[
{"post_title":"<a href='https://placer.ai' rel='nofollow noopener noreferrer' target='_blank'>Placer AI</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-12T04:40:15.942670+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Technology"},
{"post_title":"<a href='https://bigid.com' rel='nofollow noopener noreferrer' target='_blank'>BigID</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-12T04:39:54.997383+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/f3de817eff522d69006d5a24744eb8fd.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://confluent.io' rel='nofollow noopener noreferrer' target='_blank'>Confluent</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-12T04:39:33.974759+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/6ab280d599e9c0d07bf9243d01247b33.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://moneygram.com' rel='nofollow noopener noreferrer' target='_blank'>MoneyGram</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-12T04:39:12.930381+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/61452f6a9c260c85835a50cae92ff5ac.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"<a href='https://kfc.com' rel='nofollow noopener noreferrer' target='_blank'>KFC</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-12T04:38:52.626526+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/4ee0975c2eab44799ddcdb3c9bc8f72b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://eversource.com' rel='nofollow noopener noreferrer' target='_blank'>Eversource Energy</a>","group_name":"<a href='http://neclc36yt4yaa5lv54kh4qbhvjcvuv6nnaurqowkellytpvj3afh4aid.onion/companies' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Redact'>Redact</a>","discovered":"2026-10-12T03:23:11.328584+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/dde43211c986889efac13449e9a1813d.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Energy & Utilities"},
{"post_title":"<a href='https://www.mgtlog.com' rel='nofollow noopener noreferrer' target='_blank'>MGT Lojistik AŞ</a>","group_name":"<a href='/group/nightspire/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/nightspire · NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, In…'>nightspire</a>","discovered":"2026-10-12T01:18:12.550271+00:00","country":"TR","country_flag":"<a href='/country/tr/' title='Ransomware victims in Turkey'><span class='fi fi-tr fis'></span> <span>TR</span></a>","screenshot":"","activity":"Transportation"},
{"post_title":"<a href='https://kp-i.co.uk' rel='nofollow noopener noreferrer' target='_blank'>KP Industries</a>","group_name":"<a href='/group/nightspire/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/nightspire · NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, In…'>nightspire</a>","discovered":"2026-10-12T01:17:49.237806+00:00","country":"GB","country_flag":"<a href='/country/gb/' title='Ransomware victims in United Kingdom'><span class='fi fi-gb fis'></span> <span>GB</span></a>","screenshot":"","activity":"Not Found"},
{"post_title":"<a href='https://spelmanlogistics.com' rel='nofollow noopener noreferrer' target='_blank'>Spelman Logistics</a>","group_name":"<a href='/group/emperador/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/emperador'>emperador</a>","discovered":"2026-10-11T22:21:27.370329+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/afffecb8f91db20a224fa3a3d4a65b6f.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Transportation"},
{"post_title":"Company #24","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-10-11T20:53:02.237588+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/cd9319ce146401b8763e0b86ae1f7407.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://huntcompanies.com' rel='nofollow noopener noreferrer' target='_blank'>huntcompanies.com</a>","group_name":"<a href='/group/braincipher/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/BrainCipher · Brain Cipher emerged in July 2024. Both Windows and Linux variants are available. Brain Cipher using the leaked build of LockBit Black for their operations. The group suspected to have exploited CV…'>BrainCipher</a>","discovered":"2026-10-11T20:21:17.589236+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/0571e74ba8fbdfb57555885f558220e6.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"Company #23","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-10-11T18:56:11.684828+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/cd9319ce146401b8763e0b86ae1f7407.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"Company #22","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-10-11T18:55:38.377541+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/cd9319ce146401b8763e0b86ae1f7407.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"Company #21","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-10-11T18:55:04.645391+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/cd9319ce146401b8763e0b86ae1f7407.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"Company #20","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-10-11T18:54:28.848036+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/cd9319ce146401b8763e0b86ae1f7407.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"Company #19","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-10-11T18:53:54.281151+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/cd9319ce146401b8763e0b86ae1f7407.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"Company #14","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-10-11T18:53:20.420456+00:00","country":"CA","country_flag":"<a href='/country/ca/' title='Ransomware victims in Canada'><span class='fi fi-ca fis'></span> <span>CA</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/cd9319ce146401b8763e0b86ae1f7407.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"Reed &amp; Giordano PA","group_name":"<a href='/group/rhysida/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/rhysida · Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets&#x27; networks and d…'>rhysida</a>","discovered":"2026-10-11T15:28:31.162726+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/3d22751625f113fc6f83c2585e729cb3.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"Company #29","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-10-11T14:24:49.484199+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/cd9319ce146401b8763e0b86ae1f7407.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"Company #28","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-10-11T14:24:16.510501+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/cd9319ce146401b8763e0b86ae1f7407.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"Company #27","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-10-11T14:23:38.899647+00:00","country":"AU","country_flag":"<a href='/country/au/' title='Ransomware victims in Australia'><span class='fi fi-au fis'></span> <span>AU</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/cd9319ce146401b8763e0b86ae1f7407.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"Company #26","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-10-11T14:23:05.603426+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/cd9319ce146401b8763e0b86ae1f7407.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"Company #25","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-10-11T14:22:32.820044+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/cd9319ce146401b8763e0b86ae1f7407.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://kerix.net/fr/annuaire-entreprise/cnesten' rel='nofollow noopener noreferrer' target='_blank'>CNESTEN</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-11T12:03:56.093755+00:00","country":"MA","country_flag":"<a href='/country/ma/' title='Ransomware victims in Morocco'><span class='fi fi-ma fis'></span> <span>MA</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/c9c79b26ea26c6e0de65d4f2404217b0.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Government & Defense"},
{"post_title":"<a href='https://www.friendshipchristian.net' rel='nofollow noopener noreferrer' target='_blank'>Friendship Christian School</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-11T12:03:13.556260+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/0afe4e786da30d4656c96ec5e9fe96ea.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Education"},
{"post_title":"Charles E. Tabor AAL LLC","group_name":"<a href='/group/rhysida/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/rhysida · Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets&#x27; networks and d…'>rhysida</a>","discovered":"2026-10-11T06:31:57.130852+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/f626d52dc6305c1c670eb771cafe32d1.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://tqc.com.pe' rel='nofollow noopener noreferrer' target='_blank'>TQC S.A.</a>","group_name":"<a href='/group/dragonforce/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/dragonforce · DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a &quot;ransomware cartel&quot; i…'>dragonforce</a>","discovered":"2026-10-11T05:00:46.698408+00:00","country":"PE","country_flag":"<a href='/country/pe/' title='Ransomware victims in Peru'><span class='fi fi-pe fis'></span> <span>PE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/478e14f93089b89d6efd68c37ba86724.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://www.confipetrol.com' rel='nofollow noopener noreferrer' target='_blank'>Confipetrol</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-11T02:58:30.613472+00:00","country":"CO","country_flag":"<a href='/country/co/' title='Ransomware victims in Colombia'><span class='fi fi-co fis'></span> <span>CO</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/2f7da1a4cacf5a5c6b29e654e7e45a39.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Energy & Utilities"},
{"post_title":"<a href='https://hsc.mb.ca' rel='nofollow noopener noreferrer' target='_blank'>hsc.mb.ca</a>","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-10-11T01:14:06.099529+00:00","country":"CA","country_flag":"<a href='/country/ca/' title='Ransomware victims in Canada'><span class='fi fi-ca fis'></span> <span>CA</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/7ca066336f805f3cc0466d47de3b524d.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://piopio.com.co' rel='nofollow noopener noreferrer' target='_blank'>PIO PIO</a>","group_name":"<a href='/group/majinahanashi/' title='aka Majin · Files (offline) — needs Tor · Profile: https://www.ransomware.live/group/Majinahanashi'>Majinahanashi</a>","discovered":"2026-10-10T20:48:46.286109+00:00","country":"CO","country_flag":"<a href='/country/co/' title='Ransomware victims in Colombia'><span class='fi fi-co fis'></span> <span>CO</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/8f5d1bc323385e6508e11ab1c478d602.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://bonjourgroup.net' rel='nofollow noopener noreferrer' target='_blank'>BONJOUR GROUP</a>","group_name":"<a href='/group/majinahanashi/' title='aka Majin · Files (offline) — needs Tor · Profile: https://www.ransomware.live/group/Majinahanashi'>Majinahanashi</a>","discovered":"2026-10-10T20:48:13.941072+00:00","country":"IN","country_flag":"<a href='/country/in/' title='Ransomware victims in India'><span class='fi fi-in fis'></span> <span>IN</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/db74b0b5ad827844dd5c3c3722955584.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://ktrestaurants.com' rel='nofollow noopener noreferrer' target='_blank'>KT RESTAURANT</a>","group_name":"<a href='/group/majinahanashi/' title='aka Majin · Files (offline) — needs Tor · Profile: https://www.ransomware.live/group/Majinahanashi'>Majinahanashi</a>","discovered":"2026-10-10T20:47:41.963930+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/0910367ec7ca2345a59095189e1370f5.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Hospitality"},
{"post_title":"<a href='https://son-video.com' rel='nofollow noopener noreferrer' target='_blank'>SON-VIDEO</a>","group_name":"<a href='/group/majinahanashi/' title='aka Majin · Files (offline) — needs Tor · Profile: https://www.ransomware.live/group/Majinahanashi'>Majinahanashi</a>","discovered":"2026-10-10T20:47:09.032593+00:00","country":"FR","country_flag":"<a href='/country/fr/' title='Ransomware victims in France'><span class='fi fi-fr fis'></span> <span>FR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/d520c6b55c08233b16ff4484a1bc81c3.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://starfoods.pt' rel='nofollow noopener noreferrer' target='_blank'>GRUPO STARFOODS</a>","group_name":"<a href='/group/majinahanashi/' title='aka Majin · Files (offline) — needs Tor · Profile: https://www.ransomware.live/group/Majinahanashi'>Majinahanashi</a>","discovered":"2026-10-10T20:46:35.890929+00:00","country":"PT","country_flag":"<a href='/country/pt/' title='Ransomware victims in Portugal'><span class='fi fi-pt fis'></span> <span>PT</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/5189b0f932cebccf26af42ec421340d5.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Agriculture and Food Production"},
{"post_title":"CDA","group_name":"<a href='/group/majinahanashi/' title='aka Majin · Files (offline) — needs Tor · Profile: https://www.ransomware.live/group/Majinahanashi'>Majinahanashi</a>","discovered":"2026-10-10T20:46:02.489763+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/559eb4616171dab000b0b1b52108f1fb.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://wondrdiamonds.com' rel='nofollow noopener noreferrer' target='_blank'>WONDR DIAMONDS &amp; D GEM MOUNT</a>","group_name":"<a href='/group/majinahanashi/' title='aka Majin · Files (offline) — needs Tor · Profile: https://www.ransomware.live/group/Majinahanashi'>Majinahanashi</a>","discovered":"2026-10-10T20:45:28.283206+00:00","country":"IN","country_flag":"<a href='/country/in/' title='Ransomware victims in India'><span class='fi fi-in fis'></span> <span>IN</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/ef1d09eca92e52b6c908029dfecaf10b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"CARIBE / SUBRA","group_name":"<a href='/group/majinahanashi/' title='aka Majin · Files (offline) — needs Tor · Profile: https://www.ransomware.live/group/Majinahanashi'>Majinahanashi</a>","discovered":"2026-10-10T20:44:54.555810+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/1e9a5ca9bac2c458e46a23b1b3fef832.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://schmitz-nittenwilm.de' rel='nofollow noopener noreferrer' target='_blank'>SCHMITZ &amp; NITTENWILM</a>","group_name":"<a href='/group/majinahanashi/' title='aka Majin · Files (offline) — needs Tor · Profile: https://www.ransomware.live/group/Majinahanashi'>Majinahanashi</a>","discovered":"2026-10-10T20:44:19.977063+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/81c78247a05c69ec61fb65d4a7eeecb7.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://gocciaspa.com' rel='nofollow noopener noreferrer' target='_blank'>Goccia S.p.A.</a>","group_name":"<a href='/group/majinahanashi/' title='aka Majin · Files (offline) — needs Tor · Profile: https://www.ransomware.live/group/Majinahanashi'>Majinahanashi</a>","discovered":"2026-10-10T20:43:47.837336+00:00","country":"IT","country_flag":"<a href='/country/it/' title='Ransomware victims in Italy'><span class='fi fi-it fis'></span> <span>IT</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/0e024af7ee64c60dc28ada06d818950e.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://camandona.ch' rel='nofollow noopener noreferrer' target='_blank'>Camandona SA</a>","group_name":"<a href='/group/majinahanashi/' title='aka Majin · Files (offline) — needs Tor · Profile: https://www.ransomware.live/group/Majinahanashi'>Majinahanashi</a>","discovered":"2026-10-10T20:43:15.105015+00:00","country":"CH","country_flag":"<a href='/country/ch/' title='Ransomware victims in Switzerland'><span class='fi fi-ch fis'></span> <span>CH</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/52ef0dfa358f0075bc07aecd628b7f44.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://biotecha.lv' rel='nofollow noopener noreferrer' target='_blank'>UAB Biotecha</a>","group_name":"<a href='/group/majinahanashi/' title='aka Majin · Files (offline) — needs Tor · Profile: https://www.ransomware.live/group/Majinahanashi'>Majinahanashi</a>","discovered":"2026-10-10T20:42:41.940327+00:00","country":"LT","country_flag":"<a href='/country/lt/' title='Ransomware victims in Lithuania'><span class='fi fi-lt fis'></span> <span>LT</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/1a042d177ab834edf7368d1fc927feb5.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://eticod.pl' rel='nofollow noopener noreferrer' target='_blank'>ETICOD</a>","group_name":"<a href='/group/majinahanashi/' title='aka Majin · Files (offline) — needs Tor · Profile: https://www.ransomware.live/group/Majinahanashi'>Majinahanashi</a>","discovered":"2026-10-10T20:42:10.140390+00:00","country":"PL","country_flag":"<a href='/country/pl/' title='Ransomware victims in Poland'><span class='fi fi-pl fis'></span> <span>PL</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/d482ef018e1dfbb0dbeef41de46c4d9d.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"CALICHE","group_name":"<a href='/group/majinahanashi/' title='aka Majin · Files (offline) — needs Tor · Profile: https://www.ransomware.live/group/Majinahanashi'>Majinahanashi</a>","discovered":"2026-10-10T20:41:30.398332+00:00","country":"CL","country_flag":"<a href='/country/cl/' title='Ransomware victims in Chile'><span class='fi fi-cl fis'></span> <span>CL</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/c9accf44030ebe29d47f9999141f78f2.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Energy & Utilities"},
{"post_title":"Grand Ion Delemen Hotel","group_name":"<a href='/group/majinahanashi/' title='aka Majin · Files (offline) — needs Tor · Profile: https://www.ransomware.live/group/Majinahanashi'>Majinahanashi</a>","discovered":"2026-10-10T20:41:08.745932+00:00","country":"TR","country_flag":"<a href='/country/tr/' title='Ransomware victims in Turkey'><span class='fi fi-tr fis'></span> <span>TR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/28251eb141963b7ff47d22d56dc6de6b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Hospitality"},
{"post_title":"<a href='https://themargohotel.com' rel='nofollow noopener noreferrer' target='_blank'>The Margo Hotel</a>","group_name":"<a href='/group/majinahanashi/' title='aka Majin · Files (offline) — needs Tor · Profile: https://www.ransomware.live/group/Majinahanashi'>Majinahanashi</a>","discovered":"2026-10-10T20:40:25.040301+00:00","country":"GB","country_flag":"<a href='/country/gb/' title='Ransomware victims in United Kingdom'><span class='fi fi-gb fis'></span> <span>GB</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/610ff097d0bd412054438b2d11cde2f6.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Hospitality"},
