcmxldHRncm91cA" }, { "date": "2026-10-31", "name": "spencers.com", "country": "US", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/c3BlbmNlcnMuY29tQFNjYXJsZXR0Z3JvdXA" }, { "date": "2026-10-29", "name": "sunnybrook.ca", "country": "CA", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/c3Vubnlicm9vay5jYUBTY2FybGV0dGdyb3Vw" }, { "date": "2026-10-29", "name": "au.bank.in", "country": "IN", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/YXUuYmFuay5pbkBTY2FybGV0dGdyb3Vw" }, { "date": "2026-10-26", "name": "mahsing.com.my", "country": "MY", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/bWFoc2luZy5jb20ubXlAU2NhcmxldHRncm91cA" }, { "date": "2026-10-23", "name": "vinsolutions.com", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/dmluc29sdXRpb25zLmNvbUBTY2FybGV0dGdyb3Vw" }, { "date": "2026-10-21", "name": "police.rajasthan.gov.in", "country": "IN", "sectors": [ "government" ], "url": "https://www.ransomware.live/id/cG9saWNlLnJhamFzdGhhbi5nb3YuaW5AU2NhcmxldHRncm91cA" }, { "date": "2026-10-21", "name": "genesys.com", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/Z2VuZXN5cy5jb21AU2NhcmxldHRncm91cA" }, { "date": "2026-10-21", "name": "nbcuniversal.com", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/bmJjdW5pdmVyc2FsLmNvbUBTY2FybGV0dGdyb3Vw" }, { "date": "2026-10-08", "name": "yalebooks.yale.edu", "country": "US", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/eWFsZWJvb2tzLnlhbGUuZWR1QFNjYXJsZXR0Z3JvdXA" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "titan", "group": "titan", "name": "titan", "note": null, "attck": [], "activity": { "postings": 11, "first": "2026-08-20", "last": "2026-09-22", "countries": { "AR": 1, "??": 1, "IT": 9 }, "sectors": { "healthcare": 2, "manufacturing": 4, "unknown": 2, "energy": 1, "services": 1, "technology": 1 }, "recent": [ { "date": "2026-09-22", "name": "Grupo Hospifar S.R.L.", "country": "AR", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/R3J1cG8gSG9zcGlmYXIgUy5SLkwuQHRpdGFu" }, { "date": "2026-09-22", "name": "Sherman Chan, DDS, Inc.", "country": "??", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/U2hlcm1hbiBDaGFuLCBERFMsIEluYy5AdGl0YW4=" }, { "date": "2026-08-20", "name": "Termotecnica Industriale S.r.l.", "country": "IT", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/VGVybW90ZWNuaWNhIEluZHVzdHJpYWxlIFMuci5sLkB0aXRhbg==" }, { "date": "2026-08-20", "name": "CTP S.r.l.", "country": "IT", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Q1RQIFMuci5sLkB0aXRhbg==" }, { "date": "2026-08-20", "name": "Alto Calore Servizi SPA", "country": "IT", "sectors": [ "energy" ], "url": "https://www.ransomware.live/id/QWx0byBDYWxvcmUgU2Vydml6aSBTUEFAdGl0YW4=" }, { "date": "2026-08-20", "name": "Tedesco & Partners STP srl", "country": "IT", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/VGVkZXNjbyAmIFBhcnRuZXJzIFNUUCBzcmxAdGl0YW4=" }, { "date": "2026-08-20", "name": "POEMA S.r.l.", "country": "IT", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/UE9FTUEgUy5yLmwuQHRpdGFu" }, { "date": "2026-08-20", "name": "CONDOR SPA", "country": "IT", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/Q09ORE9SIFNQQUB0aXRhbg==" }, { "date": "2026-08-20", "name": "Elbor S.p.A.", "country": "IT", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/RWxib3IgUy5wLkEuQHRpdGFu" }, { "date": "2026-08-20", "name": "TECNOLOGICA S.r.l.", "country": "IT", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/VEVDTk9MT0dJQ0EgUy5yLmwuQHRpdGFu" }, { "date": "2026-08-20", "name": "ELCON MEGARAD S.p.A", "country": "IT", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/RUxDT04gTUVHQVJBRCBTLnAuQUB0aXRhbg==" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "bravox", "group": "bravox", "name": "bravox", "note": null, "attck": [], "activity": { "postings": 10, "first": "2026-08-10", "last": "2026-10-22", "countries": { "FR": 1, "US": 4, "MY": 1, "DE": 1, "GB": 1, "IT": 2 }, "sectors": { "unknown": 6, "technology": 2, "consumer": 1, "energy": 1 }, "recent": [ { "date": "2026-10-22", "name": "AMSAM", "country": "FR", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/QU1TQU1AYnJhdm94" }, { "date": "2026-10-22", "name": "Barrow & Grimm", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/QmFycm93ICYgR3JpbW1AYnJhdm94" }, { "date": "2026-10-21", "name": "GSE-M Technology Sdn. Bhd.", "country": "MY", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/R1NFLU0gVGVjaG5vbG9neSBTZG4uIEJoZC5AYnJhdm94" }, { "date": "2026-10-16", "name": "Minkon", "country": "DE", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/TWlua29uQGJyYXZveA" }, { "date": "2026-10-09", "name": "Dudley Land Company", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/RHVkbGV5IExhbmQgQ29tcGFueUBicmF2b3g" }, { "date": "2026-09-20", "name": "TOWILL", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/VE9XSUxMQGJyYXZveA==" }, { "date": "2026-09-01", "name": "SCHMIDT", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/U0NITUlEVEBicmF2b3g=" }, { "date": "2026-08-17", "name": "Moores", "country": "GB", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/TW9vcmVzQGJyYXZveA==" }, { "date": "2026-08-10", "name": "Elettrica System", "country": "IT", "sectors": [ "energy" ], "url": "https://www.ransomware.live/id/RWxldHRyaWNhIFN5c3RlbUBicmF2b3g=" }, { "date": "2026-08-10", "name": "Verona 83", "country": "IT", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/VmVyb25hIDgzQGJyYXZveA==" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "dysphor1a", "group": "dysphor1a", "name": "DYSPHOR1A", "note": null, "attck": [], "activity": { "postings": 10, "first": "2026-08-20", "last": "2026-09-06", "countries": { "MM": 6, "IN": 1, "TH": 2, "ID": 1 }, "sectors": { "government": 2, "finance": 2, "technology": 1, "transportation": 1, "education": 3, "insurance": 1, "services": 1 }, "recent": [ { "date": "2026-09-06", "name": "RTAD GOV MM", "country": "MM", "sectors": [ "government" ], "url": "https://www.ransomware.live/id/UlRBRCBHT1YgTU1ARFlTUEhPUjFB" }, { "date": "2026-09-05", "name": "CitizensPay", "country": "MM", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/Q2l0aXplbnNQYXlARFlTUEhPUjFB" }, { "date": "2026-09-04", "name": "MBT Telecom", "country": "MM", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/TUJUIFRlbGVjb21ARFlTUEhPUjFB" }, { "date": "2026-08-21", "name": "Yoma Fleet", "country": "MM", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/WW9tYSBGbGVldEBEWVNQSE9SMUE=" }, { "date": "2026-08-20", "name": "The University of Delhi (DU)", "country": "IN", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/VGhlIFVuaXZlcnNpdHkgb2YgRGVsaGkgKERVKUBEWVNQSE9SMUE=" }, { "date": "2026-08-20", "name": "AYUDHYA TH Insurance", "country": "TH", "sectors": [ "finance", "insurance" ], "url": "https://www.ransomware.live/id/QVlVREhZQSBUSCBJbnN1cmFuY2VARFlTUEhPUjFB" }, { "date": "2026-08-20", "name": "GUSTO College GLMS", "country": "TH", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/R1VTVE8gQ29sbGVnZSBHTE1TQERZU1BIT1IxQQ==" }, { "date": "2026-08-20", "name": "Indonesian Police Database", "country": "ID", "sectors": [ "government" ], "url": "https://www.ransomware.live/id/SW5kb25lc2lhbiBQb2xpY2UgRGF0YWJhc2VARFlTUEhPUjFB" }, { "date": "2026-08-20", "name": "Job