{"post_title":"PCA Group Sdn. Bhd.","group_name":"<a href='/group/majinahanashi/' title='aka Majin · Files (offline) — needs Tor · Profile: https://www.ransomware.live/group/Majinahanashi'>Majinahanashi</a>","discovered":"2026-10-10T20:39:52.476298+00:00","country":"MY","country_flag":"<a href='/country/my/' title='Ransomware victims in Malaysia'><span class='fi fi-my fis'></span> <span>MY</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/253a372d6ff4e0055c463d8294838c1c.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"TERRACOM &amp; MONTCAU","group_name":"<a href='/group/majinahanashi/' title='aka Majin · Files (offline) — needs Tor · Profile: https://www.ransomware.live/group/Majinahanashi'>Majinahanashi</a>","discovered":"2026-10-10T20:39:20.714965+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/a224d00cebfb5aea59baab1126ee2313.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"HYSYTECH S.r.l.","group_name":"<a href='/group/majinahanashi/' title='aka Majin · Files (offline) — needs Tor · Profile: https://www.ransomware.live/group/Majinahanashi'>Majinahanashi</a>","discovered":"2026-10-10T20:38:47.900658+00:00","country":"IT","country_flag":"<a href='/country/it/' title='Ransomware victims in Italy'><span class='fi fi-it fis'></span> <span>IT</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/b820cfe34f9cf53275c6b5c17e323b6b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://texma.com.tw' rel='nofollow noopener noreferrer' target='_blank'>TEXMA International Co., Ltd</a>","group_name":"<a href='/group/dragonforce/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/dragonforce · DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a &quot;ransomware cartel&quot; i…'>dragonforce</a>","discovered":"2026-10-10T20:31:45.583913+00:00","country":"TW","country_flag":"<a href='/country/tw/' title='Ransomware victims in Taiwan'><span class='fi fi-tw fis'></span> <span>TW</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/af703a7360550825c7e5d59814fdb673.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://rtaf.mi.th' rel='nofollow noopener noreferrer' target='_blank'>Royal Thai Air Force</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-10T20:30:08.186003+00:00","country":"TH","country_flag":"<a href='/country/th/' title='Ransomware victims in Thailand'><span class='fi fi-th fis'></span> <span>TH</span></a>","screenshot":"","activity":"Government & Defense"},
{"post_title":"<a href='https://helwan.edu.eg' rel='nofollow noopener noreferrer' target='_blank'>Helwan University (HITU)</a>","group_name":"<a href='/group/umbra/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/UmBra'>UmBra</a>","discovered":"2026-10-10T16:54:23.654958+00:00","country":"EG","country_flag":"<a href='/country/eg/' title='Ransomware victims in Egypt'><span class='fi fi-eg fis'></span> <span>EG</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/d05c021893576e0ade86ab4a66fdbf28.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Education"},
{"post_title":"<a href='https://dexcom.com' rel='nofollow noopener noreferrer' target='_blank'>DexCom</a>","group_name":"<a href='http://neclc36yt4yaa5lv54kh4qbhvjcvuv6nnaurqowkellytpvj3afh4aid.onion/companies' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Redact'>Redact</a>","discovered":"2026-10-10T16:53:38.697114+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/dde43211c986889efac13449e9a1813d.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://www.aciproyectos.com' rel='nofollow noopener noreferrer' target='_blank'>ACI Proyectos SAS</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-10T16:06:32.517468+00:00","country":"CO","country_flag":"<a href='/country/co/' title='Ransomware victims in Colombia'><span class='fi fi-co fis'></span> <span>CO</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/268643db4927c9f66b176d5c49e755cf.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://www.riogrande.gob.ar' rel='nofollow noopener noreferrer' target='_blank'>Secretaría de Modernización e Innovación del Municipio</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-10T16:05:54.361768+00:00","country":"AR","country_flag":"<a href='/country/ar/' title='Ransomware victims in Argentina'><span class='fi fi-ar fis'></span> <span>AR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/b8ee8b7ece26dc5ab66f55faeb9a6b82.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Government & Defense"},
{"post_title":"<a href='https://koike-asia.com' rel='nofollow noopener noreferrer' target='_blank'>KOIKE Sanso Kogoyo Co. Ltd.</a>","group_name":"<a href='http://m3ksukzn2glzfdvlusohril7n3iyk4z4fudf6mm22lwhpbpt5aiee5qd.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/exitium · Exitium is a data extortion group first observed in early 2026, operating a Tor-based double extortion site and targeting victims via bulk data exfiltration followed by public naming-and-shaming, w…'>exitium</a>","discovered":"2026-10-10T14:31:50.448423+00:00","country":"JP","country_flag":"<a href='/country/jp/' title='Ransomware victims in Japan'><span class='fi fi-jp fis'></span> <span>JP</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/c81dede367c10a30f7403435fa01065f.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://gressandclarklaw.com' rel='nofollow noopener noreferrer' target='_blank'>Gress Clark Young &amp; Schoepper</a>","group_name":"<a href='/group/rhysida/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/rhysida · Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets&#x27; networks and d…'>rhysida</a>","discovered":"2026-10-10T12:46:50.865750+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/f626d52dc6305c1c670eb771cafe32d1.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://www.glenhardiecc.com' rel='nofollow noopener noreferrer' target='_blank'>Glenhardie Country Club</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-10T12:45:59.206369+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/eada10de7b52ebe778f9fcc115c75697.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Hospitality"},
{"post_title":"<a href='https://www.ldconstructora.cl' rel='nofollow noopener noreferrer' target='_blank'>LD Constructora</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-10T12:45:10.486069+00:00","country":"CL","country_flag":"<a href='/country/cl/' title='Ransomware victims in Chile'><span class='fi fi-cl fis'></span> <span>CL</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://saber1.com' rel='nofollow noopener noreferrer' target='_blank'>Saber1</a>","group_name":"<a href='/group/deadlock/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/deadlock'>Deadlock</a>","discovered":"2026-10-09T22:51:48.912828+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Not Found"},
{"post_title":"<a href='https://www.idipharma.com' rel='nofollow noopener noreferrer' target='_blank'>idi pharma</a>","group_name":"<a href='/group/deadlock/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/deadlock'>Deadlock</a>","discovered":"2026-10-09T22:51:27.775430+00:00","country":"ES","country_flag":"<a href='/country/es/' title='Ransomware victims in Spain'><span class='fi fi-es fis'></span> <span>ES</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://hoteldelfinolugano.ch' rel='nofollow noopener noreferrer' target='_blank'>hoteldelfinolugano.ch</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-10-09T22:10:29.512693+00:00","country":"CH","country_flag":"<a href='/country/ch/' title='Ransomware victims in Switzerland'><span class='fi fi-ch fis'></span> <span>CH</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/2cc2f37504dc434c428b6a06f7c7e035.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Hospitality"},
{"post_title":"<a href='https://dwi-bau.de' rel='nofollow noopener noreferrer' target='_blank'>dwi-bau.de</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-10-09T22:09:44.515861+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/df12bcbbc935a00e943b59c41f2fa09b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://astranahealth.com' rel='nofollow noopener noreferrer' target='_blank'>astranahealth.com</a>","group_name":"<a href='/group/chaos/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/chaos · Chaos is a ransomware-as-a-service operation that emerged in early 2025, likely formed by former BlackSuit/Royal members, offering cross-platform ransomware for Windows, Linux, ESXi, and NAS to aff…'>chaos</a>","discovered":"2026-10-09T21:58:20.680183+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/27ca8da525cdc9326e18ba4e19f41f36.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"Supreme Energy","group_name":"<a href='/group/panzer/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Panzer'>Panzer</a>","discovered":"2026-10-09T21:25:22.284883+00:00","country":"ID","country_flag":"<a href='/country/id/' title='Ransomware victims in Indonesia'><span class='fi fi-id fis'></span> <span>ID</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/ac6cbc2ecbfc883fc19a184be327cc97.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Energy & Utilities"},
{"post_title":"solutend","group_name":"<a href='/group/panzer/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Panzer'>Panzer</a>","discovered":"2026-10-09T21:24:50.670968+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/b8d16dc0e9be5352eea49c145eb2900d.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://northshoresun.timesreview.com' rel='nofollow noopener noreferrer' target='_blank'>northshoresun.timesreview.com</a>","group_name":"<a href='/group/settra/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/settra'>settra</a>","discovered":"2026-10-09T21:11:04.381697+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/39a604c72ec413a63aa1d833faf08f2b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://www.vadetogroup.com' rel='nofollow noopener noreferrer' target='_blank'>Vadeto Group</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-09T20:08:10.108235+00:00","country":"SE","country_flag":"<a href='/country/se/' title='Ransomware victims in Sweden'><span class='fi fi-se fis'></span> <span>SE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/da6ee6c7a7567e58377acc1dc3e1713b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://aacounty.org' rel='nofollow noopener noreferrer' target='_blank'>Anne Arundel County</a>","group_name":"<a href='/group/rhysida/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/rhysida · Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets&#x27; networks and d…'>rhysida</a>","discovered":"2026-10-09T19:38:34.194291+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/8906edabfd1f4aac9263b446a2b7aae7.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Government & Defense"},
{"post_title":"<a href='https://fleetworksinc.com' rel='nofollow noopener noreferrer' target='_blank'>fleetworksinc.com</a>","group_name":"<a href='/group/threeam/' title='aka 3Am · Chat (online) — needs Tor · Profile: https://www.ransomware.live/group/threeam · A new Ransomware family identified by the name &#x27;3AM&#x27; or &#x27;ThreeAM&#x27; in September 2023. The ransomware operation was observed by the Symantec team, in which a ransomware affiliate attempted to deploy …'>threeam</a>","discovered":"2026-10-09T19:33:42.469953+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/c29a6d971d8238c2351e5d7b046d80a4.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Transportation"},
{"post_title":"<a href='https://dwmmh.org' rel='nofollow noopener noreferrer' target='_blank'>DW McMillan Memorial Hospital</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:27:57.502979+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://sktc.sk.ca' rel='nofollow noopener noreferrer' target='_blank'>Saskatoon Tribal Council</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:27:50.083943+00:00","country":"CA","country_flag":"<a href='/country/ca/' title='Ransomware victims in Canada'><span class='fi fi-ca fis'></span> <span>CA</span></a>","screenshot":"","activity":"Government & Defense"},
{"post_title":"<a href='https://aquatech.com' rel='nofollow noopener noreferrer' target='_blank'>Aquatech</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:27:37.040207+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Energy & Utilities"},
{"post_title":"<a href='https://anytech365.com' rel='nofollow noopener noreferrer' target='_blank'>AnyTech365</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:27:29.566008+00:00","country":"GB","country_flag":"<a href='/country/gb/' title='Ransomware victims in United Kingdom'><span class='fi fi-gb fis'></span> <span>GB</span></a>","screenshot":"","activity":"Technology"},
{"post_title":"<a href='https://greenbrookengineering.com' rel='nofollow noopener noreferrer' target='_blank'>Greenbrook Engineering</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:27:16.377492+00:00","country":"GB","country_flag":"<a href='/country/gb/' title='Ransomware victims in United Kingdom'><span class='fi fi-gb fis'></span> <span>GB</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://tgn.com.ar' rel='nofollow noopener noreferrer' target='_blank'>TGN</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:27:08.669491+00:00","country":"AR","country_flag":"<a href='/country/ar/' title='Ransomware victims in Argentina'><span class='fi fi-ar fis'></span> <span>AR</span></a>","screenshot":"","activity":"Not Found"},
{"post_title":"<a href='https://galileng.com' rel='nofollow noopener noreferrer' target='_blank'>Galil Engineering</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:26:55.725537+00:00","country":"IL","country_flag":"<a href='/country/il/' title='Ransomware victims in Israel'><span class='fi fi-il fis'></span> <span>IL</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://smartvalue.biz' rel='nofollow noopener noreferrer' target='_blank'>Smart Value</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:26:47.802729+00:00","country":"BZ","country_flag":"<span class='fi fi-bz fis'></span> <span>BZ</span>","screenshot":"","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://kooltronic.com' rel='nofollow noopener noreferrer' target='_blank'>Kooltronic</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:26:34.421415+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://skyplan.com' rel='nofollow noopener noreferrer' target='_blank'>Skyplan Services</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:26:28.327850+00:00","country":"","country_flag":"","screenshot":"","activity":"Professional Services"},
{"post_title":"<a href='https://refako.dk' rel='nofollow noopener noreferrer' target='_blank'>Refako Autodele</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:26:19.082652+00:00","country":"DK","country_flag":"<a href='/country/dk/' title='Ransomware victims in Denmark'><span class='fi fi-dk fis'></span> <span>DK</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://h2o-michel.fr' rel='nofollow noopener noreferrer' target='_blank'>SAS H2O MICHEL</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:26:07.705337+00:00","country":"FR","country_flag":"<a href='/country/fr/' title='Ransomware victims in France'><span class='fi fi-fr fis'></span> <span>FR</span></a>","screenshot":"","activity":"Other"},
{"post_title":"<a href='https://huskyboutique.com' rel='nofollow noopener noreferrer' target='_blank'>Husky Ltee</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:25:58.353368+00:00","country":"CA","country_flag":"<a href='/country/ca/' title='Ransomware victims in Canada'><span class='fi fi-ca fis'></span> <span>CA</span></a>","screenshot":"","activity":"Other"},
{"post_title":"<a href='https://asessippi.com' rel='nofollow noopener noreferrer' target='_blank'>Asessippi Ski Resort</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:25:47.077498+00:00","country":"CA","country_flag":"<a href='/country/ca/' title='Ransomware victims in Canada'><span class='fi fi-ca fis'></span> <span>CA</span></a>","screenshot":"","activity":"Hospitality"},
{"post_title":"<a href='https://pirsales.com' rel='nofollow noopener noreferrer' target='_blank'>PIR Sales</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:25:37.817628+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Other"},
{"post_title":"<a href='https://jentech.com.tw' rel='nofollow noopener noreferrer' target='_blank'>Jentech Precision Industrial</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:25:26.433237+00:00","country":"TW","country_flag":"<a href='/country/tw/' title='Ransomware victims in Taiwan'><span class='fi fi-tw fis'></span> <span>TW</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://santeesd.net' rel='nofollow noopener noreferrer' target='_blank'>Santee School District Foundation</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:25:17.311454+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Education"},
{"post_title":"<a href='https://uob.edu.om' rel='nofollow noopener noreferrer' target='_blank'>University of Buraimi</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:25:01.407530+00:00","country":"OM","country_flag":"<a href='/country/om/' title='Ransomware victims in Oman'><span class='fi fi-om fis'></span> <span>OM</span></a>","screenshot":"","activity":"Education"},
{"post_title":"<a href='https://ansonia.org' rel='nofollow noopener noreferrer' target='_blank'>Ansonia Public Schools</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:24:56.618762+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Education"},
{"post_title":"<a href='https://allsouls.qld.edu.au' rel='nofollow noopener noreferrer' target='_blank'>All Souls St Gabriels School</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:24:40.772304+00:00","country":"AU","country_flag":"<a href='/country/au/' title='Ransomware victims in Australia'><span class='fi fi-au fis'></span> <span>AU</span></a>","screenshot":"","activity":"Education"},
{"post_title":"<a href='https://ragelectric.com' rel='nofollow noopener noreferrer' target='_blank'>Rag Electric</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:24:35.787189+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Energy & Utilities"},
{"post_title":"<a href='https://myworkstream.com' rel='nofollow noopener noreferrer' target='_blank'>Maverick Desk</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:24:20.212741+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Other"},
{"post_title":"<a href='https://polishingproz.com' rel='nofollow noopener noreferrer' target='_blank'>Polishing Proz</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:24:14.744459+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Other"},
{"post_title":"<a href='https://nwpolytech.ca' rel='nofollow noopener noreferrer' target='_blank'>Northwestern Polytechnic</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:23:59.451693+00:00","country":"CA","country_flag":"<a href='/country/ca/' title='Ransomware victims in Canada'><span class='fi fi-ca fis'></span> <span>CA</span></a>","screenshot":"","activity":"Education"},
{"post_title":"<a href='https://k2machine.cz' rel='nofollow noopener noreferrer' target='_blank'>Machine sro</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:23:54.076553+00:00","country":"CZ","country_flag":"<a href='/country/cz/' title='Ransomware victims in Czechia'><span class='fi fi-cz fis'></span> <span>CZ</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://abilitytw.com' rel='nofollow noopener noreferrer' target='_blank'>Ability Enterprise</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:23:38.769340+00:00","country":"TW","country_flag":"<a href='/country/tw/' title='Ransomware victims in Taiwan'><span class='fi fi-tw fis'></span> <span>TW</span></a>","screenshot":"","activity":"Not Found"},
{"post_title":"<a href='https://aa.org' rel='nofollow noopener noreferrer' target='_blank'>Alcoholics Anonymous</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:23:33.474645+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://mabris.fr' rel='nofollow noopener noreferrer' target='_blank'>Mabris</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:23:18.072218+00:00","country":"FR","country_flag":"<a href='/country/fr/' title='Ransomware victims in France'><span class='fi fi-fr fis'></span> <span>FR</span></a>","screenshot":"","activity":"Not Found"},
{"post_title":"<a href='https://potomacanimalhospital.com' rel='nofollow noopener noreferrer' target='_blank'>Potomac Animal Hospital</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:23:13.992984+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://jrwalshlaw.com' rel='nofollow noopener noreferrer' target='_blank'>The Law Office of James R Walsh</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:22:56.955394+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Professional Services"},
{"post_title":"<a href='https://allsmilesnova.com' rel='nofollow noopener noreferrer' target='_blank'>All Smiles Dental of Falls Church</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:22:53.300743+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://ajesticindiaholidays.com' rel='nofollow noopener noreferrer' target='_blank'>Majestic Holidays India Private Limited</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:22:36.213075+00:00","country":"IN","country_flag":"<a href='/country/in/' title='Ransomware victims in India'><span class='fi fi-in fis'></span> <span>IN</span></a>","screenshot":"","activity":"Hospitality"},
{"post_title":"<a href='https://habbaslaw.com' rel='nofollow noopener noreferrer' target='_blank'>Habbas Associates</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:22:32.596720+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Not Found"},
{"post_title":"<a href='https://palmainc.com' rel='nofollow noopener noreferrer' target='_blank'>Palma</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:22:15.403540+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Other"},
{"post_title":"<a href='https://mercymedcolumbus.com' rel='nofollow noopener noreferrer' target='_blank'>MercyMed of Columbus</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:22:11.751699+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://bewellctr.org' rel='nofollow noopener noreferrer' target='_blank'>North Philadelphia Health System</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:21:50.911412+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://www.deloitte.com' rel='nofollow noopener noreferrer' target='_blank'>Deloitte</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-09T19:21:30.182669+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/605c7d7538b9f6f3743a851bd9187ad8.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://merrillsteel.com' rel='nofollow noopener noreferrer' target='_blank'>Merrill Iron &amp; Steel</a>","group_name":"<a href='/group/payoutsking/' title='aka Payouts King · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/payoutsking · PayoutsKing is an active ransomware group observed through at least 2026 that has claimed attacks against a wide range of industries internationally — including Del Monte Foods and V. FRAAS — acros…'>payoutsking</a>","discovered":"2026-10-09T19:21:09.828445+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/077e831e982647ffdfc727ceac6fe241.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://watermarkcommunities.com' rel='nofollow noopener noreferrer' target='_blank'>Watermark Retirement Communities</a>","group_name":"<a href='/group/payoutsking/' title='aka Payouts King · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/payoutsking · PayoutsKing is an active ransomware group observed through at least 2026 that has claimed attacks against a wide range of industries internationally — including Del Monte Foods and V. FRAAS — acros…'>payoutsking</a>","discovered":"2026-10-09T19:20:09.750265+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/ce616c96ef40d7cd750f1962884704bb.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://www.bayer.com/en' rel='nofollow noopener noreferrer' target='_blank'>bayer</a>","group_name":"<a href='/group/black-x/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Black%20X'>Black X</a>","discovered":"2026-10-09T19:14:00.205357+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/192ae3c66fa5e79d6b69711850e33d2a.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://entouch.jp' rel='nofollow noopener noreferrer' target='_blank'>enTouch</a>","group_name":"<a href='/group/black-x/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Black%20X'>Black X</a>","discovered":"2026-10-09T19:13:19.588979+00:00","country":"JP","country_flag":"<a href='/country/jp/' title='Ransomware victims in Japan'><span class='fi fi-jp fis'></span> <span>JP</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/560bd2a4d225e04869ede2068dca6e70.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://lopay.com' rel='nofollow noopener noreferrer' target='_blank'>lopay</a>","group_name":"<a href='/group/black-x/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Black%20X'>Black X</a>","discovered":"2026-10-09T19:12:37.596311+00:00","country":"GB","country_flag":"<a href='/country/gb/' title='Ransomware victims in United Kingdom'><span class='fi fi-gb fis'></span> <span>GB</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/a68d6f28c18e5df0fb8af5aa6b3ef8ec.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"<a href='https://www.tepcomp.fi' rel='nofollow noopener noreferrer' target='_blank'>Tepcomp</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-09T18:05:46.973522+00:00","country":"FI","country_flag":"<a href='/country/fi/' title='Ransomware victims in Finland'><span class='fi fi-fi fis'></span> <span>FI</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/a0d26e27697af4e25c381fef1095bea6.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://shalomca.com' rel='nofollow noopener noreferrer' target='_blank'>Shalom Christian Academy</a>","group_name":"<a href='/group/interlock/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/interlock · Interlock is a ransomware group first observed in September 2024 that targets critical infrastructure sectors including healthcare, government, education, and technology across North America and Eu…'>interlock</a>","discovered":"2026-10-09T18:02:14.927410+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Education"},
{"post_title":"Mynd","group_name":"<a href='/group/anubis/' title='Chat (online) — needs Tor · Profile: https://www.ransomware.live/group/anubis · Anubis is a ransomware-as-a-service group active since December 2024 that targets healthcare, engineering, construction, and professional services sectors, offering affiliates a flexible revenue sp…'>anubis</a>","discovered":"2026-10-09T17:28:37.344824+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/e546a0b391c14b55e7dd60b68cdb0b60.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"Imperial Diamond Jewellery","group_name":"<a href='/group/emperador/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/emperador'>emperador</a>","discovered":"2026-10-09T17:21:57.756871+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/feae521d9461d03253fa1707d7e48f0c.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://www.melchioni.com' rel='nofollow noopener noreferrer' target='_blank'>Melchioni Spa</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-09T14:15:33.839294+00:00","country":"IT","country_flag":"<a href='/country/it/' title='Ransomware victims in Italy'><span class='fi fi-it fis'></span> <span>IT</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/311fc1adf0b90baff77b316b85b7021c.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://aethosconsultoria.com.br' rel='nofollow noopener noreferrer' target='_blank'>AETHOS</a>","group_name":"<a href='/group/arcusmedia/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/arcusmedia · Arcus Media is a ransomware-as-a-service group that emerged in May 2024, employing double extortion with ChaCha20 + RSA-2048 encryption and recruiting affiliates via a referral-based vetting proces…'>arcusmedia</a>","discovered":"2026-10-09T13:31:23.706804+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/1f6ad413f37efeeda6a792c5e45af394.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://mblllp.ca' rel='nofollow noopener noreferrer' target='_blank'>mblllp</a>","group_name":"<a href='/group/arcusmedia/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/arcusmedia · Arcus Media is a ransomware-as-a-service group that emerged in May 2024, employing double extortion with ChaCha20 + RSA-2048 encryption and recruiting affiliates via a referral-based vetting proces…'>arcusmedia</a>","discovered":"2026-10-09T13:30:47.891304+00:00","country":"CA","country_flag":"<a href='/country/ca/' title='Ransomware victims in Canada'><span class='fi fi-ca fis'></span> <span>CA</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/54454214a0c75529bb8d8c1663e21437.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://ladrillera.mx' rel='nofollow noopener noreferrer' target='_blank'>Ladrillera Mecanizada</a>","group_name":"<a href='/group/arcusmedia/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/arcusmedia · Arcus Media is a ransomware-as-a-service group that emerged in May 2024, employing double extortion with ChaCha20 + RSA-2048 encryption and recruiting affiliates via a referral-based vetting proces…'>arcusmedia</a>","discovered":"2026-10-09T13:30:13.573522+00:00","country":"MX","country_flag":"<a href='/country/mx/' title='Ransomware victims in Mexico'><span class='fi fi-mx fis'></span> <span>MX</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/c842244fa23d82911a030ccb7771138c.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"Yarema","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-10-09T13:29:16.968913+00:00","country":"","country_flag":"","screenshot":"","activity":"Other"},
{"post_title":"<a href='https://www.identalsoft.com' rel='nofollow noopener noreferrer' target='_blank'>iDentalSoft</a>","group_name":"<a href='/group/termite/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/termite · Termite is a ransomware group first identified in late 2024 using a modified version of Babuk ransomware code; its most notable attack was the November 2024 breach of supply-chain software firm Blu…'>termite</a>","discovered":"2026-10-09T12:59:37.236746+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/186c713da2ae2516e91d2e95b5464515.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://www.dudley-land.com' rel='nofollow noopener noreferrer' target='_blank'>Dudley Land Company</a>","group_name":"<a href='/group/bravox/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/bravox · BravoX is a selective ransomware-as-a-service operation that surfaced publicly in January 2026 after advertising on the RAMP underground forum, targeting primarily US-based organizations in healthc…'>bravox</a>","discovered":"2026-10-09T12:37:17.746583+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/fe60a2da7f5282b5c75c75f0ea1e11b3.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"Design Electric","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-10-09T12:35:35.763382+00:00","country":"","country_flag":"","screenshot":"","activity":"Manufacturing"},
{"post_title":"TigerPress (DCC)","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-10-09T12:35:16.047263+00:00","country":"","country_flag":"","screenshot":"","activity":"Other"},
{"post_title":"RealManage","group_name":"<a href='/group/rhysida/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/rhysida · Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets&#x27; networks and d…'>rhysida</a>","discovered":"2026-10-09T12:10:15.176224+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/8906edabfd1f4aac9263b446a2b7aae7.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"Anaergia | World-Leading Anaerobic Digestion Solutions","group_name":"<a href='http://cryoblogedawivdcknyd4jsjxkrx3xrqqltxla6wwjjnzm3f3jaxjzqd.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/cry0 · Cry0 is a ransomware-as-a-service operation that recruits affiliates via underground forums, using a Rust-written payload with blockchain-based (Internet Computer Protocol) negotiation infrastructu…'>cry0</a>","discovered":"2026-10-09T12:00:56.045550+00:00","country":"CA","country_flag":"<a href='/country/ca/' title='Ransomware victims in Canada'><span class='fi fi-ca fis'></span> <span>CA</span></a>","screenshot":"","activity":"Energy & Utilities"},
{"post_title":"<a href='https://www.hagiva.co.il' rel='nofollow noopener noreferrer' target='_blank'>Hagiva Yh</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-09T11:11:18.416828+00:00","country":"IL","country_flag":"<a href='/country/il/' title='Ransomware victims in Israel'><span class='fi fi-il fis'></span> <span>IL</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/d0424be7e136d49ccf4acb62818cec85.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://fondyfoodpantry.org' rel='nofollow noopener noreferrer' target='_blank'>Fondy Food Pantry</a>","group_name":"<a href='/group/nightspire/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/nightspire · NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, In…'>nightspire</a>","discovered":"2026-10-09T06:04:22.753131+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Agriculture and Food Production"},
{"post_title":"The Bernard Osher Foundation","group_name":"<a href='/group/nightspire/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/nightspire · NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, In…'>nightspire</a>","discovered":"2026-10-09T06:04:03.131333+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Education"},
{"post_title":"PMG Project Management Group","group_name":"<a href='/group/nightspire/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/nightspire · NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, In…'>nightspire</a>","discovered":"2026-10-09T06:03:43.772196+00:00","country":"AE","country_flag":"<a href='/country/ae/' title='Ransomware victims in United Arab Emirates'><span class='fi fi-ae fis'></span> <span>AE</span></a>","screenshot":"","activity":"Professional Services"},
{"post_title":"<a href='https://poljoprivreda.gov.hr' rel='nofollow noopener noreferrer' target='_blank'>Ministarstvo poljoprivrede, šumarstva i ribarstva</a>","group_name":"<a href='/group/barracuda/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Barracuda'>Barracuda</a>","discovered":"2026-10-09T04:20:25.706924+00:00","country":"HR","country_flag":"<a href='/country/hr/' title='Ransomware victims in Croatia'><span class='fi fi-hr fis'></span> <span>HR</span></a>","screenshot":"","activity":"Agriculture and Food Production"},
{"post_title":"<a href='https://maentelhaus-kaiser.de' rel='nofollow noopener noreferrer' target='_blank'>Mäntelhaus Kaiser GmbH &amp; Co. KG</a>","group_name":"<a href='/group/nightspire/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/nightspire · NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, In…'>nightspire</a>","discovered":"2026-10-09T02:06:40.364801+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://www.inapi.cl/en/about-inapi/inapi' rel='nofollow noopener noreferrer' target='_blank'>INAPI</a>","group_name":"<a href='/group/nightspire/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/nightspire · NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, In…'>nightspire</a>","discovered":"2026-10-09T01:09:44.560186+00:00","country":"DZ","country_flag":"<a href='/country/dz/' title='Ransomware victims in Algeria'><span class='fi fi-dz fis'></span> <span>DZ</span></a>","screenshot":"","activity":"Technology"},
{"post_title":"<a href='https://medcomtech.es/en' rel='nofollow noopener noreferrer' target='_blank'>Medcom Tech Information</a>","group_name":"<a href='/group/nightspire/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/nightspire · NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, In…'>nightspire</a>","discovered":"2026-10-09T01:09:21.718839+00:00","country":"ES","country_flag":"<a href='/country/es/' title='Ransomware victims in Spain'><span class='fi fi-es fis'></span> <span>ES</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://www.wearchitects.com' rel='nofollow noopener noreferrer' target='_blank'>WAGA Enterprises Architects LLC</a>","group_name":"<a href='/group/nightspire/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/nightspire · NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, In…'>nightspire</a>","discovered":"2026-10-09T01:08:59.486423+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Professional Services"},
{"post_title":"<a href='https://heidisevents.com' rel='nofollow noopener noreferrer' target='_blank'>Heidi's Events &amp; Catering, Inc.</a>","group_name":"<a href='/group/nightspire/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/nightspire · NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, In…'>nightspire</a>","discovered":"2026-10-09T01:08:36.640070+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Hospitality"},
{"post_title":"<a href='https://sdc-arts.org' rel='nofollow noopener noreferrer' target='_blank'>Sangre de Cristo Arts and Conference Center</a>","group_name":"<a href='/group/nightspire/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/nightspire · NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, In…'>nightspire</a>","discovered":"2026-10-09T01:08:13.181020+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Hospitality"},
{"post_title":"<a href='https://superport.vn' rel='nofollow noopener noreferrer' target='_blank'>Vietnam SuperPort</a>","group_name":"<a href='/group/nightspire/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/nightspire · NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, In…'>nightspire</a>","discovered":"2026-10-09T01:07:50.517873+00:00","country":"VN","country_flag":"<a href='/country/vn/' title='Ransomware victims in Vietnam'><span class='fi fi-vn fis'></span> <span>VN</span></a>","screenshot":"","activity":"Transportation"},