Net .COM.MM", "country": "MM", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/Sm9iIE5ldCAuQ09NLk1NQERZU1BIT1IxQQ==" }, { "date": "2026-08-20", "name": "Strategy First International College", "country": "MM", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/U3RyYXRlZ3kgRmlyc3QgSW50ZXJuYXRpb25hbCBDb2xsZWdlQERZU1BIT1IxQQ==" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "payoutsking", "group": "payoutsking", "name": "payoutsking", "note": null, "attck": [], "activity": { "postings": 10, "first": "2026-08-27", "last": "2026-10-24", "countries": { "US": 10 }, "sectors": { "unknown": 6, "manufacturing": 1, "healthcare": 2, "services": 1 }, "recent": [ { "date": "2026-10-24", "name": "Morrow Meadows Corporation", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/TW9ycm93IE1lYWRvd3MgQ29ycG9yYXRpb25AcGF5b3V0c2tpbmc" }, { "date": "2026-10-24", "name": "Merical LLC", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/TWVyaWNhbCBMTENAcGF5b3V0c2tpbmc" }, { "date": "2026-10-24", "name": "P****y", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/UCoqKip5QHBheW91dHNraW5n" }, { "date": "2026-10-09", "name": "Merrill Iron & Steel", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/TWVycmlsbCBJcm9uICYgU3RlZWxAcGF5b3V0c2tpbmc" }, { "date": "2026-10-09", "name": "Watermark Retirement Communities", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/V2F0ZXJtYXJrIFJldGlyZW1lbnQgQ29tbXVuaXRpZXNAcGF5b3V0c2tpbmc" }, { "date": "2026-10-04", "name": "M****C", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/TSoqKipDQHBheW91dHNraW5n" }, { "date": "2026-09-26", "name": "M****n", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/TSoqKipuQHBheW91dHNraW5n" }, { "date": "2026-09-02", "name": "Proliance Surgeons", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/UHJvbGlhbmNlIFN1cmdlb25zQHBheW91dHNraW5n" }, { "date": "2026-08-28", "name": "H.W. Lochner", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/SC5XLiBMb2NobmVyQHBheW91dHNraW5n" }, { "date": "2026-08-27", "name": "W****s", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/VyoqKipzQHBheW91dHNraW5n" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "ransomhouse", "group": "ransomhouse", "name": "ransomhouse", "note": null, "attck": [], "activity": { "postings": 10, "first": "2026-09-01", "last": "2026-11-04", "countries": { "GB": 2, "US": 2, "ID": 2, "PE": 1, "BR": 1, "NA": 1, "JP": 1 }, "sectors": { "consumer": 1, "services": 1, "transportation": 1, "energy": 2, "healthcare": 1, "unknown": 2, "government": 1, "education": 1 }, "recent": [ { "date": "2026-11-04", "name": "TFG London", "country": "GB", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/VEZHIExvbmRvbkByYW5zb21ob3VzZQ" }, { "date": "2026-10-30", "name": "Phillips Nizer", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/UGhpbGxpcHMgTml6ZXJAcmFuc29taG91c2U" }, { "date": "2026-10-13", "name": "Excess Baggage", "country": "GB", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/RXhjZXNzIEJhZ2dhZ2VAcmFuc29taG91c2U" }, { "date": "2026-10-02", "name": "PT Indo Tambangraya Megah", "country": "ID", "sectors": [ "energy" ], "url": "https://www.ransomware.live/id/UFQgSW5kbyBUYW1iYW5ncmF5YSBNZWdhaEByYW5zb21ob3VzZQ==" }, { "date": "2026-10-01", "name": "Hospital Hermilio Valdizán", "country": "PE", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/SG9zcGl0YWwgSGVybWlsaW8gVmFsZGl6w6FuQHJhbnNvbWhvdXNl" }, { "date": "2026-10-01", "name": "Terca", "country": "BR", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/VGVyY2FAcmFuc29taG91c2U=" }, { "date": "2026-09-17", "name": "Pertamina", "country": "ID", "sectors": [ "energy" ], "url": "https://www.ransomware.live/id/UGVydGFtaW5hQHJhbnNvbWhvdXNl" }, { "date": "2026-09-16", "name": "Namibian Defence Force", "country": "NA", "sectors": [ "government" ], "url": "https://www.ransomware.live/id/TmFtaWJpYW4gRGVmZW5jZSBGb3JjZUByYW5zb21ob3VzZQ==" }, { "date": "2026-09-10", "name": "California School Employees Association", "country": "US", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/Q2FsaWZvcm5pYSBTY2hvb2wgRW1wbG95ZWVzIEFzc29jaWF0aW9uQHJhbnNvbWhvdXNl" }, { "date": "2026-09-01", "name": "REXT Holdings Co., Ltd.", "country": "JP", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/UkVYVCBIb2xkaW5ncyBDby4sIEx0ZC5AcmFuc29taG91c2U=" } ] }, "convergences": [], "reports": [ { "url": "https://asec.ahnlab.com/en/95770/", "publisher": "AhnLab ASEC", "published": "2026-10-11", "title": "September 2026 Dark Web Threat Actor Trend Report", "origin": "feed", "primary": false }, { "url": "https://asec.ahnlab.com/en/95949/", "publisher": "AhnLab ASEC", "published": "2026-10-11", "title": "September 2026 Threat Trend Report on Ransomware", "origin": "feed", "primary": false } ], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "umbra", "group": "umbra", "name": "UmBra", "note": null, "attck": [], "activity": { "postings": 10, "first": "2026-10-06", "last": "2026-10-10", "countries": { "EG": 3, "BR": 1, "IN": 2, "??": 2, "ZA": 1, "US": 1 }, "sectors": { "education": 5, "technology": 3, "manufacturing": 1, "unknown": 1 }, "recent": [ { "date": "2026-10-10", "name": "Helwan University (HITU)", "country": "EG", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/SGVsd2FuIFVuaXZlcnNpdHkgKEhJVFUpQFVtQnJh" }, { "date": "2026-10-08", "name": "SOCOCO", "country": "BR", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/U09DT0NPQFVtQnJh" }, { "date": "2026-10-08", "name": "Manipal Academy of Higher Edu", "country": "IN", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/TWFuaXBhbCBBY2FkZW15IG9mIEhpZ2hlciBFZHVAVW1CcmE" }, { "date": "2026-10-08", "name": "IIT Roorkee", "country": "IN", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/SUlUIFJvb3JrZWVAVW1CcmE" }, { "date": "2026-10-08", "name": "FSE, Cairo University", "country": "EG", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/RlNFLCBDYWlybyBVbml2ZXJzaXR5QFVtQnJh" }, { "date": "2026-10-07", "name": "SANAtech Global Solutions", "country": "??", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/U0FOQXRlY2ggR2xvYmFsIFNvbHV0aW9uc0BVbUJyYQ" }, { "date": "2026-10-07", "name": "Raqib", "country": "??", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/UmFxaWJAVW1CcmE" }, { "date": "2026-10-07", "name": "Tharisa", "country": "ZA", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/VGhhcmlzYUBVbUJyYQ" }, { "date": "2026-10-06", "name": "Beni Suef Technological University – BTU", "country": "EG", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/QmVuaSBTdWVmIFRlY2hub2xvZ2ljYWwgVW5pdmVyc2l0eSDigJMgQlRVQFVtQnJh" }, { "date": "2026-10-06", "name": "Four Hands LLC", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Rm91ciBIYW5kcyBMTENAVW1CcmE" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "blacknevas", "group": "blacknevas", "name": "blacknevas", "note": null, "attck": [], "activity": { "postings": 9, "first": "2026-08-12", "last": "2026-10-15", "countries": { "AE": 1, "??": 2, "TR": 1, "IT": 1, "US": 3, "CA": 1 }, "sectors": { "education": 1, "finance": 1, "manufacturing": 2, "technology": 2, "agriculture": 1, "healthcare": 1, "services": 1 }, "recent": [ { "date": "2026-10-15", "name": "Amity University