{"post_title":"<a href='https://www.valvorobica.eu' rel='nofollow noopener noreferrer' target='_blank'>Valvorobica Industirale S.p.A</a>","group_name":"<a href='/group/nightspire/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/nightspire · NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, In…'>nightspire</a>","discovered":"2026-10-09T00:11:31.421012+00:00","country":"IT","country_flag":"<a href='/country/it/' title='Ransomware victims in Italy'><span class='fi fi-it fis'></span> <span>IT</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://www.kc-ph.com' rel='nofollow noopener noreferrer' target='_blank'>KC Pharmaceuticals, Inc</a>","group_name":"<a href='/group/nightspire/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/nightspire · NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, In…'>nightspire</a>","discovered":"2026-10-09T00:11:08.855396+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://ohaganmeyer.com' rel='nofollow noopener noreferrer' target='_blank'>O'Hagan Meyer</a>","group_name":"<a href='/group/silentransomgroup/' title='aka Luna Moth · DLS (online) · Profile: https://www.ransomware.live/group/silentransomgroup · A former Conti team'>SilentRansomGroup</a>","discovered":"2026-10-08T23:22:09.715901+00:00","country":"","country_flag":"","screenshot":"","activity":"Professional Services"},
{"post_title":"<a href='https://www.magopsa.com' rel='nofollow noopener noreferrer' target='_blank'>Mid Atlantic Gynecologic Oncology and Pelvic Surgery Associates</a>","group_name":"<a href='/group/netrunner/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/netrunner · NetRunner is a ransomware group active from at least 2025 targeting diverse sectors including healthcare, telecommunications, manufacturing, and agriculture across Japan, Italy, the US, and Jordan,…'>netrunner</a>","discovered":"2026-10-08T22:40:26.720698+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/616b2db50a4bae8a4eb22f3c189e2612.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"SOCOCO","group_name":"<a href='/group/umbra/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/UmBra'>UmBra</a>","discovered":"2026-10-08T21:36:50.533825+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/d05c021893576e0ade86ab4a66fdbf28.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://dipecarr.com.br' rel='nofollow noopener noreferrer' target='_blank'>dipecarr.com.br</a>","group_name":"<a href='/group/eclipse/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Eclipse'>Eclipse</a>","discovered":"2026-10-08T21:21:19.222767+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/48b1df997bbefe970b777d78d5fe48f6.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://www.mcmtelecom.com' rel='nofollow noopener noreferrer' target='_blank'>MCM Telecom</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-08T21:07:24.672943+00:00","country":"MX","country_flag":"<a href='/country/mx/' title='Ransomware victims in Mexico'><span class='fi fi-mx fis'></span> <span>MX</span></a>","screenshot":"","activity":"Technology"},
{"post_title":"Baker McKenzie","group_name":"<a href='/group/silentransomgroup/' title='aka Luna Moth · DLS (online) · Profile: https://www.ransomware.live/group/silentransomgroup · A former Conti team'>SilentRansomGroup</a>","discovered":"2026-10-08T20:52:34.476155+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Professional Services"},
{"post_title":"<a href='https://manipaldubai.com' rel='nofollow noopener noreferrer' target='_blank'>Manipal Academy of Higher Edu</a>","group_name":"<a href='/group/umbra/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/UmBra'>UmBra</a>","discovered":"2026-10-08T20:29:01.377809+00:00","country":"IN","country_flag":"<a href='/country/in/' title='Ransomware victims in India'><span class='fi fi-in fis'></span> <span>IN</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/d05c021893576e0ade86ab4a66fdbf28.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Education"},
{"post_title":"<a href='https://iitr.ac.in' rel='nofollow noopener noreferrer' target='_blank'>IIT Roorkee</a>","group_name":"<a href='/group/umbra/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/UmBra'>UmBra</a>","discovered":"2026-10-08T20:28:18.438174+00:00","country":"IN","country_flag":"<a href='/country/in/' title='Ransomware victims in India'><span class='fi fi-in fis'></span> <span>IN</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/d05c021893576e0ade86ab4a66fdbf28.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Education"},
{"post_title":"FSE, Cairo University","group_name":"<a href='/group/umbra/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/UmBra'>UmBra</a>","discovered":"2026-10-08T20:27:35.313179+00:00","country":"EG","country_flag":"<a href='/country/eg/' title='Ransomware victims in Egypt'><span class='fi fi-eg fis'></span> <span>EG</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/d05c021893576e0ade86ab4a66fdbf28.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Education"},
{"post_title":"<a href='https://boullard.ch' rel='nofollow noopener noreferrer' target='_blank'>Boullard Musique</a>","group_name":"<a href='/group/payload/' title='Chat (online) — needs Tor · Profile: https://www.ransomware.live/group/payload · Payload is a ransomware group that emerged in early 2026, using Babuk-derived source code targeting both Windows and ESXi systems with cross-platform double-extortion attacks against healthcare, en…'>payload</a>","discovered":"2026-10-08T19:33:32.557265+00:00","country":"CH","country_flag":"<a href='/country/ch/' title='Ransomware victims in Switzerland'><span class='fi fi-ch fis'></span> <span>CH</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/f8ce3d9357949395312954e2c9e3fb22.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://simplexengg.in' rel='nofollow noopener noreferrer' target='_blank'>simplexengg.in</a>","group_name":"<a href='/group/eclipse/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Eclipse'>Eclipse</a>","discovered":"2026-10-08T17:53:39.641217+00:00","country":"IN","country_flag":"<a href='/country/in/' title='Ransomware victims in India'><span class='fi fi-in fis'></span> <span>IN</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://sanjoseattorneys.com' rel='nofollow noopener noreferrer' target='_blank'>sanjoseattorneys.com</a>","group_name":"<a href='/group/eclipse/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Eclipse'>Eclipse</a>","discovered":"2026-10-08T17:52:47.896965+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Professional Services"},
{"post_title":"Andersen Group Inc.","group_name":"<a href='/group/silentransomgroup/' title='aka Luna Moth · DLS (online) · Profile: https://www.ransomware.live/group/silentransomgroup · A former Conti team'>SilentRansomGroup</a>","discovered":"2026-10-08T16:26:51.947000+00:00","country":"","country_flag":"","screenshot":"","activity":"Professional Services"},
{"post_title":"<a href='https://www.dipecarr.com.br' rel='nofollow noopener noreferrer' target='_blank'>DIPECARR</a>","group_name":"<a href='/group/eclipse/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Eclipse'>Eclipse</a>","discovered":"2026-10-08T14:22:39.888264+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/16c547c69e597e35c729940009b2ce9d.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://www.globalair.com.sg' rel='nofollow noopener noreferrer' target='_blank'>Global AirFreight International</a>","group_name":"<a href='/group/eclipse/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Eclipse'>Eclipse</a>","discovered":"2026-10-08T13:22:17.469894+00:00","country":"SG","country_flag":"<a href='/country/sg/' title='Ransomware victims in Singapore'><span class='fi fi-sg fis'></span> <span>SG</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/8b69dc0e512277f6d1f82b7477c525b0.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Transportation"},
{"post_title":"Morton LTC Pharmacy","group_name":"<a href='http://rnsmwareartse3m4hjsumjf222pnka6gad26cqxqmbjvevhbnym5p6ad.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/RunSomeWares · RunSomeWares is an emerging ransomware group that surfaced in February 2025 with initial victims across supply-chain services, financial services, accounting, and manufacturing, with unclear deploy…'>RunSomeWares</a>","discovered":"2026-10-08T11:54:06.766447+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/2055a720d379af2b31495b48f8d82f6e.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"Cooperative Des Techniciens Ambulanciers De La Monte","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-10-08T05:25:57.714492+00:00","country":"CA","country_flag":"<a href='/country/ca/' title='Ransomware victims in Canada'><span class='fi fi-ca fis'></span> <span>CA</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/b669653c7752ab3c726660602a0275aa.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"TheraCare","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-10-08T05:25:26.782110+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/25afb192ba9ad8cd22f2623a7566a1b7.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://yalebooks.yale.edu' rel='nofollow noopener noreferrer' target='_blank'>yalebooks.yale.edu</a>","group_name":"<a href='http://scarlettgugldabhgz3uertpnxglxytddxbd5vnoma5pihfk6k5q2sid.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Scarlettgroup'>Scarlettgroup</a>","discovered":"2026-10-08T05:21:32.601392+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/79c2af8cddb55eec14eed4786413e49c.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Education"},
{"post_title":"<a href='https://consilio.com' rel='nofollow noopener noreferrer' target='_blank'>consilio.com</a>","group_name":"<a href='/group/lockbit5/' title='Files (online) — needs Tor · Profile: https://www.ransomware.live/group/lockbit5 · LockBit 5.0 (&quot;ChuongDong&quot;) emerged in September 2025 as the group&#x27;s resurgence following the February 2024 law enforcement takedown, introducing cross-platform payloads targeting Windows, Linux, an…'>lockbit5</a>","discovered":"2026-10-08T03:34:03.103700+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/1776f0b64bbb6cee1b93119a0ed46751.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://capitalbankhaiti.biz' rel='nofollow noopener noreferrer' target='_blank'>capitalbankhaiti.biz</a>","group_name":"<a href='/group/lockbit5/' title='Files (online) — needs Tor · Profile: https://www.ransomware.live/group/lockbit5 · LockBit 5.0 (&quot;ChuongDong&quot;) emerged in September 2025 as the group&#x27;s resurgence following the February 2024 law enforcement takedown, introducing cross-platform payloads targeting Windows, Linux, an…'>lockbit5</a>","discovered":"2026-10-08T03:33:18.010903+00:00","country":"HT","country_flag":"<span class='fi fi-ht fis'></span> <span>HT</span>","screenshot":"<a href='https://images.ransomware.live/victims/5d1fa24bc72f023125bff38d534bb4c0.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"<a href='https://grunenwald.com' rel='nofollow noopener noreferrer' target='_blank'>grunenwald.com</a>","group_name":"<a href='/group/lockbit5/' title='Files (online) — needs Tor · Profile: https://www.ransomware.live/group/lockbit5 · LockBit 5.0 (&quot;ChuongDong&quot;) emerged in September 2025 as the group&#x27;s resurgence following the February 2024 law enforcement takedown, introducing cross-platform payloads targeting Windows, Linux, an…'>lockbit5</a>","discovered":"2026-10-08T03:32:37.315584+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/6bb56dd3d8707c0d42e750ff7f664285.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://avsa.com.ar' rel='nofollow noopener noreferrer' target='_blank'>avsa.com.ar</a>","group_name":"<a href='/group/lockbit5/' title='Files (online) — needs Tor · Profile: https://www.ransomware.live/group/lockbit5 · LockBit 5.0 (&quot;ChuongDong&quot;) emerged in September 2025 as the group&#x27;s resurgence following the February 2024 law enforcement takedown, introducing cross-platform payloads targeting Windows, Linux, an…'>lockbit5</a>","discovered":"2026-10-08T03:31:57.308030+00:00","country":"AR","country_flag":"<a href='/country/ar/' title='Ransomware victims in Argentina'><span class='fi fi-ar fis'></span> <span>AR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/36c22e7715c31839fffa9cb71d8d122b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://www.aeu.org.uy/home' rel='nofollow noopener noreferrer' target='_blank'>Asociación de Escribanos del Uruguay</a>","group_name":"<a href='/group/nightspire/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/nightspire · NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, In…'>nightspire</a>","discovered":"2026-10-08T02:04:03.780436+00:00","country":"UY","country_flag":"<a href='/country/uy/' title='Ransomware victims in Uruguay'><span class='fi fi-uy fis'></span> <span>UY</span></a>","screenshot":"","activity":"Professional Services"},
{"post_title":"<a href='https://spmardique.com' rel='nofollow noopener noreferrer' target='_blank'>Sociedad Portuaria Mardique S.A.</a>","group_name":"<a href='/group/nightspire/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/nightspire · NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, In…'>nightspire</a>","discovered":"2026-10-08T02:03:40.786647+00:00","country":"CO","country_flag":"<a href='/country/co/' title='Ransomware victims in Colombia'><span class='fi fi-co fis'></span> <span>CO</span></a>","screenshot":"","activity":"Transportation"},
{"post_title":"<a href='https://www.sinaephuket.com' rel='nofollow noopener noreferrer' target='_blank'>Sinae Phuket Luxury Hotel</a>","group_name":"<a href='/group/nightspire/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/nightspire · NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, In…'>nightspire</a>","discovered":"2026-10-08T02:03:19.614146+00:00","country":"TH","country_flag":"<a href='/country/th/' title='Ransomware victims in Thailand'><span class='fi fi-th fis'></span> <span>TH</span></a>","screenshot":"","activity":"Hospitality"},
{"post_title":"<a href='https://www.ini.fiocruz.br' rel='nofollow noopener noreferrer' target='_blank'>INI Fiocruz</a>","group_name":"<a href='/group/nightspire/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/nightspire · NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, In…'>nightspire</a>","discovered":"2026-10-08T02:02:57.968103+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://lumabuilt.com' rel='nofollow noopener noreferrer' target='_blank'>Lumabuilt</a>","group_name":"<a href='/group/nightspire/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/nightspire · NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, In…'>nightspire</a>","discovered":"2026-10-08T02:02:34.272497+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://www.egt.com' rel='nofollow noopener noreferrer' target='_blank'>Royal EGT</a>","group_name":"<a href='/group/nightspire/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/nightspire · NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, In…'>nightspire</a>","discovered":"2026-10-08T02:02:09.233178+00:00","country":"EG","country_flag":"<a href='/country/eg/' title='Ransomware victims in Egypt'><span class='fi fi-eg fis'></span> <span>EG</span></a>","screenshot":"","activity":"Energy & Utilities"},
{"post_title":"Deese and Locklear Chiropractic Center","group_name":"<a href='/group/nightspire/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/nightspire · NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, In…'>nightspire</a>","discovered":"2026-10-08T02:01:48.013860+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://www.ksldirtworks.com' rel='nofollow noopener noreferrer' target='_blank'>KSL Dirtworks</a>","group_name":"<a href='/group/nightspire/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/nightspire · NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, In…'>nightspire</a>","discovered":"2026-10-08T02:01:27.138214+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"Nantou Shiuhkuang Senior High School.","group_name":"<a href='/group/nightspire/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/nightspire · NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, In…'>nightspire</a>","discovered":"2026-10-08T02:01:04.841064+00:00","country":"TW","country_flag":"<a href='/country/tw/' title='Ransomware victims in Taiwan'><span class='fi fi-tw fis'></span> <span>TW</span></a>","screenshot":"","activity":"Education"},
{"post_title":"K...","group_name":"<a href='/group/silentransomgroup/' title='aka Luna Moth · DLS (online) · Profile: https://www.ransomware.live/group/silentransomgroup · A former Conti team'>SilentRansomGroup</a>","discovered":"2026-10-07T23:54:15.501274+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/c938014f683b3f79b345b4219214ebab.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://petrosul.com.br' rel='nofollow noopener noreferrer' target='_blank'>Petrosul Distribuidora, Transportadora e Comércio de Combustíveis Ltda.</a>","group_name":"<a href='/group/dragonforce/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/dragonforce · DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a &quot;ransomware cartel&quot; i…'>dragonforce</a>","discovered":"2026-10-07T23:29:33.604203+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/942e997a9052236c203951337c1c7478.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Energy & Utilities"},
{"post_title":"TMobile","group_name":"<a href='http://byodxn5s7sua6oyyjj74rycgn6afncfckprt5ezskt3cni6lg3wdrgad.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/BYOD'>BYOD</a>","discovered":"2026-10-07T23:20:43.410917+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Technology"},
{"post_title":"Gate | Crypto Exchange","group_name":"<a href='http://byodxn5s7sua6oyyjj74rycgn6afncfckprt5ezskt3cni6lg3wdrgad.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/BYOD'>BYOD</a>","discovered":"2026-10-07T23:20:23.690423+00:00","country":"SG","country_flag":"<a href='/country/sg/' title='Ransomware victims in Singapore'><span class='fi fi-sg fis'></span> <span>SG</span></a>","screenshot":"","activity":"Financial Services"},
{"post_title":"<a href='https://www.reso.fr' rel='nofollow noopener noreferrer' target='_blank'>RÉSO</a>","group_name":"<a href='/group/dragonforce/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/dragonforce · DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a &quot;ransomware cartel&quot; i…'>dragonforce</a>","discovered":"2026-10-07T22:59:59.635731+00:00","country":"FR","country_flag":"<a href='/country/fr/' title='Ransomware victims in France'><span class='fi fi-fr fis'></span> <span>FR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/b0256cc0088e71cee58540be2474ffa5.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"The New Community School","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-10-07T22:09:57.343601+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/0e1bb9ffe6a7625f8e55183e7ca553f0.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Education"},