Dubai", "country": "AE", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/QW1pdHkgVW5pdmVyc2l0eSBEdWJhaUBibGFja25ldmFz" }, { "date": "2026-09-16", "name": "Optimum First Mortgage (Pear's acting group's promotional blog)", "country": "??", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/T3B0aW11bSBGaXJzdCBNb3J0Z2FnZSAoUGVhcidzIGFjdGluZyBncm91cCdzIHByb21vdGlvbmFsIGJsb2cpQGJsYWNrbmV2YXM=" }, { "date": "2026-09-08", "name": "Mefa Group www.mefagroup.com.tr / MEFA Endüstri www.mefaendustri.com / and (Efachem, Eco...", "country": "TR", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/TWVmYSBHcm91cCB3d3cubWVmYWdyb3VwLmNvbS50ciAvIE1FRkEgRW5kw7xzdHJpIHd3dy5tZWZhZW5kdXN0cmkuY29tIC8gYW5kIChFZmFjaGVtLCBFY28uLi5AYmxhY2tuZXZhcw==" }, { "date": "2026-08-14", "name": "ASCOM S.p.A. ascom-italy.it serviced by an IT company Emilcom S.r.l.", "country": "IT", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/QVNDT00gUy5wLkEuIGFzY29tLWl0YWx5Lml0IHNlcnZpY2VkIGJ5IGFuIElUIGNvbXBhbnkgRW1pbGNvbSBTLnIubC5AYmxhY2tuZXZhcw==" }, { "date": "2026-08-13", "name": "Portable Intelligence Inc www.portable-intelligence.com serviced by an IT company Computer...", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/UG9ydGFibGUgSW50ZWxsaWdlbmNlIEluYyB3d3cucG9ydGFibGUtaW50ZWxsaWdlbmNlLmNvbSBzZXJ2aWNlZCBieSBhbiBJVCBjb21wYW55IENvbXB1dGVyLi4uQGJsYWNrbmV2YXM=" }, { "date": "2026-08-12", "name": "Westbrook Greenhouse Systems www.westbrooksystems.com serviced by an IT company Computer C...", "country": "US", "sectors": [ "agriculture" ], "url": "https://www.ransomware.live/id/V2VzdGJyb29rIEdyZWVuaG91c2UgU3lzdGVtcyB3d3cud2VzdGJyb29rc3lzdGVtcy5jb20gc2VydmljZWQgYnkgYW4gSVQgY29tcGFueSBDb21wdXRlciBDLi4uQGJsYWNrbmV2YXM=" }, { "date": "2026-08-12", "name": "Enteroptyx Ophthalmology Products www.enteroptyx.com serviced by an IT company Computer Co...", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/RW50ZXJvcHR5eCBPcGh0aGFsbW9sb2d5IFByb2R1Y3RzIHd3dy5lbnRlcm9wdHl4LmNvbSBzZXJ2aWNlZCBieSBhbiBJVCBjb21wYW55IENvbXB1dGVyIENvLi4uQGJsYWNrbmV2YXM=" }, { "date": "2026-08-12", "name": "Jack Rutherford Customs Brokers Ltd / The Rutherford Group www.therg.ca serviced by an IT ...", "country": "CA", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/SmFjayBSdXRoZXJmb3JkIEN1c3RvbXMgQnJva2VycyBMdGQgLyBUaGUgUnV0aGVyZm9yZCBHcm91cCB3d3cudGhlcmcuY2Egc2VydmljZWQgYnkgYW4gSVQgLi4uQGJsYWNrbmV2YXM=" }, { "date": "2026-08-12", "name": "COMPUTER COUNTRY AND NETWORKS", "country": "??", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/Q09NUFVURVIgQ09VTlRSWSBBTkQgTkVUV09SS1NAYmxhY2tuZXZhcw==" } ] }, "convergences": [], "reports": [ { "url": "https://securelist.com/virtualization-security-esxi-and-proxmox-ransomware-cases/121819/", "publisher": "Kaspersky Securelist", "published": "2026-11-06", "title": "Virtualization security: attack layers and misconfiguration impact", "origin": "feed", "primary": false } ], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "kairos", "group": "kairos", "name": "kairos", "note": null, "attck": [], "activity": { "postings": 9, "first": "2026-08-12", "last": "2026-10-14", "countries": { "VU": 1, "US": 4, "FR": 2, "AU": 1, "ES": 1 }, "sectors": { "technology": 1, "education": 1, "healthcare": 1, "unknown": 1, "manufacturing": 2, "consumer": 1, "government": 2 }, "recent": [ { "date": "2026-10-14", "name": "Oceania Digital Communications", "country": "VU", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/T2NlYW5pYSBEaWdpdGFsIENvbW11bmljYXRpb25zQGthaXJvcw" }, { "date": "2026-10-01", "name": "Slate Valley Unified School District", "country": "US", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/U2xhdGUgVmFsbGV5IFVuaWZpZWQgU2Nob29sIERpc3RyaWN0QGthaXJvcw==" }, { "date": "2026-09-30", "name": "Le Centre National de l'Expertise Hospitalière (CNEH)", "country": "FR", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/TGUgQ2VudHJlIE5hdGlvbmFsIGRlIGwnRXhwZXJ0aXNlIEhvc3BpdGFsacOocmUgKENORUgpQGthaXJvcw==" }, { "date": "2026-09-29", "name": "Unique Repair Services", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/VW5pcXVlIFJlcGFpciBTZXJ2aWNlc0BrYWlyb3M=" }, { "date": "2026-09-22", "name": "Krapf Group", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/S3JhcGYgR3JvdXBAa2Fpcm9z" }, { "date": "2026-09-16", "name": "Leisure Coast Kitchens", "country": "AU", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/TGVpc3VyZSBDb2FzdCBLaXRjaGVuc0BrYWlyb3M=" }, { "date": "2026-09-02", "name": "Ville de Libercourt", "country": "FR", "sectors": [ "government" ], "url": "https://www.ransomware.live/id/VmlsbGUgZGUgTGliZXJjb3VydEBrYWlyb3M=" }, { "date": "2026-08-20", "name": "Ayuntamiento de Velilla de San Antonio", "country": "ES", "sectors": [ "government" ], "url": "https://www.ransomware.live/id/QXl1bnRhbWllbnRvIGRlIFZlbGlsbGEgZGUgU2FuIEFudG9uaW9Aa2Fpcm9z" }, { "date": "2026-08-12", "name": "Hightech Signs", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/SGlnaHRlY2ggU2lnbnNAa2Fpcm9z" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "m3rx", "group": "m3rx", "name": "m3rx", "note": null, "attck": [], "activity": { "postings": 9, "first": "2026-08-14", "last": "2026-09-29", "countries": { "PL": 1, "US": 2, "BR": 2, "AE": 1, "??": 1, "CA": 1, "AT": 1 }, "sectors": { "technology": 3, "services": 4, "consumer": 1, "manufacturing": 1 }, "recent": [ { "date": "2026-09-29", "name": "intense.pl", "country": "PL", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/aW50ZW5zZS5wbEBtM3J4" }, { "date": "2026-09-29", "name": "oterolaw.com", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/b3Rlcm9sYXcuY29tQG0zcng=" }, { "date": "2026-09-29", "name": "somasolucoes.com", "country": "BR", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/c29tYXNvbHVjb2VzLmNvbUBtM3J4" }, { "date": "2026-09-29", "name": "noonsugar.com", "country": "AE", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/bm9vbnN1Z2FyLmNvbUBtM3J4" }, { "date": "2026-09-29", "name": "iccsi.com", "country": "??", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/aWNjc2kuY29tQG0zcng=" }, { "date": "2026-09-29", "name": "cpacb.com", "country": "CA", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/Y3BhY2IuY29tQG0zcng=" }, { "date": "2026-09-26", "name": "cipher.systems", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/Y2lwaGVyLnN5c3RlbXNAbTNyeA==" }, { "date": "2026-08-29", "name": "lindner-group.com", "country": "AT", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/bGluZG5lci1ncm91cC5jb21AbTNyeA==" }, { "date": "2026-08-14", "name": "tecnoabi.com", "country": "BR", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/dGVjbm9hYmkuY29tQG0zcng=" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "shadowbyt3", "group": "shadowbyt3$", "name": "ShadowByt3$", "note": null, "attck": [], "activity": { "postings": 9, "first": "2026-08-25", "last": "2026-09-16", "countries": { "US": 5, "GB": 3, "ID": 1 }, "sectors": { "unknown": 3, "services": 1, "consumer": 2, "agriculture": 1, "technology": 1, "education": 1 }, "recent": [ { "date": "2026-09-16", "name": "HandyTrac Greystar AZ WARNING", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/SGFuZHlUcmFjIEdyZXlzdGFyIEFaIFdBUk5JTkdAU2hhZG93Qnl0MyQ=" }, { "date": "2026-09-15", "name": "HandyTrac (Greystar Litchfield Park, AZ)", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/SGFuZHlUcmFjIChHcmV5c3RhciBMaXRjaGZpZWxkIFBhcmssIEFaKUBTaGFkb3dCeXQzJA==" }, { "date": "2026-09-10", "name": "John Engel Team", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/Sm9obiBFbmdlbCBUZWFtQFNoYWRvd0J5dDMk" }, { "date": "2026-09-07", "name": "Ben Leeds Properties", "country": "GB", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/QmVuIExlZWRzIFByb3BlcnRpZXNAU2hhZG93Qnl0MyQ=" }, { "date": "2026-08-29", "name": "BayView Real Estate", "country": "US", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/QmF5VmlldyBSZWFsIEVzdGF0ZUBTaGFkb3dCeXQzJA==" }, { "date": "2026-08-28", "name": "Bayview Real Estate WARNING", "country": "US", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/QmF5dmlldyBSZWFsIEVzdGF0ZSBXQVJOSU5HQFNoYWRvd0J5dDMk" }, { "date": "2026-08-25", "name": "Sinar Mas Agribusiness and Food Golden Agri-Resources)", "country": "ID", "sectors": [ "agriculture" ], "url": "https://www.ransomware.live/id/U2luYXIgTWFzIEFncmlidXNpbmVzcyBhbmQgRm9vZCBHb2xkZW4gQWdyaS1SZXNvdXJjZXMpQFNoYWRvd0J5dDMk" }, { "date": "2026-08-25", "name": "A-Plus Software Limited", "country": "GB", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/QS1QbHVzIFNvZnR3YXJlIExpbWl0ZWRAU2hhZG93Qnl0MyQ=" }, { "date": "2026-08-25", "name": "Knottingham Trent University", "country": "GB", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/S25vdHRpbmdoYW0gVHJlbnQgVW5pdmVyc2l0eUBTaGFkb3dCeXQzJA==" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "redact", "group": "redact", "name": "Redact", "note": null, "attck": [], "activity": { "postings": 8, "first": "2026-10-01", "last": "2026-11-05", "countries": { "US": 8 }, "sectors": { "consumer": 1, "services": 2, "energy": 2, "manufacturing": 2, "healthcare": 1 }, "recent": [ { "date": "2026-11-05", "name": "Omni Hotels & Resorts", "country": "US", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/T21uaSBIb3RlbHMgJiBSZXNvcnRzQFJlZGFjdA" }, { "date": "2026-11-02", "name": "Holland & Knight", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/SG9sbGFuZCAmIEtuaWdodEBSZWRhY3Q" }, { "date": "2026-10-19", "name": "Baker Donelson", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/QmFrZXIgRG9uZWxzb25AUmVkYWN0" }, { "date": "2026-10-16", "name": "ONEOK, Inc.", "country": "US", "sectors": [ "energy" ], "url": "https://www.ransomware.live/id/T05FT0ssIEluYy5AUmVkYWN0" }, { "date": "2026-10-16", "name": "Parker-Hannifin Corporation", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/UGFya2VyLUhhbm5pZmluIENvcnBvcmF0aW9uQFJlZGFjdA" }, { "date": "2026-10-12", "name": "Eversource Energy", "country": "US", "sectors": [ "energy" ], "url": "https://www.ransomware.live/id/RXZlcnNvdXJjZSBFbmVyZ3lAUmVkYWN0" }, { "date": "2026-10-10", "name": "DexCom", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/RGV4Q29tQFJlZGFjdA" }, { "date": "2026-10-01", "name": "Graybar Electric Company, Inc.", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/R3JheWJhciBFbGVjdHJpYyBDb21wYW55LCBJbmMuQFJlZGFjdA==" } ] }, "convergences": [ { "name": "FCCI Insurance Group", "flagged": "2026-09-04", "classes": [ "leak", "notice" ], "curated": false, "hand_picked": false } ], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "everstake", "group": "everstake", "name": "everstake", "note": null, "attck": [], "activity": { "postings": 8, "first": "2026-10-29", "last": "2026-11-05", "countries": { "??": 8 }, "sectors": { "unknown": 6, "technology": 2, "insurance": 1 }, "recent": [ { "date": "2026-11-05", "name": "ne*****h.com", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/bmUqKioqKmguY29tQGV2ZXJzdGFrZQ" }, { "date": "2026-11-02", "name": "da*****t.com", "country": "??", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/ZGEqKioqKnQuY29tQGV2ZXJzdGFrZQ" }, { "date": "2026-11-02", "name": "ra*****g.com", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/cmEqKioqKmcuY29tQGV2ZXJzdGFrZQ" }, { "date": "2026-10-30", "name": "sp*****g.com", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/c3AqKioqKmcuY29tQGV2ZXJzdGFrZQ" }, { "date": "2026-10-29", "name": "as*****g.com", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/YXMqKioqKmcuY29tQGV2ZXJzdGFrZQ" }, { "date": "2026-10-29", "name": "ca*****s.com", "country": "??", "sectors": [ "unknown", "insurance" ], "url": "https://www.ransomware.live/id/Y2EqKioqKnMuY29tQGV2ZXJzdGFrZQ" }, { "date": "2026-10-29", "name": "in*****s.com", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/aW4qKioqKnMuY29tQGV2ZXJzdGFrZQ" }, { "date": "2026-10-29", "name": "corp-smart.com", "country": "??", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/Y29ycC1zbWFydC5jb21AZXZlcnN0YWtl" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "the-seven-deadly-sins", "group": "the seven deadly sins", "name": "THE SEVEN DEADLY SINS", "note": null, "attck": [], "activity": { "postings": 8, "first": "2026-10-16", "last": "2026-10-16", "countries": { "US": 6, "AU": 1, "BR": 1 }, "sectors": { "technology": 3, "unknown": 1, "healthcare": 3, "consumer": 1 }, "recent": [ { "date": "2026-10-16", "name": "Cradlewise Inc.", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/Q3JhZGxld2lzZSBJbmMuQFRIRSBTRVZFTiBERUFETFkgU0lOUw" }, { "date": "2026-10-16", "name": "Globeia Inc.", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/R2xvYmVpYSBJbmMuQFRIRSBTRVZFTiBERUFETFkgU0lOUw" }, { "date": "2026-10-16", "name": "Canva", "country": "AU", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/Q2FudmFAVEhFIFNFVkVOIERFQURMWSBTSU5T" }, { "date": "2026-10-16", "name": "Hospital Sírio-Libanês", "country": "BR", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/SG9zcGl0YWwgU8OtcmlvLUxpYmFuw6pzQFRIRSBTRVZFTiBERUFETFkgU0lOUw" }, { "date": "2026-10-16", "name": "Verano Holdings", "country": "US", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/VmVyYW5vIEhvbGRpbmdzQFRIRSBTRVZFTiBERUFETFkgU0lOUw" }, { "date": "2026-10-16", "name": "Harness Inc.", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/SGFybmVzcyBJbmMuQFRIRSBTRVZFTiBERUFETFkgU0lOUw" }, { "date": "2026-10-16", "name": "iHeartJane", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/aUhlYXJ0SmFuZUBUSEUgU0VWRU4gREVBRExZIFNJTlM" }, { "date": "2026-10-16", "name": "CureMetrix, Inc.", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/Q3VyZU1ldHJpeCwgSW5jLkBUSEUgU0VWRU4gREVBRExZIFNJTlM" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "xpl0itrs", "group": "xpl0itrs", "name": "xpl0itrs", "note": null, "attck": [], "activity": { "postings": 8, "first": "2026-08-15", "last": "2026-08-20", "countries": { "IT": 1, "US": 2, "??": 2, "DE": 1, "AT": 1, "AU": 1 }, "sectors": { "manufacturing": 2, "consumer": 3, "technology": 2, "unknown": 1 }, "recent": [ { "date": "2026-08-20", "name": "Gruppo Spaggiari Parma", "country": "IT", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/R3J1cHBvIFNwYWdnaWFyaSBQYXJtYUB4cGwwaXRycw==" }, { "date": "2026-08-20", "name": "Target", "country": "US", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/VGFyZ2V0QHhwbDBpdHJz" }, { "date": "2026-08-19", "name": "Mihuru", "country": "??", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/TWlodXJ1QHhwbDBpdHJz" }, { "date": "2026-08-17", "name": "BMW