{"post_title":"<a href='https://www.qnie.com' rel='nofollow noopener noreferrer' target='_blank'>Qatar National Import &amp; Export</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-07T19:03:44.410454+00:00","country":"QA","country_flag":"<a href='/country/qa/' title='Ransomware victims in Qatar'><span class='fi fi-qa fis'></span> <span>QA</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/1c953d428c5c5acd457b2c6964b778fb.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://www.avinyo.net' rel='nofollow noopener noreferrer' target='_blank'>Matadero Frigorífico Avinyó</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-07T19:03:06.978880+00:00","country":"ES","country_flag":"<a href='/country/es/' title='Ransomware victims in Spain'><span class='fi fi-es fis'></span> <span>ES</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/4f111ef5640a963cfe29dcd17e6e1dba.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Agriculture and Food Production"},
{"post_title":"University of Rostock","group_name":"<a href='/group/panzer/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Panzer'>Panzer</a>","discovered":"2026-10-07T18:53:05.443804+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/1426b647200a15d235d698822a738b4a.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Education"},
{"post_title":"<a href='https://https:rivierahealthcare.com' rel='nofollow noopener noreferrer' target='_blank'>Riviera Healthcare Center</a>","group_name":"<a href='/group/interlock/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/interlock · Interlock is a ransomware group first observed in September 2024 that targets critical infrastructure sectors including healthcare, government, education, and technology across North America and Eu…'>interlock</a>","discovered":"2026-10-07T18:00:56.245957+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/90cd9997f8bcdb32764c72a1d4c6ccdc.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"Leadec","group_name":"<a href='/group/anubis/' title='Chat (online) — needs Tor · Profile: https://www.ransomware.live/group/anubis · Anubis is a ransomware-as-a-service group active since December 2024 that targets healthcare, engineering, construction, and professional services sectors, offering affiliates a flexible revenue sp…'>anubis</a>","discovered":"2026-10-07T16:54:20.040745+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/bf8119d6cc0b3a65b0b3af89935c25a3.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"Wavecrest HFA","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-10-07T16:03:12.435291+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/261a746f7351580a7f8a4dd2a42534f5.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"Tec Imports","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-10-07T16:02:38.255948+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/ba1549729928cdb722136eda84cf5871.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"UAE Pro League","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-10-07T16:02:02.817151+00:00","country":"AE","country_flag":"<a href='/country/ae/' title='Ransomware victims in United Arab Emirates'><span class='fi fi-ae fis'></span> <span>AE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/7f4712237b29631c78268928f17bef3f.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Hospitality"},
{"post_title":"City of Cloverdale","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-10-07T16:01:25.844271+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/b34fbf2eb6dd1b9d81fc81e1cc398325.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Government & Defense"},
{"post_title":"SANAtech Global Solutions","group_name":"<a href='/group/umbra/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/UmBra'>UmBra</a>","discovered":"2026-10-07T11:27:15.004314+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/d05c021893576e0ade86ab4a66fdbf28.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"Raqib","group_name":"<a href='/group/umbra/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/UmBra'>UmBra</a>","discovered":"2026-10-07T11:26:39.728303+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/d05c021893576e0ade86ab4a66fdbf28.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"Tharisa","group_name":"<a href='/group/umbra/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/UmBra'>UmBra</a>","discovered":"2026-10-07T08:23:30.103540+00:00","country":"ZA","country_flag":"<a href='/country/za/' title='Ransomware victims in South Africa'><span class='fi fi-za fis'></span> <span>ZA</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/d05c021893576e0ade86ab4a66fdbf28.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"Chibitek","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-10-07T05:51:42.782349+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/793491f17c29cb5d5c524abfcfa884b8.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://acmestamping.com' rel='nofollow noopener noreferrer' target='_blank'>acmestamping.com</a>","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-10-07T05:08:14.160618+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/0914130314cd35d0a5bc387efb0fb77e.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://harborpacific.com' rel='nofollow noopener noreferrer' target='_blank'>harborpacific.com</a>","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-10-07T05:07:34.873428+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/a820decadff3d347b7208bbf7cf4516c.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Transportation"},
{"post_title":"<a href='https://architekt-vondanwitz.de' rel='nofollow noopener noreferrer' target='_blank'>architekt-vondanwitz.de</a>","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-10-07T05:06:37.227225+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/2a25b72464ff616d6e01aa575fe1781c.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://www.aon.com' rel='nofollow noopener noreferrer' target='_blank'>Aon</a>","group_name":"<a href='/group/termite/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/termite · Termite is a ransomware group first identified in late 2024 using a modified version of Babuk ransomware code; its most notable attack was the November 2024 breach of supply-chain software firm Blu…'>termite</a>","discovered":"2026-10-07T00:45:51.789572+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/68e5124b9410196f5d0db4d235a1cbde.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://www.eptisa.com' rel='nofollow noopener noreferrer' target='_blank'>EPTISA</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-07T00:10:58.269068+00:00","country":"ES","country_flag":"<a href='/country/es/' title='Ransomware victims in Spain'><span class='fi fi-es fis'></span> <span>ES</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/f7c2e20a96aac76df799ad46a500b72c.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"Andersen Group","group_name":"<a href='/group/silentransomgroup/' title='aka Luna Moth · DLS (online) · Profile: https://www.ransomware.live/group/silentransomgroup · A former Conti team'>SilentRansomGroup</a>","discovered":"2026-10-06T23:52:26.171128+00:00","country":"","country_flag":"","screenshot":"","activity":"Professional Services"},
{"post_title":"EDFelectronics","group_name":"<a href='/group/panzer/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Panzer'>Panzer</a>","discovered":"2026-10-06T22:55:53.652676+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/7a67c76fa4869b897f00ac5c3063199e.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"Beni Suef Technological University – BTU","group_name":"<a href='/group/umbra/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/UmBra'>UmBra</a>","discovered":"2026-10-06T22:24:17.238937+00:00","country":"EG","country_flag":"<a href='/country/eg/' title='Ransomware victims in Egypt'><span class='fi fi-eg fis'></span> <span>EG</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/d05c021893576e0ade86ab4a66fdbf28.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Education"},
{"post_title":"<a href='https://kookabarra.com' rel='nofollow noopener noreferrer' target='_blank'>KOOKABARRA JUICE</a>","group_name":"<a href='/group/vexy-ransomware/' title='aka vexy · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Vexy%20Ransomware'>Vexy Ransomware</a>","discovered":"2026-10-06T20:55:40.519293+00:00","country":"AU","country_flag":"<a href='/country/au/' title='Ransomware victims in Australia'><span class='fi fi-au fis'></span> <span>AU</span></a>","screenshot":"","activity":"Retail & E-Commerce"},
{"post_title":"BNYH","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-06T20:19:20.879065+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/def047c587bb6cf2a4d6e3af02447dd8.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"<a href='https://www.ciftay.com.tr' rel='nofollow noopener noreferrer' target='_blank'>Ciftay Insaat Taahhut Ve Ticaret Anonim Sirketi</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-06T20:18:44.877466+00:00","country":"TR","country_flag":"<a href='/country/tr/' title='Ransomware victims in Turkey'><span class='fi fi-tr fis'></span> <span>TR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/2d37e3449514829213c9f0eaaae455e8.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"SweetRush","group_name":"<a href='/group/panzer/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Panzer'>Panzer</a>","discovered":"2026-10-06T17:51:53.601613+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/ec76a428bc275e842af092175e66e7a5.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://magnals.com' rel='nofollow noopener noreferrer' target='_blank'>magnals.com</a>","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-10-06T17:27:48.689445+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/1a5fd3c19245ea904b74fcc613a24a4b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://greggio.com' rel='nofollow noopener noreferrer' target='_blank'>Greggio Argento</a>","group_name":"<a href='/group/deadlock/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/deadlock'>Deadlock</a>","discovered":"2026-10-06T16:21:21.016089+00:00","country":"IT","country_flag":"<a href='/country/it/' title='Ransomware victims in Italy'><span class='fi fi-it fis'></span> <span>IT</span></a>","screenshot":"","activity":"Agriculture and Food Production"},
{"post_title":"Agri Industrial","group_name":"<a href='/group/everest/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/everest · Everest ransom group collects and analyzes information about their victims. They specialize in customer privacy data, financial information, databases, credit card information, and more. The Everes…'>everest</a>","discovered":"2026-10-06T16:17:41.735199+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/cd25e1a22e36a6c38ff797455ec5fe17.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Agriculture and Food Production"},
{"post_title":"B-accountants","group_name":"<a href='/group/everest/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/everest · Everest ransom group collects and analyzes information about their victims. They specialize in customer privacy data, financial information, databases, credit card information, and more. The Everes…'>everest</a>","discovered":"2026-10-06T16:17:04.817939+00:00","country":"NL","country_flag":"<a href='/country/nl/' title='Ransomware victims in Netherlands'><span class='fi fi-nl fis'></span> <span>NL</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/33e1819d5cf98b6174c381906edfedd2.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"Morcon Developments","group_name":"<a href='/group/everest/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/everest · Everest ransom group collects and analyzes information about their victims. They specialize in customer privacy data, financial information, databases, credit card information, and more. The Everes…'>everest</a>","discovered":"2026-10-06T16:16:28.010797+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/2a408c7bd9ff4136f546f2bf1bd3d1ce.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"Kennametal","group_name":"<a href='/group/everest/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/everest · Everest ransom group collects and analyzes information about their victims. They specialize in customer privacy data, financial information, databases, credit card information, and more. The Everes…'>everest</a>","discovered":"2026-10-06T16:15:50.894358+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/de7ec523e9709f1988eb52bb033a0bec.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"Flydubai","group_name":"<a href='/group/everest/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/everest · Everest ransom group collects and analyzes information about their victims. They specialize in customer privacy data, financial information, databases, credit card information, and more. The Everes…'>everest</a>","discovered":"2026-10-06T16:15:13.028038+00:00","country":"AE","country_flag":"<a href='/country/ae/' title='Ransomware victims in United Arab Emirates'><span class='fi fi-ae fis'></span> <span>AE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/77282b3b45df093a9d5f9b1faedf136c.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Transportation"},
{"post_title":"<a href='https://fourhands.com' rel='nofollow noopener noreferrer' target='_blank'>Four Hands LLC</a>","group_name":"<a href='/group/umbra/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/UmBra'>UmBra</a>","discovered":"2026-10-06T14:54:04.731220+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/d05c021893576e0ade86ab4a66fdbf28.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://mkshelbycpa.com' rel='nofollow noopener noreferrer' target='_blank'>Michael K Shelby, CPA</a>","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-10-06T14:52:35.235760+00:00","country":"","country_flag":"","screenshot":"","activity":"Professional Services"},
{"post_title":"Hygrade","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-10-06T14:52:15.712125+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Agriculture and Food Production"},
{"post_title":"<a href='https://www.corbyrock.ie' rel='nofollow noopener noreferrer' target='_blank'>CORBY ROCK MILL</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-06T09:03:34.702486+00:00","country":"IE","country_flag":"<a href='/country/ie/' title='Ransomware victims in Ireland'><span class='fi fi-ie fis'></span> <span>IE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/61baeac96c293726a40b744b5b927239.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://www.deltamarine.com' rel='nofollow noopener noreferrer' target='_blank'>Delta Marine</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-06T09:02:53.702819+00:00","country":"FI","country_flag":"<a href='/country/fi/' title='Ransomware victims in Finland'><span class='fi fi-fi fis'></span> <span>FI</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/463a843ce2d890462a3e62b0a46741d8.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Transportation"},
{"post_title":"<a href='https://www.jdfinancial.com' rel='nofollow noopener noreferrer' target='_blank'>J&amp;D Financial</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-06T09:02:14.467599+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/b778e14e8f594987a4dc5a37e02cfcf4.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"<a href='https://philander.edu' rel='nofollow noopener noreferrer' target='_blank'>Philander Smith University</a>","group_name":"<a href='http://endzonezgz3sqzmtqg4acp4z7ao7xc6vunfhezjsnfqrm2ksudsredyd.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/EndZone'>EndZone</a>","discovered":"2026-10-06T07:50:52.821133+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Education"},
{"post_title":"A...n","group_name":"<a href='/group/silentransomgroup/' title='aka Luna Moth · DLS (online) · Profile: https://www.ransomware.live/group/silentransomgroup · A former Conti team'>SilentRansomGroup</a>","discovered":"2026-10-05T22:27:00.794177+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/a4a3eb1eb190cbe4637bd11dfc21b568.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://w**.m******.c**' rel='nofollow noopener noreferrer' target='_blank'>M** A******* G********** O******* a** P***** S****** A*********</a>","group_name":"<a href='/group/netrunner/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/netrunner · NetRunner is a ransomware group active from at least 2025 targeting diverse sectors including healthcare, telecommunications, manufacturing, and agriculture across Japan, Italy, the US, and Jordan,…'>netrunner</a>","discovered":"2026-10-05T22:03:55.325954+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Not Found"},
{"post_title":"<a href='https://www.gscsecurity.com' rel='nofollow noopener noreferrer' target='_blank'>Global Security Concepts</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-05T21:04:49.471497+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/5674e416dbb596b9e36778911c5d9e31.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://www.tsgpc.com' rel='nofollow noopener noreferrer' target='_blank'>Medical Data Rx</a>","group_name":"<a href='http://ftvvwyigat4ysm4rqrs43pzijvcbali6zgc6ubvqtocwipzbdldgqlyd.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/VYPR'>VYPR</a>","discovered":"2026-10-05T21:04:26.406621+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://www.agio-usa.com' rel='nofollow noopener noreferrer' target='_blank'>Agio International</a>","group_name":"<a href='http://ftvvwyigat4ysm4rqrs43pzijvcbali6zgc6ubvqtocwipzbdldgqlyd.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/VYPR'>VYPR</a>","discovered":"2026-10-05T21:04:06.066652+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Financial Services"},
{"post_title":"<a href='https://www.simsvibrationlab.com' rel='nofollow noopener noreferrer' target='_blank'>Sims Vibration Laboratory</a>","group_name":"<a href='http://ftvvwyigat4ysm4rqrs43pzijvcbali6zgc6ubvqtocwipzbdldgqlyd.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/VYPR'>VYPR</a>","discovered":"2026-10-05T21:03:46.037702+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://www.circulatingair.com' rel='nofollow noopener noreferrer' target='_blank'>Circulating Air</a>","group_name":"<a href='http://ftvvwyigat4ysm4rqrs43pzijvcbali6zgc6ubvqtocwipzbdldgqlyd.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/VYPR'>VYPR</a>","discovered":"2026-10-05T21:03:25.688124+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://www.gen3construction.com' rel='nofollow noopener noreferrer' target='_blank'>Gen3</a>","group_name":"<a href='http://ftvvwyigat4ysm4rqrs43pzijvcbali6zgc6ubvqtocwipzbdldgqlyd.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/VYPR'>VYPR</a>","discovered":"2026-10-05T21:03:05.590647+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Other"},
{"post_title":"<a href='https://www.jpshealthnet.org' rel='nofollow noopener noreferrer' target='_blank'>JPS Health Network</a>","group_name":"<a href='http://ftvvwyigat4ysm4rqrs43pzijvcbali6zgc6ubvqtocwipzbdldgqlyd.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/VYPR'>VYPR</a>","discovered":"2026-10-05T21:02:45.547984+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://www.champaignschools.org' rel='nofollow noopener noreferrer' target='_blank'>Champaign Unit 4 School District</a>","group_name":"<a href='http://ftvvwyigat4ysm4rqrs43pzijvcbali6zgc6ubvqtocwipzbdldgqlyd.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/VYPR'>VYPR</a>","discovered":"2026-10-05T21:02:25.194711+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Education"},
{"post_title":"<a href='https://www.praxisemr.com' rel='nofollow noopener noreferrer' target='_blank'>Praxis EMR</a>","group_name":"<a href='/group/insomnia/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/insomnia · Insomnia is a data-theft and extortion group that emerged in October 2025, targeting primarily US-based healthcare organizations — stealing patient files and threatening public exposure rather than…'>insomnia</a>","discovered":"2026-10-05T20:42:41.042607+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/8764a4207c0ea1c897d8de08770a0e60.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"Standpointe / Trinite Solutions","group_name":"<a href='http://byodxn5s7sua6oyyjj74rycgn6afncfckprt5ezskt3cni6lg3wdrgad.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/BYOD'>BYOD</a>","discovered":"2026-10-05T20:20:25.039963+00:00","country":"","country_flag":"","screenshot":"","activity":"Professional Services"},
{"post_title":"<a href='https://dd-automation.ch' rel='nofollow noopener noreferrer' target='_blank'>dd-automation.ch</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-10-05T19:39:24.946195+00:00","country":"CH","country_flag":"<a href='/country/ch/' title='Ransomware victims in Switzerland'><span class='fi fi-ch fis'></span> <span>CH</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/0eee285aa085581f80ed22ea2c94228f.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://stuecheli.ch' rel='nofollow noopener noreferrer' target='_blank'>stuecheli.ch</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-10-05T19:37:16.241722+00:00","country":"CH","country_flag":"<a href='/country/ch/' title='Ransomware victims in Switzerland'><span class='fi fi-ch fis'></span> <span>CH</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/0d278531a9738d4ef4ad835f10062b39.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://bwi-bau.de' rel='nofollow noopener noreferrer' target='_blank'>bwi-bau.de</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-10-05T19:36:42.312228+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/ee5217578ddc024abb4f76f258ae6427.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://halservice.it' rel='nofollow noopener noreferrer' target='_blank'>halservice.it</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-10-05T19:36:08.406848+00:00","country":"IT","country_flag":"<a href='/country/it/' title='Ransomware victims in Italy'><span class='fi fi-it fis'></span> <span>IT</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/5ad32138f1c1b04c6a531a6b95857970.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://grundens.com' rel='nofollow noopener noreferrer' target='_blank'>grundens.com</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-10-05T19:35:30.689009+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e30ab60d24921ddfdfd8f93e4649870b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://t-systems.com' rel='nofollow noopener noreferrer' target='_blank'>t-systems.com</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-10-05T19:34:51.869300+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/5d85474d7d23b662e294643a42aed98a.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"R***e Pa******","group_name":"<a href='/group/nightspire/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/nightspire · NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, In…'>nightspire</a>","discovered":"2026-10-05T19:33:49.901402+00:00","country":"","country_flag":"","screenshot":"","activity":"Professional Services"},
{"post_title":"Nelson Mullins Riley &amp; Scarborough","group_name":"<a href='/group/silentransomgroup/' title='aka Luna Moth · DLS (online) · Profile: https://www.ransomware.live/group/silentransomgroup · A former Conti team'>SilentRansomGroup</a>","discovered":"2026-10-05T19:25:27.487642+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Professional Services"},
{"post_title":"Sheppard, Mullin, Richter &amp; Hampton","group_name":"<a href='/group/silentransomgroup/' title='aka Luna Moth · DLS (online) · Profile: https://www.ransomware.live/group/silentransomgroup · A former Conti team'>SilentRansomGroup</a>","discovered":"2026-10-05T19:25:07.895731+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Professional Services"},
{"post_title":"<a href='https://turn5.com' rel='nofollow noopener noreferrer' target='_blank'>Turn5</a>","group_name":"<a href='/group/global-secret-group/' title='aka GSG · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Global%20Secret%20Group'>Global Secret Group</a>","discovered":"2026-10-05T18:53:32.300956+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/b53956e8c6ba607b60764214f02b6f25.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://anwo.cl' rel='nofollow noopener noreferrer' target='_blank'>anwo.cl</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-10-05T18:28:07.066601+00:00","country":"CL","country_flag":"<a href='/country/cl/' title='Ransomware victims in Chile'><span class='fi fi-cl fis'></span> <span>CL</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/70ec8a977ae17fff60b57f0de48a73f2.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://duhaas.sk' rel='nofollow noopener noreferrer' target='_blank'>duhaas.sk</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-10-05T18:27:31.435078+00:00","country":"SK","country_flag":"<a href='/country/sk/' title='Ransomware victims in Slovakia'><span class='fi fi-sk fis'></span> <span>SK</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/80d2e9288373da416e67be43637ec0eb.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://ikhasas.com' rel='nofollow noopener noreferrer' target='_blank'>ikhasas.com</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-10-05T18:26:55.334277+00:00","country":"MY","country_flag":"<a href='/country/my/' title='Ransomware victims in Malaysia'><span class='fi fi-my fis'></span> <span>MY</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/6a51d22a6ff8568586fcb52a545f9a96.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://sterrer.net' rel='nofollow noopener noreferrer' target='_blank'>sterrer.net</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-10-05T18:26:20.115843+00:00","country":"NL","country_flag":"<a href='/country/nl/' title='Ransomware victims in Netherlands'><span class='fi fi-nl fis'></span> <span>NL</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/886e9400402c005dc88a02ff8cf9a69b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://https:hlmanufacturing.com' rel='nofollow noopener noreferrer' target='_blank'>H&amp;L Manufacturing</a>","group_name":"<a href='/group/interlock/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/interlock · Interlock is a ransomware group first observed in September 2024 that targets critical infrastructure sectors including healthcare, government, education, and technology across North America and Eu…'>interlock</a>","discovered":"2026-10-05T15:59:04.667920+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/05da34fe9b0ec2edb5ed5fd2bdb40a68.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://part02.simplexengg.in' rel='nofollow noopener noreferrer' target='_blank'>part02.simplexengg.in</a>","group_name":"<a href='/group/eclipse/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Eclipse'>Eclipse</a>","discovered":"2026-10-05T15:22:43.914417+00:00","country":"IN","country_flag":"<a href='/country/in/' title='Ransomware victims in India'><span class='fi fi-in fis'></span> <span>IN</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/c7d93c7267a3fb2fc3eedf9db250af38.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"Asia Era One","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-05T15:09:14.903290+00:00","country":"TH","country_flag":"<a href='/country/th/' title='Ransomware victims in Thailand'><span class='fi fi-th fis'></span> <span>TH</span></a>","screenshot":"","activity":"Not Found"},
{"post_title":"<a href='https://o2smiles.com' rel='nofollow noopener noreferrer' target='_blank'>O2 Dental Group</a>","group_name":"<a href='/group/interlock/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/interlock · Interlock is a ransomware group first observed in September 2024 that targets critical infrastructure sectors including healthcare, government, education, and technology across North America and Eu…'>interlock</a>","discovered":"2026-10-05T15:01:57.555237+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/28e232cdf3af32f94dbee444bb12c00a.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://windor.com' rel='nofollow noopener noreferrer' target='_blank'>windor.com</a>","group_name":"<a href='/group/settra/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/settra'>settra</a>","discovered":"2026-10-05T13:16:20.528503+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/d5c379ae5fa6ccf51d93ca9c8af88ed9.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://www.onsemi.com' rel='nofollow noopener noreferrer' target='_blank'>Onsemi</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-05T13:15:16.404169+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/f85a0f876f74531b6bccd173504cccea.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://enka.k12.tr' rel='nofollow noopener noreferrer' target='_blank'>ENKA Schools</a>","group_name":"<a href='/group/doommageddon/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Doommageddon · Direct Extortion'>Doommageddon</a>","discovered":"2026-10-05T11:53:59.659960+00:00","country":"TR","country_flag":"<a href='/country/tr/' title='Ransomware victims in Turkey'><span class='fi fi-tr fis'></span> <span>TR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e1712161edbeeab1108f1477b624a971.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Education"},
{"post_title":"Cam Group LLC","group_name":"<a href='/group/doommageddon/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Doommageddon · Direct Extortion'>Doommageddon</a>","discovered":"2026-10-05T11:53:24.326488+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/9b5bb250dbd6a0597b1cc17610c83426.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://franklinempire.com' rel='nofollow noopener noreferrer' target='_blank'>Franklin Empire</a>","group_name":"<a href='http://byodxn5s7sua6oyyjj74rycgn6afncfckprt5ezskt3cni6lg3wdrgad.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/BYOD'>BYOD</a>","discovered":"2026-10-05T11:50:23.875197+00:00","country":"","country_flag":"","screenshot":"","activity":"Other"},
{"post_title":"Infomedia A/S","group_name":"<a href='/group/aurora/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/aurora · Aurora is a ransomware group associated with a multi-purpose Go-based malware distributed by multiple criminal teams from mid-2022, also sold as an infostealer/botnet under the same name on undergr…'>aurora</a>","discovered":"2026-10-05T11:26:41.159312+00:00","country":"DK","country_flag":"<a href='/country/dk/' title='Ransomware victims in Denmark'><span class='fi fi-dk fis'></span> <span>DK</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/c0a52318f91d7d0e08e8c2ff65e50630.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://millensys.com' rel='nofollow noopener noreferrer' target='_blank'>Millensys</a>","group_name":"<a href='/group/medusalocker/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/medusalocker · Medusa is a DDoS bot written in .NET 2.0. In its current incarnation its C&amp;C protocol is based on HTTP, while its predecessor made use of IRC.'>medusalocker</a>","discovered":"2026-10-05T11:08:22.464562+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/b8c32e4fe084ade3487c653eb444c856.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://rueegseggerag.ch' rel='nofollow noopener noreferrer' target='_blank'>Rueegseggerag</a>","group_name":"<a href='/group/medusalocker/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/medusalocker · Medusa is a DDoS bot written in .NET 2.0. In its current incarnation its C&amp;C protocol is based on HTTP, while its predecessor made use of IRC.'>medusalocker</a>","discovered":"2026-10-05T11:07:51.010196+00:00","country":"CH","country_flag":"<a href='/country/ch/' title='Ransomware victims in Switzerland'><span class='fi fi-ch fis'></span> <span>CH</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/ee54b5906531d416fac8b5937179fb4c.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"PANCARIBBEAN LOGISTICS GROUP","group_name":"<a href='/group/emperador/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/emperador'>emperador</a>","discovered":"2026-10-05T10:52:41.591060+00:00","country":"TT","country_flag":"<a href='/country/tt/' title='Ransomware victims in Trinidad and Tobago'><span class='fi fi-tt fis'></span> <span>TT</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/3c51649c59c43d02a5a20fb75c3bb316.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Transportation"},
{"post_title":"Company #3","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-10-05T09:54:53.493395+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/cd9319ce146401b8763e0b86ae1f7407.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"Company #2","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-10-05T09:54:22.369478+00:00","country":"CA","country_flag":"<a href='/country/ca/' title='Ransomware victims in Canada'><span class='fi fi-ca fis'></span> <span>CA</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/cd9319ce146401b8763e0b86ae1f7407.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"Company #1","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-10-05T09:53:51.377163+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/cd9319ce146401b8763e0b86ae1f7407.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"METROCOLOR S.A.","group_name":"<a href='/group/emperador/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/emperador'>emperador</a>","discovered":"2026-10-05T09:49:04.403101+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/c79d464d551c869f73d576cd2a70a2c9.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://typco.com' rel='nofollow noopener noreferrer' target='_blank'>Thomas Y. Pickett &amp; Co., Inc.</a>","group_name":"<a href='/group/aurora/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/aurora · Aurora is a ransomware group associated with a multi-purpose Go-based malware distributed by multiple criminal teams from mid-2022, also sold as an infostealer/botnet under the same name on undergr…'>aurora</a>","discovered":"2026-10-05T08:57:09.746538+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/fdf68abb98cf2308f4e4422bc795709b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://trumpmobile.com' rel='nofollow noopener noreferrer' target='_blank'>Trump Mobile Wireless (Telecom)</a>","group_name":"<a href='http://byodxn5s7sua6oyyjj74rycgn6afncfckprt5ezskt3cni6lg3wdrgad.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/BYOD'>BYOD</a>","discovered":"2026-10-05T08:04:48.407649+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Technology"},
{"post_title":"Eteam","group_name":"<a href='http://byodxn5s7sua6oyyjj74rycgn6afncfckprt5ezskt3cni6lg3wdrgad.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/BYOD'>BYOD</a>","discovered":"2026-10-05T08:04:28.907638+00:00","country":"","country_flag":"","screenshot":"","activity":"Technology"},
{"post_title":"<a href='https://royalselangor.com' rel='nofollow noopener noreferrer' target='_blank'>Royal Selangor</a>","group_name":"<a href='http://byodxn5s7sua6oyyjj74rycgn6afncfckprt5ezskt3cni6lg3wdrgad.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/BYOD'>BYOD</a>","discovered":"2026-10-05T08:04:09.020150+00:00","country":"MY","country_flag":"<a href='/country/my/' title='Ransomware victims in Malaysia'><span class='fi fi-my fis'></span> <span>MY</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://fluge.es' rel='nofollow noopener noreferrer' target='_blank'>Fluge Audiovisuales</a>","group_name":"<a href='/group/lamashtu/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/lamashtu · Lamashtu is an extortion group that first appeared in April 2026, claiming attacks against organizations in France, Romania, and Thailand across energy, pharmaceutical, and film sectors; it has not…'>lamashtu</a>","discovered":"2026-10-05T07:32:31.392811+00:00","country":"ES","country_flag":"<a href='/country/es/' title='Ransomware victims in Spain'><span class='fi fi-es fis'></span> <span>ES</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/11f24e82fc0848a95ec506128af58f6e.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://bender-tribuenen.de' rel='nofollow noopener noreferrer' target='_blank'>Bender Tribunenbau</a>","group_name":"<a href='/group/lamashtu/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/lamashtu · Lamashtu is an extortion group that first appeared in April 2026, claiming attacks against organizations in France, Romania, and Thailand across energy, pharmaceutical, and film sectors; it has not…'>lamashtu</a>","discovered":"2026-10-05T07:31:53.343708+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/1f4947847b04142abbe7aebc800c2741.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://translo.es' rel='nofollow noopener noreferrer' target='_blank'>TRANS LOGROÑO SOCIEDAD ANONIMA</a>","group_name":"<a href='/group/lamashtu/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/lamashtu · Lamashtu is an extortion group that first appeared in April 2026, claiming attacks against organizations in France, Romania, and Thailand across energy, pharmaceutical, and film sectors; it has not…'>lamashtu</a>","discovered":"2026-10-05T07:31:14.640436+00:00","country":"ES","country_flag":"<a href='/country/es/' title='Ransomware victims in Spain'><span class='fi fi-es fis'></span> <span>ES</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/569896f0fac3b74f7e7581b1db040e4b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Transportation"},