Group", "country": "DE", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/Qk1XIEdyb3VwQHhwbDBpdHJz" }, { "date": "2026-08-15", "name": "Dynatrace", "country": "AT", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/RHluYXRyYWNlQHhwbDBpdHJz" }, { "date": "2026-08-15", "name": "Oz Hair & Beauty", "country": "AU", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/T3ogSGFpciAmIEJlYXV0eUB4cGwwaXRycw==" }, { "date": "2026-08-15", "name": "*********", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/KioqKioqKioqQHhwbDBpdHJz" }, { "date": "2026-08-15", "name": "RapidFort", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/UmFwaWRGb3J0QHhwbDBpdHJz" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "falcon", "group": "falcon", "name": "Falcon", "note": null, "attck": [], "activity": { "postings": 7, "first": "2026-08-30", "last": "2026-11-03", "countries": { "US": 7 }, "sectors": { "services": 3, "healthcare": 2, "manufacturing": 2 }, "recent": [ { "date": "2026-11-03", "name": "Buchanan Ingersoll & Rooney PC", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/QnVjaGFuYW4gSW5nZXJzb2xsICYgUm9vbmV5IFBDQEZhbGNvbg" }, { "date": "2026-10-26", "name": "Beasley Allen Law Firm", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/QmVhc2xleSBBbGxlbiBMYXcgRmlybUBGYWxjb24" }, { "date": "2026-10-25", "name": "Weitz & Luxenberg", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/V2VpdHogJiBMdXhlbmJlcmdARmFsY29u" }, { "date": "2026-10-25", "name": "Astrana Health", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/QXN0cmFuYSBIZWFsdGhARmFsY29u" }, { "date": "2026-08-31", "name": "Hayward Holdings", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/SGF5d2FyZCBIb2xkaW5nc0BGYWxjb24=" }, { "date": "2026-08-30", "name": "Globus Medical", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/R2xvYnVzIE1lZGljYWxARmFsY29u" }, { "date": "2026-08-30", "name": "DistributionNOW (DNOW Inc.)", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/RGlzdHJpYnV0aW9uTk9XIChETk9XIEluYy4pQEZhbGNvbg==" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "obsoft", "group": "obsoft", "name": "OBSOFT", "note": null, "attck": [], "activity": { "postings": 7, "first": "2026-11-03", "last": "2026-11-06", "countries": { "??": 2, "KR": 5 }, "sectors": { "unknown": 7 }, "recent": [ { "date": "2026-11-06", "name": "Company #6", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Q29tcGFueSAjNkBPQlNPRlQ" }, { "date": "2026-11-03", "name": "Company #1", "country": "KR", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Q29tcGFueSAjMUBPQlNPRlQ" }, { "date": "2026-11-03", "name": "Company #2", "country": "KR", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Q29tcGFueSAjMkBPQlNPRlQ" }, { "date": "2026-11-03", "name": "Company #3", "country": "KR", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Q29tcGFueSAjM0BPQlNPRlQ" }, { "date": "2026-11-03", "name": "Company #4", "country": "KR", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Q29tcGFueSAjNEBPQlNPRlQ" }, { "date": "2026-11-03", "name": "Company #5", "country": "KR", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Q29tcGFueSAjNUBPQlNPRlQ" }, { "date": "2026-11-03", "name": "New Victim Company #6", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/TmV3IFZpY3RpbSBDb21wYW55ICM2QE9CU09GVA" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "termite", "group": "termite", "name": "Termite", "note": null, "attck": [], "activity": { "postings": 7, "first": "2026-08-22", "last": "2026-10-09", "countries": { "BR": 1, "US": 6 }, "sectors": { "healthcare": 1, "services": 1, "insurance": 1, "unknown": 2, "manufacturing": 2, "finance": 1 }, "recent": [ { "date": "2026-10-09", "name": "iDentalSoft", "country": "BR", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/aURlbnRhbFNvZnRAdGVybWl0ZQ" }, { "date": "2026-10-07", "name": "Aon", "country": "US", "sectors": [ "services", "insurance" ], "url": "https://www.ransomware.live/id/QW9uQHRlcm1pdGU" }, { "date": "2026-09-26", "name": "Crossett", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Q3Jvc3NldHRAdGVybWl0ZQ==" }, { "date": "2026-09-22", "name": "Sealcon", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/U2VhbGNvbkB0ZXJtaXRl" }, { "date": "2026-09-22", "name": "TruAmerica Multifamily", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/VHJ1QW1lcmljYSBNdWx0aWZhbWlseUB0ZXJtaXRl" }, { "date": "2026-09-22", "name": "theLender", "country": "US", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/dGhlTGVuZGVyQHRlcm1pdGU=" }, { "date": "2026-08-22", "name": "Everglades Boats", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/RXZlcmdsYWRlcyBCb2F0c0B0ZXJtaXRl" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "unsafe", "group": "unsafe", "name": "unsafe", "note": null, "attck": [], "activity": { "postings": 7, "first": "2026-08-10", "last": "2026-09-21", "countries": { "FI": 1, "??": 1, "US": 3, "BR": 1, "IN": 1 }, "sectors": { "technology": 6, "unknown": 1 }, "recent": [ { "date": "2026-09-21", "name": "kyyba.com", "country": "FI", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/a3l5YmEuY29tQHVuc2FmZQ==" }, { "date": "2026-09-19", "name": "voltgames.io", "country": "??", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/dm9sdGdhbWVzLmlvQHVuc2FmZQ==" }, { "date": "2026-09-14", "name": "geekybunch.com", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/Z2Vla3lidW5jaC5jb21AdW5zYWZl" }, { "date": "2026-09-12", "name": "watchops.com", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/d2F0Y2hvcHMuY29tQHVuc2FmZQ==" }, { "date": "2026-08-28", "name": "amzur.com", "country": "BR", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/YW16dXIuY29tQHVuc2FmZQ==" }, { "date": "2026-08-10", "name": "Presentations.AI", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/UHJlc2VudGF0aW9ucy5BSUB1bnNhZmU=" }, { "date": "2026-08-10", "name": "DECK APP TECHNOLOGIES PTE. LTD", "country": "IN", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/REVDSyBBUFAgVEVDSE5PTE9HSUVTIFBURS4gTFREQHVuc2FmZQ==" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "vypr", "group": "vypr", "name": "VYPR", "note": null, "attck": [], "activity": { "postings": 7, "first": "2026-10-05", "last": "2026-10-05", "countries": { "US": 7 }, "sectors": { "healthcare": 2, "finance": 1, "manufacturing": 2, "unknown": 1, "education": 1 }, "recent": [ { "date": "2026-10-05", "name": "Medical Data Rx", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/TWVkaWNhbCBEYXRhIFJ4QFZZUFI" }, { "date": "2026-10-05", "name": "Agio International", "country": "US", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/QWdpbyBJbnRlcm5hdGlvbmFsQFZZUFI" }, { "date": "2026-10-05", "name": "Sims Vibration Laboratory", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/U2ltcyBWaWJyYXRpb24gTGFib3JhdG9yeUBWWVBS" }, { "date": "2026-10-05", "name": "Circulating Air", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/Q2lyY3VsYXRpbmcgQWlyQFZZUFI" }, { "date": "2026-10-05", "name": "Gen3", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/R2VuM0BWWVBS" }, { "date": "2026-10-05", "name": "JPS Health Network", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/SlBTIEhlYWx0aCBOZXR3b3JrQFZZUFI" }, { "date": "2026-10-05", "name": "Champaign Unit 4 School District", "country": "US", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/Q2hhbXBhaWduIFVuaXQgNCBTY2hvb2wgRGlzdHJpY3RAVllQUg" } ] }, "convergences": [], "reports": [ { "url": "https://blog.talosintelligence.com/ir-trends-q3-2026/", "publisher": "Cisco Talos", "published": "2026-10-29", "title": "IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases", "origin": "feed", "primary": false } ], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "endzone", "group": "endzone", "name": "EndZone", "note": null, "attck": [], "activity": { "postings": 6, "first": "2026-09-18", "last": "2026-10-06", "countries": { "US": 4, "??": 2 }, "sectors": { "education": 1, "services": 1, "technology": 2, "unknown": 1, "government": 1 }, "recent": [ { "date": "2026-10-06", "name": "Philander Smith University", "country": "US", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/UGhpbGFuZGVyIFNtaXRoIFVuaXZlcnNpdHlARW5kWm9uZQ" }, { "date": "2026-09-24", "name": "eTeam", "country": "??", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/ZVRlYW1ARW5kWm9uZQ==" }, { "date": "2026-09-23", "name": "Trump Mobile", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/VHJ1bXAgTW9iaWxlQEVuZFpvbmU=" }, { "date": "2026-09-21", "name": "Gomomentum.com", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/R29tb21lbnR1bS5jb21ARW5kWm9uZQ==" }, { "date": "2026-09-18", "name": "Accela.com", "country": "US", "sectors": [ "government" ], "url": "https://www.ransomware.live/id/QWNjZWxhLmNvbUBFbmRab25l" }, { "date": "2026-09-18", "name": "AT&T", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/QVQmVEBFbmRab25l" } ] }, "convergences": [ { "name": "Accela, Inc.", "flagged": "2026-09-19", "classes": [ "leak", "notice" ], "curated": false, "hand_picked": false } ], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "black-x", "group": "black x", "name": "Black X", "note": null, "attck": [], "activity": { "postings": 6, "first": "2026-08-30", "last": "2026-10-09", "countries": { "DE": 1, "JP": 1, "GB": 1, "KR": 2, "VN": 1 }, "sectors": { "healthcare": 1, "technology": 2, "finance": 2, "unknown": 1 }, "recent": [ { "date": "2026-10-09", "name": "bayer", "country": "DE", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/YmF5ZXJAQmxhY2sgWA" }, { "date": "2026-10-09", "name": "enTouch", "country": "JP", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/ZW5Ub3VjaEBCbGFjayBY" }, { "date": "2026-10-09", "name": "lopay", "country": "GB", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/bG9wYXlAQmxhY2sgWA" }, { "date": "2026-09-01", "name": "iwin", "country": "KR", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/aXdpbkBCbGFjayBY" }, { "date": "2026-08-30", "name": "FE CREDIT", "country": "VN", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/RkUgQ1JFRElUQEJsYWNrIFg=" }, { "date": "2026-08-30", "name": "i-one", "country": "KR", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/aS1vbmVAQmxhY2sgWA==" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "global", "group": "global", "name": "global", "note": null, "attck": [], "activity": { "postings": 6, "first": "2026-08-28", "last": "2026-09-12", "countries": { "US": 2, "UY": 1, "CN": 2, "SG": 1 }, "sectors": { "education": 1, "government": 1, "technology": 2, "healthcare": 1, "transportation": 1 }, "recent": [ { "date": "2026-09-12", "name": "Sutton Public Schools", "country": "US", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/U3V0dG9uIFB1YmxpYyBTY2hvb2xzQGdsb2JhbA==" }, { "date": "2026-09-12", "name": "TOWN OF SUTTON | MASSACHUSETTS", "country": "US", "sectors": [ "government" ], "url": "https://www.ransomware.live/id/VE9XTiBPRiBTVVRUT04gfCBNQVNTQUNIVVNFVFRTQGdsb2JhbA==" }, { "date": "2026-08-28", "name": "Vigilia", "country": "UY", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/VmlnaWxpYUBnbG9iYWw=" }, { "date": "2026-08-28", "name": "Hangzhou Qihan Biotech Co., Ltd.", "country": "CN", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/SGFuZ3pob3UgUWloYW4gQmlvdGVjaCBDby4sIEx0ZC5AZ2xvYmFs" }, { "date": "2026-08-28", "name": "Shanghai Tunnel Engineering Co Ltd", "country": "SG", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/U2hhbmdoYWkgVHVubmVsIEVuZ2luZWVyaW5nIENvIEx0ZEBnbG9iYWw=" }, { "date": "2026-08-28", "name": "Atcomm", "country": "CN", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/QXRjb21tQGdsb2JhbA==" } ] }, "convergences": [], "reports": [ { "url": "https://cofense.com/blog/from-payment-plan-to-ransomware-inside-a-global-group-attack", "publisher": "Cofense", "published": "2026-09-22", "title": "From Payment Plan to Ransomware - Inside a Global Group Attack", "origin": "feed", "primary": false } ], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "netrunner", "group": "netrunner", "name": "netrunner", "note": null, "attck": [], "activity": { "postings": 6, "first": "2026-09-28", "last": "2026-10-08", "countries": { "US": 2, "??": 2, "MY": 2 }, "sectors": { "healthcare": 1, "unknown": 3, "transportation": 1, "consumer": 1 }, "recent": [ { "date": "2026-10-08", "name": "Mid Atlantic Gynecologic Oncology and Pelvic Surgery Associates", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/TWlkIEF0bGFudGljIEd5bmVjb2xvZ2ljIE9uY29sb2d5IGFuZCBQZWx2aWMgU3VyZ2VyeSBBc3NvY2lhdGVzQG5ldHJ1bm5lcg" }, { "date": "2026-10-05", "name": "M** A******* G********** O******* a** P***** S****** A*********", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/TSoqIEEqKioqKioqIEcqKioqKioqKioqIE8qKioqKioqIGEqKiBQKioqKiogUyoqKioqKiBBKioqKioqKioqQG5ldHJ1bm5lcg" }, { "date": "2026-10-03", "name": "Precon Marine Inc", "country": "??", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/UHJlY29uIE1hcmluZSBJbmNAbmV0cnVubmVy" }, { "date": "2026-10-02", "name": "Main Place Mall", "country": "MY", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/TWFpbiBQbGFjZSBNYWxsQG5ldHJ1bm5lcg==" }, { "date": "2026-09-30", "name": "P***** M***** I**", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/UCoqKioqIE0qKioqKiBJKipAbmV0cnVubmVy" }, { "date": "2026-09-28", "name": "M*** P**** M***", "country": "MY", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/TSoqKiBQKioqKiBNKioqQG5ldHJ1bm5lcg==" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "shiba", "group": "shiba", "name": "Shiba", "note": null, "attck": [], "activity": { "postings": 6, "first": "2026-10-29", "last": "2026-11-06", "countries": { "IT": 1, "DE": 1, "??": 3, "GB": 1 }, "sectors": { "unknown": 2, "agriculture": 1, "healthcare": 2, "services": 1 }, "recent": [ { "date": "2026-11-06", "name": "Istituto Borgo", "country": "IT", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/SXN0aXR1dG8gQm9yZ29AU2hpYmE" }, { "date": "2026-11-01", "name": "Tema Hwt", "country": "DE", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/VGVtYSBId3RAU2hpYmE" }, { "date": "2026-10-29", "name": "IT Foods Industries", "country": "??", "sectors": [ "agriculture" ], "url": "https://www.ransomware.live/id/SVQgRm9vZHMgSW5kdXN0cmllc0BTaGliYQ" }, { "date": "2026-10-29", "name": "Friendly Senior Living", "country": "??", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/RnJpZW5kbHkgU2VuaW9yIExpdmluZ0BTaGliYQ" }, { "date": "2026-10-29", "name": "Morgan White