{"post_title":"<a href='https://grupotauro.com' rel='nofollow noopener noreferrer' target='_blank'>Grupo Industrial Tauro</a>","group_name":"<a href='/group/lamashtu/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/lamashtu · Lamashtu is an extortion group that first appeared in April 2026, claiming attacks against organizations in France, Romania, and Thailand across energy, pharmaceutical, and film sectors; it has not…'>lamashtu</a>","discovered":"2026-10-05T07:30:34.989865+00:00","country":"MX","country_flag":"<a href='/country/mx/' title='Ransomware victims in Mexico'><span class='fi fi-mx fis'></span> <span>MX</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/205aa5d9ab026959a74224006ade07ec.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://www.boldspring.com' rel='nofollow noopener noreferrer' target='_blank'>Bold Spring Nursery</a>","group_name":"<a href='/group/play/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/play · Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite simil…'>play</a>","discovered":"2026-10-04T19:37:06.566868+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/2fbfdfb7ff3acecd5e0fe58cd8050e57.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Agriculture and Food Production"},
{"post_title":"<a href='https://www.siliconvalleyglass.com' rel='nofollow noopener noreferrer' target='_blank'>Silicon Valley Glass</a>","group_name":"<a href='/group/play/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/play · Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite simil…'>play</a>","discovered":"2026-10-04T19:36:32.595512+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/d799f66f9bd9bf51c9a43e036007452b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"OMUR HIRDAVAT LTD","group_name":"<a href='/group/emperador/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/emperador'>emperador</a>","discovered":"2026-10-04T17:22:49.413371+00:00","country":"TR","country_flag":"<a href='/country/tr/' title='Ransomware victims in Turkey'><span class='fi fi-tr fis'></span> <span>TR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/64b81eea812b8145a53e552ff5a245f9.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://www.morselife.org' rel='nofollow noopener noreferrer' target='_blank'>MorseLife Health System, Inc.</a>","group_name":"<a href='/group/booba-project/' title='aka Booba Team · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Booba%20Project · Booba'>Booba Project</a>","discovered":"2026-10-04T15:20:31.523089+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"Nipigon District Memorial Hospital","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-10-04T15:06:06.658688+00:00","country":"CA","country_flag":"<a href='/country/ca/' title='Ransomware victims in Canada'><span class='fi fi-ca fis'></span> <span>CA</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/3534e07769117399cd461f6c0972bf94.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://www.unidentgroup.net' rel='nofollow noopener noreferrer' target='_blank'>Unident Group</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-04T15:04:22.694759+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/b24f5ad6cd8cf072c458df718468e4ea.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://www.chadwickswitchboards.com.au' rel='nofollow noopener noreferrer' target='_blank'>Chadwick Switchboards</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-04T15:03:44.303119+00:00","country":"AU","country_flag":"<a href='/country/au/' title='Ransomware victims in Australia'><span class='fi fi-au fis'></span> <span>AU</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/bd62333acfb2e815a0044f133925419e.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://www.emser.es' rel='nofollow noopener noreferrer' target='_blank'>Emser</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-04T15:03:05.720221+00:00","country":"ES","country_flag":"<a href='/country/es/' title='Ransomware victims in Spain'><span class='fi fi-es fis'></span> <span>ES</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/8def43cfada8dfd279e47d9757861ccd.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://www.cotesma.coop' rel='nofollow noopener noreferrer' target='_blank'>Cotesma</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-04T15:02:27.864865+00:00","country":"CL","country_flag":"<a href='/country/cl/' title='Ransomware victims in Chile'><span class='fi fi-cl fis'></span> <span>CL</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/78f9c9a6d39032b3e14e98a78ff2e2ac.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://softruck.com' rel='nofollow noopener noreferrer' target='_blank'>Softruck</a>","group_name":"<a href='/group/direwolf/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/direwolf · Dire Wolf is a sophisticated human-operated ransomware group first documented in May 2025, written in Golang using Curve25519/ChaCha20 encryption, targeting manufacturing and technology sectors acr…'>direwolf</a>","discovered":"2026-10-04T14:30:49.735115+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/1b9c99a85ded7d75781106800ac6f169.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://www.mutsumi-g.co.jp' rel='nofollow noopener noreferrer' target='_blank'>Mutsumi Group</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-04T14:10:25.770300+00:00","country":"JP","country_flag":"<a href='/country/jp/' title='Ransomware victims in Japan'><span class='fi fi-jp fis'></span> <span>JP</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/6f689a51e69a4df2e8b3c0299d6aff36.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://m****.com' rel='nofollow noopener noreferrer' target='_blank'>M****C</a>","group_name":"<a href='/group/payoutsking/' title='aka Payouts King · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/payoutsking · PayoutsKing is an active ransomware group observed through at least 2026 that has claimed attacks against a wide range of industries internationally — including Del Monte Foods and V. FRAAS — acros…'>payoutsking</a>","discovered":"2026-10-04T13:19:10.551577+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Not Found"},
{"post_title":"<a href='https://centerstateengineering.com' rel='nofollow noopener noreferrer' target='_blank'>Center State Engineering</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-04T13:17:23.826222+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://euroditel.com' rel='nofollow noopener noreferrer' target='_blank'>euroditel.com</a>","group_name":"<a href='/group/krybit/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/krybit · Krybit is an emerging RaaS group that launched in late March 2026, offering affiliates an 80/20 revenue split with support for Windows, Linux, ESXi, and NAS device encryption, and became notable fo…'>krybit</a>","discovered":"2026-10-04T13:02:10.935014+00:00","country":"FR","country_flag":"<a href='/country/fr/' title='Ransomware victims in France'><span class='fi fi-fr fis'></span> <span>FR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e82e98ed96bba5cfeafc4465a76a33ac.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://superpack.com.co' rel='nofollow noopener noreferrer' target='_blank'>superpack.com.co</a>","group_name":"<a href='/group/krybit/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/krybit · Krybit is an emerging RaaS group that launched in late March 2026, offering affiliates an 80/20 revenue split with support for Windows, Linux, ESXi, and NAS device encryption, and became notable fo…'>krybit</a>","discovered":"2026-10-04T13:01:32.904862+00:00","country":"CO","country_flag":"<a href='/country/co/' title='Ransomware victims in Colombia'><span class='fi fi-co fis'></span> <span>CO</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/0309dfacde156d8623adfba9f5385144.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://daralteb.com' rel='nofollow noopener noreferrer' target='_blank'>daralteb.com</a>","group_name":"<a href='/group/krybit/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/krybit · Krybit is an emerging RaaS group that launched in late March 2026, offering affiliates an 80/20 revenue split with support for Windows, Linux, ESXi, and NAS device encryption, and became notable fo…'>krybit</a>","discovered":"2026-10-04T13:00:54.425784+00:00","country":"IR","country_flag":"<a href='/country/ir/' title='Ransomware victims in Iran'><span class='fi fi-ir fis'></span> <span>IR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e620a8aa278a1df8cf3f9df07044a06b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://www.genesiscred.com' rel='nofollow noopener noreferrer' target='_blank'>Genesis Credit Management</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-03T14:05:35.886097+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/fd8a2af12ab422d843dbb705c3bb673c.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"<a href='https://preconmarine.com' rel='nofollow noopener noreferrer' target='_blank'>Precon Marine Inc</a>","group_name":"<a href='/group/netrunner/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/netrunner · NetRunner is a ransomware group active from at least 2025 targeting diverse sectors including healthcare, telecommunications, manufacturing, and agriculture across Japan, Italy, the US, and Jordan,…'>netrunner</a>","discovered":"2026-10-03T14:04:39.862559+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/904a9d2634f3472783b8e69469cc722d.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Transportation"},
{"post_title":"<a href='https://skaffgroup.com' rel='nofollow noopener noreferrer' target='_blank'>Skaff Group</a>","group_name":"<a href='/group/rhysida/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/rhysida · Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets&#x27; networks and d…'>rhysida</a>","discovered":"2026-10-03T13:02:56.759867+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/8906edabfd1f4aac9263b446a2b7aae7.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://stfrancishawaii.org' rel='nofollow noopener noreferrer' target='_blank'>St. Francis Healthcare Systems of Hawaii</a>","group_name":"<a href='/group/wallstreet/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Wallstreet'>Wallstreet</a>","discovered":"2026-10-03T12:24:31.897105+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"World Cup 2034","group_name":"<a href='/group/wallstreet/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Wallstreet'>Wallstreet</a>","discovered":"2026-10-03T11:54:05.389560+00:00","country":"SA","country_flag":"<a href='/country/sa/' title='Ransomware victims in Saudi Arabia'><span class='fi fi-sa fis'></span> <span>SA</span></a>","screenshot":"","activity":"Other"},
{"post_title":"<a href='https://statesind.com' rel='nofollow noopener noreferrer' target='_blank'>States Industries</a>","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-10-03T06:27:57.199973+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/5f25923a4d6edf72966b902098362eff.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://aware.com' rel='nofollow noopener noreferrer' target='_blank'>Aware</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-03T06:27:35.311369+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Technology"},
{"post_title":"<a href='https://alliedmachine.com' rel='nofollow noopener noreferrer' target='_blank'>Allied Machine &amp; Engineering</a>","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-10-03T06:27:26.357291+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/955476b689dd1f5e13a25475f0fffc33.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://wooshinsys.co.kr' rel='nofollow noopener noreferrer' target='_blank'>WOOSHIN SAFETY SYSTEMS CO LTD</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-03T06:27:14.662368+00:00","country":"KR","country_flag":"<a href='/country/kr/' title='Ransomware victims in South Korea'><span class='fi fi-kr fis'></span> <span>KR</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://stepbystepusa.com' rel='nofollow noopener noreferrer' target='_blank'>Step By Step</a>","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-10-03T06:26:55.380508+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/f8a4c5148807a7a246a3b0926500b699.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Education"},
{"post_title":"<a href='https://zelham.com' rel='nofollow noopener noreferrer' target='_blank'>Zelham</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-03T06:26:53.676330+00:00","country":"","country_flag":"","screenshot":"","activity":"Not Found"},
{"post_title":"<a href='https://santpau.cat' rel='nofollow noopener noreferrer' target='_blank'>Hospital de la Santa Creu i Sant Pau</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-03T06:26:33.138762+00:00","country":"ES","country_flag":"<a href='/country/es/' title='Ransomware victims in Spain'><span class='fi fi-es fis'></span> <span>ES</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://rotamac.ca' rel='nofollow noopener noreferrer' target='_blank'>Rotamac</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-03T06:26:12.222236+00:00","country":"CA","country_flag":"<a href='/country/ca/' title='Ransomware victims in Canada'><span class='fi fi-ca fis'></span> <span>CA</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://mandurahses.org.au' rel='nofollow noopener noreferrer' target='_blank'>Mandurah State Emergency Service</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-03T06:25:51.608513+00:00","country":"AU","country_flag":"<a href='/country/au/' title='Ransomware victims in Australia'><span class='fi fi-au fis'></span> <span>AU</span></a>","screenshot":"","activity":"Government & Defense"},
{"post_title":"<a href='https://westropprimaryschool.co.uk' rel='nofollow noopener noreferrer' target='_blank'>Westrop Primary &amp; Nursery School</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-03T06:25:30.930959+00:00","country":"GB","country_flag":"<a href='/country/gb/' title='Ransomware victims in United Kingdom'><span class='fi fi-gb fis'></span> <span>GB</span></a>","screenshot":"","activity":"Education"},
{"post_title":"<a href='https://gerritystone.com' rel='nofollow noopener noreferrer' target='_blank'>Gerrity Stone</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-10-03T06:25:10.139806+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"The Official Collegeof Architects of León (COAL)","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-10-03T05:54:28.277305+00:00","country":"MX","country_flag":"<a href='/country/mx/' title='Ransomware victims in Mexico'><span class='fi fi-mx fis'></span> <span>MX</span></a>","screenshot":"","activity":"Professional Services"},
{"post_title":"<a href='https://www.novonordisk.com' rel='nofollow noopener noreferrer' target='_blank'>Forma Therapeutics Holdings, Inc.</a>","group_name":"<a href='/group/nightspire/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/nightspire · NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, In…'>nightspire</a>","discovered":"2026-10-03T01:33:09.591144+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://sevenseasgroup.com' rel='nofollow noopener noreferrer' target='_blank'>seven seas group</a>","group_name":"<a href='http://spiralstfe7rtbna7zlv6szdwmjvjszf2d64zkf6z5jykrwnw5jbgpyd.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Spirals'>Spirals</a>","discovered":"2026-10-03T00:53:20.745035+00:00","country":"AE","country_flag":"<a href='/country/ae/' title='Ransomware victims in United Arab Emirates'><span class='fi fi-ae fis'></span> <span>AE</span></a>","screenshot":"","activity":"Transportation"},
{"post_title":"<a href='https://www.lionairthai.com' rel='nofollow noopener noreferrer' target='_blank'>Thai Lion Air</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-02T21:04:55.711379+00:00","country":"TH","country_flag":"<a href='/country/th/' title='Ransomware victims in Thailand'><span class='fi fi-th fis'></span> <span>TH</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/38ddea21028b642dd6b2470d9b3ee844.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Transportation"},
{"post_title":"Mat Bao Corporation","group_name":"<a href='/group/rhysida/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/rhysida · Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets&#x27; networks and d…'>rhysida</a>","discovered":"2026-10-02T20:04:32.336783+00:00","country":"VN","country_flag":"<a href='/country/vn/' title='Ransomware victims in Vietnam'><span class='fi fi-vn fis'></span> <span>VN</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/bd7a822b7d1fa93a9beaab3af29ca138.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"Paessolucoes","group_name":"<a href='/group/panzer/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Panzer'>Panzer</a>","discovered":"2026-10-02T18:25:00.191826+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/718ea457ae5073e908b5cc22b8130a98.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"Electro Heat Sweden AB","group_name":"<a href='/group/rhysida/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/rhysida · Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets&#x27; networks and d…'>rhysida</a>","discovered":"2026-10-02T18:04:03.468529+00:00","country":"SE","country_flag":"<a href='/country/se/' title='Ransomware victims in Sweden'><span class='fi fi-se fis'></span> <span>SE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/fe46bfc4588113f70d3603899f566960.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Energy & Utilities"},
{"post_title":"<a href='https://sportsevents365.com' rel='nofollow noopener noreferrer' target='_blank'>Sports Events365</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-02T18:03:08.704297+00:00","country":"GB","country_flag":"<a href='/country/gb/' title='Ransomware victims in United Kingdom'><span class='fi fi-gb fis'></span> <span>GB</span></a>","screenshot":"","activity":"Hospitality"},
{"post_title":"<a href='https://hollypoultry.com' rel='nofollow noopener noreferrer' target='_blank'>hollypoultry.com</a>","group_name":"<a href='/group/settra/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/settra'>settra</a>","discovered":"2026-10-02T17:38:25.034590+00:00","country":"GB","country_flag":"<a href='/country/gb/' title='Ransomware victims in United Kingdom'><span class='fi fi-gb fis'></span> <span>GB</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/b35f5a2c3cb81a7fb3c11261512720b9.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Agriculture and Food Production"},