Group", "country": "??", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/TW9yZ2FuIFdoaXRlIEdyb3VwQFNoaWJh" }, { "date": "2026-10-29", "name": "Antwerp House Dentistry", "country": "GB", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/QW50d2VycCBIb3VzZSBEZW50aXN0cnlAU2hpYmE" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "aoqin", "group": "aoqin", "name": "Aoqin", "note": null, "attck": [], "activity": { "postings": 5, "first": "2026-11-04", "last": "2026-11-05", "countries": { "BR": 1, "SI": 1, "CL": 1, "CN": 1, "US": 1 }, "sectors": { "technology": 2, "manufacturing": 1, "energy": 1, "services": 1 }, "recent": [ { "date": "2026-11-05", "name": "Sistel", "country": "BR", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/U2lzdGVsQEFvcWlu" }, { "date": "2026-11-04", "name": "SILIKO d.o.o.", "country": "SI", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/U0lMSUtPIGQuby5vLkBBb3Fpbg" }, { "date": "2026-11-04", "name": "Petroshahd(Enap Sipetrol International - Egypt Branch)", "country": "CL", "sectors": [ "energy" ], "url": "https://www.ransomware.live/id/UGV0cm9zaGFoZChFbmFwIFNpcGV0cm9sIEludGVybmF0aW9uYWwgLSBFZ3lwdCBCcmFuY2gpQEFvcWlu" }, { "date": "2026-11-04", "name": "Nextron Technology", "country": "CN", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/TmV4dHJvbiBUZWNobm9sb2d5QEFvcWlu" }, { "date": "2026-11-04", "name": "Goldsmith & Hull", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/R29sZHNtaXRoICYgSHVsbEBBb3Fpbg" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "spirals", "group": "spirals", "name": "Spirals", "note": null, "attck": [], "activity": { "postings": 5, "first": "2026-09-18", "last": "2026-10-03", "countries": { "AE": 1, "UG": 1, "OM": 1, "US": 1, "??": 1 }, "sectors": { "transportation": 2, "finance": 1, "healthcare": 1, "technology": 1 }, "recent": [ { "date": "2026-10-03", "name": "seven seas group", "country": "AE", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/c2V2ZW4gc2VhcyBncm91cEBTcGlyYWxz" }, { "date": "2026-09-24", "name": "Armada Credit Bureau", "country": "UG", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/QXJtYWRhIENyZWRpdCBCdXJlYXVAU3BpcmFscw==" }, { "date": "2026-09-23", "name": "ASYAD GROUP", "country": "OM", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/QVNZQUQgR1JPVVBAU3BpcmFscw==" }, { "date": "2026-09-18", "name": "PITTSRAD", "country": "US", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/UElUVFNSQURAU3BpcmFscw==" }, { "date": "2026-09-18", "name": "ANYTHINGIT", "country": "??", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/QU5ZVEhJTkdJVEBTcGlyYWxz" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "ailock", "group": "ailock", "name": "AiLock", "note": null, "attck": [], "activity": { "postings": 4, "first": "2026-08-13", "last": "2026-08-26", "countries": { "GB": 1, "US": 1, "JP": 2 }, "sectors": { "services": 1, "unknown": 2, "technology": 1 }, "recent": [ { "date": "2026-08-26", "name": "Morgan Services", "country": "GB", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/TW9yZ2FuIFNlcnZpY2VzQEFpTG9jaw==" }, { "date": "2026-08-26", "name": "Hamilton", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/SGFtaWx0b25AQWlMb2Nr" }, { "date": "2026-08-13", "name": "DAISEN", "country": "JP", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/REFJU0VOQEFpTG9jaw==" }, { "date": "2026-08-13", "name": "Yaomasa", "country": "JP", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/WWFvbWFzYUBBaUxvY2s=" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "beast", "group": "beast", "name": "beast", "note": null, "attck": [], "activity": { "postings": 4, "first": "2026-08-24", "last": "2026-11-05", "countries": { "JP": 1, "HK": 1, "US": 1, "CA": 1 }, "sectors": { "unknown": 1, "technology": 2, "agriculture": 1 }, "recent": [ { "date": "2026-11-05", "name": "SevenPlus", "country": "JP", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/U2V2ZW5QbHVzQGJlYXN0" }, { "date": "2026-09-10", "name": "M800 and CINNOX", "country": "HK", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/TTgwMCBhbmQgQ0lOTk9YQGJlYXN0" }, { "date": "2026-08-25", "name": "Cosmon", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/Q29zbW9uQGJlYXN0" }, { "date": "2026-08-24", "name": "Meridian Forest Services", "country": "CA", "sectors": [ "agriculture" ], "url": "https://www.ransomware.live/id/TWVyaWRpYW4gRm9yZXN0IFNlcnZpY2VzQGJlYXN0" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "fulcrumsec", "group": "fulcrumsec", "name": "fulcrumsec", "note": null, "attck": [], "activity": { "postings": 4, "first": "2026-09-01", "last": "2026-10-23", "countries": { "US": 1, "CN": 1, "SE": 1, "GB": 1 }, "sectors": { "technology": 3, "transportation": 1 }, "recent": [ { "date": "2026-10-23", "name": "EMARKETER", "country": "US", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/RU1BUktFVEVSQGZ1bGNydW1zZWM" }, { "date": "2026-10-19", "name": "PingCAP / TiDB Cloud", "country": "CN", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/UGluZ0NBUCAvIFRpREIgQ2xvdWRAZnVsY3J1bXNlYw" }, { "date": "2026-09-11", "name": "Dustin Group", "country": "SE", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/RHVzdGluIEdyb3VwQGZ1bGNydW1zZWM=" }, { "date": "2026-09-01", "name": "Manchester Airports Group", "country": "GB", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/TWFuY2hlc3RlciBBaXJwb3J0cyBHcm91cEBmdWxjcnVtc2Vj" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "securotrop", "group": "securotrop", "name": "securotrop", "note": null, "attck": [], "activity": { "postings": 4, "first": "2026-08-15", "last": "2026-09-18", "countries": { "US": 4 }, "sectors": { "unknown": 2, "manufacturing": 2 }, "recent": [ { "date": "2026-09-18", "name": "Prefix Corp", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/UHJlZml4IENvcnBAc2VjdXJvdHJvcA==" }, { "date": "2026-09-12", "name": "Shelco Filters", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/U2hlbGNvIEZpbHRlcnNAc2VjdXJvdHJvcA==" }, { "date": "2026-08-18", "name": "ADL Embedded Solutions", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/QURMIEVtYmVkZGVkIFNvbHV0aW9uc0BzZWN1cm90cm9w" }, { "date": "2026-08-15", "name": "Lepi Enterprises", "country": "US", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/TGVwaSBFbnRlcnByaXNlc0BzZWN1cm90cm9w" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "gunra", "group": "gunra", "name": "gunra", "note": null, "attck": [], "activity": { "postings": 3, "first": "2026-08-18", "last": "2026-09-04", "countries": { "UY": 1, "VE": 1, "HN": 1 }, "sectors": { "services": 1, "energy": 1, "unknown": 1 }, "recent": [ { "date": "2026-09-04", "name": "Blanco & Etcheverry", "country": "UY", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/QmxhbmNvICYgRXRjaGV2ZXJyeUBndW5yYQ==" }, { "date": "2026-09-04", "name": "Occidental", "country": "VE", "sectors": [ "energy" ], "url": "https://www.ransomware.live/id/T2NjaWRlbnRhbEBndW5yYQ==" }, { "date": "2026-08-18", "name": "BOMOHSA", "country": "HN", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Qk9NT0hTQUBndW5yYQ==" } ] }, "convergences": [], "reports": [ { "url": "https://securelist.com/lazarus-operation-flashhole/121541/", "publisher": "Kaspersky Securelist", "published": "2026-10-21", "title": "Operation FlashHole: Lazarus breaks security, defies control", "origin": "feed", "primary": false }, { "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-222a", "publisher": "CISA", "published": "2026-08-05", "title": "#StopRansomware: Gunra Ransomware", "origin": "feed", "primary": true } ], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "blacklocks", "group": "blacklocks", "name": "BlackLocks", "note": null, "attck": [], "activity": { "postings": 3, "first": "2026-09-05", "last": "2026-09-26", "countries": { "ZA": 2, "KR": 1 }, "sectors": { "services": 1, "transportation": 1, "manufacturing": 1 }, "recent": [ { "date": "2026-09-26", "name": "ARCA UNLIMITED Architects", "country": "ZA", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/QVJDQSBVTkxJTUlURUQgQXJjaGl0ZWN0c0BCbGFja0xvY2tz" }, { "date": "2026-09-26", "name": "Apollo 21 – Quality Truck, Bus & Trailer Spare Parts South Africa", "country": "ZA", "sectors": [ "transportation" ], "url": "https://www.ransomware.live/id/QXBvbGxvIDIxIOKAkyBRdWFsaXR5IFRydWNrLCBCdXMgJiBUcmFpbGVyIFNwYXJlIFBhcnRzIFNvdXRoIEFmcmljYUBCbGFja0xvY2tz" }, { "date": "2026-09-05", "name": "광명산업(주)", "country": "KR", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/6rSR66qF7IKw7JeFKOyjvClAQmxhY2tMb2Nrcw==" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "blackwater", "group": "blackwater", "name": "blackwater", "note": null, "attck": [], "activity": { "postings": 3, "first": "2026-08-15", "last": "2026-08-24", "countries": { "PT": 1, "AR": 1, "IN": 1 }, "sectors": { "unknown": 2, "services": 1 }, "recent": [ { "date": "2026-08-24", "name": "www.ptesm.com", "country": "PT", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/d3d3LnB0ZXNtLmNvbUBibGFja3dhdGVy" }, { "date": "2026-08-15", "name": "www.amca.org.ar", "country": "AR", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/d3d3LmFtY2Eub3JnLmFyQGJsYWNrd2F0ZXI=" }, { "date": "2026-08-15", "name": "www.shalina.com", "country": "IN", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/d3d3LnNoYWxpbmEuY29tQGJsYWNrd2F0ZXI=" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "cry0", "group": "cry0", "name": "cry0", "note": null, "attck": [], "activity": { "postings": 3, "first": "2026-09-19", "last": "2026-10-09", "countries": { "CA": 1, "??": 1, "US": 1 }, "sectors": { "energy": 1, "manufacturing": 1, "services": 1 }, "recent": [ { "date": "2026-10-09", "name": "Anaergia | World-Leading Anaerobic Digestion Solutions", "country": "CA", "sectors": [ "energy" ], "url": "https://www.ransomware.live/id/QW5hZXJnaWEgfCBXb3JsZC1MZWFkaW5nIEFuYWVyb2JpYyBEaWdlc3Rpb24gU29sdXRpb25zQGNyeTA" }, { "date": "2026-09-28", "name": "MinMor Industries", "country": "??", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/TWluTW9yIEluZHVzdHJpZXNAY3J5MA==" }, { "date": "2026-09-19", "name": "Young Injury Law", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/WW91bmcgSW5qdXJ5IExhd0Bjcnkw" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "crypto24", "group": "crypto24", "name": "crypto24", "note": null, "attck": [], "activity": { "postings": 3, "first": "2026-08-31", "last": "2026-10-27", "countries": { "MY": 1, "PH": 1, "SG": 1 }, "sectors": { "healthcare": 1, "technology": 1, "unknown": 1 }, "recent": [ { "date": "2026-10-27", "name": "Antah HealthCare Group", "country": "MY", "sectors": [ "healthcare" ], "url": "https://www.ransomware.live/id/QW50YWggSGVhbHRoQ2FyZSBHcm91cEBjcnlwdG8yNA" }, { "date": "2026-10-27", "name": "DATEM, Inc.", "country": "PH", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/REFURU0sIEluYy5AY3J5cHRvMjQ" }, { "date": "2026-08-31", "name": "Me***", "country": "SG", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/TWUqKipAY3J5cHRvMjQ=" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "ethics", "group": "ethics", "name": "Ethics", "note": null, "attck": [], "activity": { "postings": 3, "first": "2026-08-12", "last": "2026-08-12", "countries": { "DE": 1, "US": 2 }, "sectors": { "technology": 1, "services": 1, "finance": 1, "insurance": 1 }, "recent": [ { "date": "2026-08-12", "name": "BerlinerLuft. Technology GmbH", "country": "DE", "sectors": [ "technology" ], "url": "https://www.ransomware.live/id/QmVybGluZXJMdWZ0LiBUZWNobm9sb2d5IEdtYkhARXRoaWNz" }, { "date": "2026-08-12", "name": "Holstrom, Block & Parke, A Professional Law", "country": "US", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/SG9sc3Ryb20sIEJsb2NrICYgUGFya2UsIEEgUHJvZmVzc2lvbmFsIExhd0BFdGhpY3M=" }, { "date": "2026-08-12", "name": "Philadelphia Insurance Companies", "country": "US", "sectors": [ "finance", "insurance" ], "url": "https://www.ransomware.live/id/UGhpbGFkZWxwaGlhIEluc3VyYW5jZSBDb21wYW5pZXNARXRoaWNz" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "gammax", "group": "gammax", "name": "Gammax", "note": null, "attck": [], "activity": { "postings": 3, "first": "2026-09-18", "last": "2026-09-29", "countries": { "NZ": 1, "US": 2 }, "sectors": { "education": 1, "manufacturing": 2 }, "recent": [ { "date": "2026-09-29", "name": "AHeadStart Tutoring", "country": "NZ", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/QUhlYWRTdGFydCBUdXRvcmluZ0BHYW1tYXg=" }, { "date": "2026-09-29", "name": "Crowder Industries, Inc", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/Q3Jvd2RlciBJbmR1c3RyaWVzLCBJbmNAR2FtbWF4" }, { "date": "2026-09-18", "name": "Premier Lighting & Controls", "country": "US", "sectors": [ "manufacturing" ], "url": "https://www.ransomware.live/id/UHJlbWllciBMaWdodGluZyAmIENvbnRyb2xzQEdhbW1heA==" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "sarcoma", "group": "sarcoma", "name": "sarcoma", "note": null, "attck": [], "activity": { "postings": 3, "first": "2026-10-13", "last": "2026-10-31", "countries": { "PH": 1, "??": 2 }, "sectors": { "consumer": 1, "services": 1, "unknown": 1 }, "recent": [ { "date": "2026-10-31", "name": "Ivan Smith Furniture", "country": "PH", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/SXZhbiBTbWl0aCBGdXJuaXR1cmVAc2FyY29tYQ" }, { "date": "2026-10-23", "name": "Don Pickett & Associates", "country": "??", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/RG9uIFBpY2tldHQgJiBBc3NvY2lhdGVzQHNhcmNvbWE" }, { "date": "2026-10-13", "name": "victim", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/dmljdGltQHNhcmNvbWE" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } }, { "slug": "ulose", "group": "ulose", "name": "ULose", "note": null, "attck": [], "activity": { "postings": 3, "first": "2026-09-30", "last": "2026-10-27", "countries": { "??": 2, "KR": 1 }, "sectors": { "unknown": 3 }, "recent": [ { "date": "2026-10-27", "name": "zzq-test", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/enpxLXRlc3RAVUxvc2U" }, { "date": "2026-10-27", "name": "probe-011637cabbf94076-", "country": "??", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/cHJvYmUtMDExNjM3Y2FiYmY5NDA3Ni1AVUxvc2U" }, { "date": "2026-09-30", "name": "www.newyjh.com", "country": "KR", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/d3d3Lm5ld3lqaC5jb21AVUxvc2U=" } ] }, "convergences": [], "reports": [], "techniques": [], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 0, "defendable": 0, "covered": 0, "uncovered": [] } } ] }