{"post_title":"<a href='https://www.windor.com' rel='nofollow noopener noreferrer' target='_blank'>www.windor.com</a>","group_name":"<a href='/group/settra/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/settra'>settra</a>","discovered":"2026-10-02T17:37:52.391920+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/d5c379ae5fa6ccf51d93ca9c8af88ed9.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"Ad***ng","group_name":"<a href='/group/auditteam/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/AuditTeam · AuditTeam is a small ransomware group with approximately 5 known victims, primarily targeting organizations in East and Southeast Asia across technology and manufacturing sectors, operating a data …'>AuditTeam</a>","discovered":"2026-10-02T16:50:28.255012+00:00","country":"AE","country_flag":"<a href='/country/ae/' title='Ransomware victims in United Arab Emirates'><span class='fi fi-ae fis'></span> <span>AE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/59830a9485223778024bf436f7ab4477.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"The Official College of Architects of León (COAL)","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-10-02T14:59:23.740946+00:00","country":"MX","country_flag":"<a href='/country/mx/' title='Ransomware victims in Mexico'><span class='fi fi-mx fis'></span> <span>MX</span></a>","screenshot":"","activity":"Professional Services"},
{"post_title":"<a href='https://jampac.com.br' rel='nofollow noopener noreferrer' target='_blank'>Jampac Alimentos</a>","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-10-02T14:59:03.626043+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"","activity":"Agriculture and Food Production"},
{"post_title":"<a href='https://translarity.com' rel='nofollow noopener noreferrer' target='_blank'>translarity.com</a>","group_name":"<a href='/group/settra/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/settra'>settra</a>","discovered":"2026-10-02T14:44:46.928778+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/2840b93dd554043d68f6f29f2dc1eed1.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://pacifictanklines.com' rel='nofollow noopener noreferrer' target='_blank'>Pacific Tank Lines</a>","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-10-02T14:24:13.728851+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Transportation"},
{"post_title":"<a href='https://inova-semiconductors.de' rel='nofollow noopener noreferrer' target='_blank'>Inova Semiconductors GmbH</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-02T14:04:15.039524+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/0e065f5051a95e5804eb837066fce12b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://www.itmg.co.id' rel='nofollow noopener noreferrer' target='_blank'>PT Indo Tambangraya Megah</a>","group_name":"<a href='/group/ransomhouse/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/ransomhouse · RansomHouse is a double-extortion RaaS operation active since late 2021, attributed to the threat actor &quot;Jolly Scorpius,&quot; targeting over 120 organizations across healthcare, finance, transportation…'>ransomhouse</a>","discovered":"2026-10-02T13:14:39.049589+00:00","country":"ID","country_flag":"<a href='/country/id/' title='Ransomware victims in Indonesia'><span class='fi fi-id fis'></span> <span>ID</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/0a61751c8a1ef276d6ae84a227e3ef94.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Energy & Utilities"},
{"post_title":"<a href='https://www.rfppa.com' rel='nofollow noopener noreferrer' target='_blank'>Raleigh Family Medicine</a>","group_name":"<a href='/group/booba-project/' title='aka Booba Team · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Booba%20Project · Booba'>Booba Project</a>","discovered":"2026-10-02T12:51:06.149432+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://www.edgeendo.com' rel='nofollow noopener noreferrer' target='_blank'>EdgeEndo® USA</a>","group_name":"<a href='/group/booba-project/' title='aka Booba Team · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Booba%20Project · Booba'>Booba Project</a>","discovered":"2026-10-02T12:50:51.934577+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://www.lakewoodmedical.ca' rel='nofollow noopener noreferrer' target='_blank'>Soni Medical Centre</a>","group_name":"<a href='/group/booba-project/' title='aka Booba Team · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Booba%20Project · Booba'>Booba Project</a>","discovered":"2026-10-02T12:50:38.729946+00:00","country":"CA","country_flag":"<a href='/country/ca/' title='Ransomware victims in Canada'><span class='fi fi-ca fis'></span> <span>CA</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://www.uic.edu' rel='nofollow noopener noreferrer' target='_blank'>University of Illinois Chicago</a>","group_name":"<a href='/group/booba-project/' title='aka Booba Team · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Booba%20Project · Booba'>Booba Project</a>","discovered":"2026-10-02T12:50:25.586591+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Education"},
{"post_title":"Tronex A/S","group_name":"<a href='/group/wallstreet/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Wallstreet'>Wallstreet</a>","discovered":"2026-10-02T11:55:03.245906+00:00","country":"DK","country_flag":"<a href='/country/dk/' title='Ransomware victims in Denmark'><span class='fi fi-dk fis'></span> <span>DK</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://www.kres.cz' rel='nofollow noopener noreferrer' target='_blank'>www.kres.cz</a>","group_name":"<a href='/group/krybit/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/krybit · Krybit is an emerging RaaS group that launched in late March 2026, offering affiliates an 80/20 revenue split with support for Windows, Linux, ESXi, and NAS device encryption, and became notable fo…'>krybit</a>","discovered":"2026-10-02T09:31:56.783862+00:00","country":"CZ","country_flag":"<a href='/country/cz/' title='Ransomware victims in Czechia'><span class='fi fi-cz fis'></span> <span>CZ</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/5a42db0b4d167d79c0e3d4310fea5f06.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://www.raajratna.com' rel='nofollow noopener noreferrer' target='_blank'>www.raajratna.com</a>","group_name":"<a href='/group/krybit/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/krybit · Krybit is an emerging RaaS group that launched in late March 2026, offering affiliates an 80/20 revenue split with support for Windows, Linux, ESXi, and NAS device encryption, and became notable fo…'>krybit</a>","discovered":"2026-10-02T09:31:28.585730+00:00","country":"IN","country_flag":"<a href='/country/in/' title='Ransomware victims in India'><span class='fi fi-in fis'></span> <span>IN</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/1507620ac4ff25fe6a377bb1c9393b7b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://www.pierrefeu.fr' rel='nofollow noopener noreferrer' target='_blank'>www.pierrefeu.fr</a>","group_name":"<a href='/group/krybit/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/krybit · Krybit is an emerging RaaS group that launched in late March 2026, offering affiliates an 80/20 revenue split with support for Windows, Linux, ESXi, and NAS device encryption, and became notable fo…'>krybit</a>","discovered":"2026-10-02T09:30:59.262741+00:00","country":"FR","country_flag":"<a href='/country/fr/' title='Ransomware victims in France'><span class='fi fi-fr fis'></span> <span>FR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/a3766fd839d6686c66440f65e8c7c52f.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://sai.org.in' rel='nofollow noopener noreferrer' target='_blank'>sai.org.in</a>","group_name":"<a href='/group/krybit/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/krybit · Krybit is an emerging RaaS group that launched in late March 2026, offering affiliates an 80/20 revenue split with support for Windows, Linux, ESXi, and NAS device encryption, and became notable fo…'>krybit</a>","discovered":"2026-10-02T09:30:27.520644+00:00","country":"IN","country_flag":"<a href='/country/in/' title='Ransomware victims in India'><span class='fi fi-in fis'></span> <span>IN</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/136a1b6d19699b35412574b454df3185.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Education"},
{"post_title":"<a href='https://baltimorefreightliner.com' rel='nofollow noopener noreferrer' target='_blank'>baltimorefreightliner.com</a>","group_name":"<a href='/group/settra/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/settra'>settra</a>","discovered":"2026-10-02T09:04:38.780054+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/66568b4aa0101178f11e1ee82b0fdda2.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Transportation"},
{"post_title":"<a href='https://goldenpearfunding.com' rel='nofollow noopener noreferrer' target='_blank'>goldenpearfunding.com</a>","group_name":"<a href='/group/settra/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/settra'>settra</a>","discovered":"2026-10-02T09:04:13.822116+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/e2b2640f37651637508553d4182dc2c2.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"<a href='https://mcpolymers.com' rel='nofollow noopener noreferrer' target='_blank'>mcpolymers.com</a>","group_name":"<a href='/group/settra/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/settra'>settra</a>","discovered":"2026-10-02T09:03:48.846623+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/a68d8e3d51dd1c1d6738e5bae11effaa.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://rogdianakis.gr' rel='nofollow noopener noreferrer' target='_blank'>UNION FA</a>","group_name":"<a href='/group/deadlock/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/deadlock'>Deadlock</a>","discovered":"2026-10-02T07:50:40.565444+00:00","country":"GR","country_flag":"<a href='/country/gr/' title='Ransomware victims in Greece'><span class='fi fi-gr fis'></span> <span>GR</span></a>","screenshot":"","activity":"Other"},
{"post_title":"<a href='https://farwestcontractors.com' rel='nofollow noopener noreferrer' target='_blank'>Far West Contractors</a>","group_name":"<a href='/group/deadlock/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/deadlock'>Deadlock</a>","discovered":"2026-10-02T07:50:37.065816+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://aneta.org.ec' rel='nofollow noopener noreferrer' target='_blank'>Automovil Club del Ecuador ANETA</a>","group_name":"<a href='/group/barracuda/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Barracuda'>Barracuda</a>","discovered":"2026-10-02T04:50:21.376543+00:00","country":"EC","country_flag":"<a href='/country/ec/' title='Ransomware victims in Ecuador'><span class='fi fi-ec fis'></span> <span>EC</span></a>","screenshot":"","activity":"Transportation"},
{"post_title":"<a href='https://myelectric.coop' rel='nofollow noopener noreferrer' target='_blank'>Sangre de Cristo Electric Association</a>","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-10-02T01:33:07.817519+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e1c1fa901b116f52863dc7b66eae8839.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Energy & Utilities"},
{"post_title":"<a href='https://www.mainplace.com.my' rel='nofollow noopener noreferrer' target='_blank'>Main Place Mall</a>","group_name":"<a href='/group/netrunner/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/netrunner · NetRunner is a ransomware group active from at least 2025 targeting diverse sectors including healthcare, telecommunications, manufacturing, and agriculture across Japan, Italy, the US, and Jordan,…'>netrunner</a>","discovered":"2026-10-02T00:05:15.514808+00:00","country":"MY","country_flag":"<a href='/country/my/' title='Ransomware victims in Malaysia'><span class='fi fi-my fis'></span> <span>MY</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/c60496a86c23ae38d6b1d64a075a5212.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://euroditel.com' rel='nofollow noopener noreferrer' target='_blank'>EURODITEL/RESOTELECOM</a>","group_name":"<a href='/group/krybit/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/krybit · Krybit is an emerging RaaS group that launched in late March 2026, offering affiliates an 80/20 revenue split with support for Windows, Linux, ESXi, and NAS device encryption, and became notable fo…'>krybit</a>","discovered":"2026-10-01T21:33:33.216829+00:00","country":"FR","country_flag":"<a href='/country/fr/' title='Ransomware victims in France'><span class='fi fi-fr fis'></span> <span>FR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/dde979833328c075cfd8b3f757fec394.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://www.hhv.gob.pe' rel='nofollow noopener noreferrer' target='_blank'>Hospital Hermilio Valdizán</a>","group_name":"<a href='/group/ransomhouse/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/ransomhouse · RansomHouse is a double-extortion RaaS operation active since late 2021, attributed to the threat actor &quot;Jolly Scorpius,&quot; targeting over 120 organizations across healthcare, finance, transportation…'>ransomhouse</a>","discovered":"2026-10-01T21:05:18.872506+00:00","country":"PE","country_flag":"<a href='/country/pe/' title='Ransomware victims in Peru'><span class='fi fi-pe fis'></span> <span>PE</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://slatevalleyunified.org' rel='nofollow noopener noreferrer' target='_blank'>Slate Valley Unified School District</a>","group_name":"<a href='/group/kairos/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/kairos · Kairos is a data extortion group active since late 2024 that focuses solely on data theft with no encryption, primarily targeting small-to-mid-sized organizations in healthcare, manufacturing, and …'>kairos</a>","discovered":"2026-10-01T19:00:23.598688+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Education"},
{"post_title":"steelco","group_name":"<a href='/group/auditteam/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/AuditTeam · AuditTeam is a small ransomware group with approximately 5 known victims, primarily targeting organizations in East and Southeast Asia across technology and manufacturing sectors, operating a data …'>AuditTeam</a>","discovered":"2026-10-01T15:20:36.615569+00:00","country":"IT","country_flag":"<a href='/country/it/' title='Ransomware victims in Italy'><span class='fi fi-it fis'></span> <span>IT</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/b5d1db4ab35b2587d7d6ee5ffa9b70d3.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://promindit.com' rel='nofollow noopener noreferrer' target='_blank'>ProMind IT</a>","group_name":"<a href='/group/auditteam/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/AuditTeam · AuditTeam is a small ransomware group with approximately 5 known victims, primarily targeting organizations in East and Southeast Asia across technology and manufacturing sectors, operating a data …'>AuditTeam</a>","discovered":"2026-10-01T15:20:22.961652+00:00","country":"IT","country_flag":"<a href='/country/it/' title='Ransomware victims in Italy'><span class='fi fi-it fis'></span> <span>IT</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/51fe1485e6cb464fe157dcaac6e2b9f5.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://DISK PRECISION GROUP - diskprecision.com' rel='nofollow noopener noreferrer' target='_blank'>DISK PRECISION GROUP - diskprecision.com</a>","group_name":"<a href='/group/krybit/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/krybit · Krybit is an emerging RaaS group that launched in late March 2026, offering affiliates an 80/20 revenue split with support for Windows, Linux, ESXi, and NAS device encryption, and became notable fo…'>krybit</a>","discovered":"2026-10-01T14:59:58.588084+00:00","country":"SG","country_flag":"<a href='/country/sg/' title='Ransomware victims in Singapore'><span class='fi fi-sg fis'></span> <span>SG</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/4cd0147c8ed871f3f2a8931b30462a53.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://funap.sp.gov.br' rel='nofollow noopener noreferrer' target='_blank'>FUNAP - Fundação \"Prof. Dr. Manoel Pedro Pimentel\"</a>","group_name":"<a href='/group/booba-project/' title='aka Booba Team · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Booba%20Project · Booba'>Booba Project</a>","discovered":"2026-10-01T14:50:50.355750+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"","activity":"Government & Defense"},
{"post_title":"<a href='https://www.gastrocny.com' rel='nofollow noopener noreferrer' target='_blank'>ASSOCIATED GASTROENTEROLOGISTS OF CENTRAL NEW YORK, P.C</a>","group_name":"<a href='/group/booba-project/' title='aka Booba Team · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Booba%20Project · Booba'>Booba Project</a>","discovered":"2026-10-01T14:50:46.597134+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://www.terca.com.br' rel='nofollow noopener noreferrer' target='_blank'>Terca</a>","group_name":"<a href='/group/ransomhouse/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/ransomhouse · RansomHouse is a double-extortion RaaS operation active since late 2021, attributed to the threat actor &quot;Jolly Scorpius,&quot; targeting over 120 organizations across healthcare, finance, transportation…'>ransomhouse</a>","discovered":"2026-10-01T14:30:43.822473+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/c7f089fa0dbc3913b6b3c395c46736b9.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"Superior Plating Technology CO","group_name":"<a href='/group/morpheus/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/morpheus · Morpheus emerged in late 2024 as a semi-private RaaS operation whose affiliates share identical payloads with the HellCat ransomware group, targeting pharmaceutical, manufacturing, legal, and Itali…'>morpheus</a>","discovered":"2026-10-01T14:30:01.966608+00:00","country":"","country_flag":"","screenshot":"","activity":"Manufacturing"},
{"post_title":"C*ro *nty *es","group_name":"<a href='/group/nightspire/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/nightspire · NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, In…'>nightspire</a>","discovered":"2026-10-01T13:35:58.592497+00:00","country":"","country_flag":"","screenshot":"","activity":"Not Found"},
{"post_title":"Wesmar","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-10-01T13:27:59.579745+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"DPL Group","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-10-01T13:27:57.654563+00:00","country":"","country_flag":"","screenshot":"","activity":"Other"},
{"post_title":"Krycler, Ervin, Taubman &amp; Kaminsky","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-10-01T12:56:13.234457+00:00","country":"","country_flag":"","screenshot":"","activity":"Professional Services"},
{"post_title":"Graybar Electric Company, Inc.","group_name":"<a href='http://neclc36yt4yaa5lv54kh4qbhvjcvuv6nnaurqowkellytpvj3afh4aid.onion/companies' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Redact'>Redact</a>","discovered":"2026-10-01T12:55:52.542586+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/dde43211c986889efac13449e9a1813d.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://rimrock.org' rel='nofollow noopener noreferrer' target='_blank'>Rimrock Foundation</a>","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-10-01T12:31:18.384298+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/483f382a21c60bd17c999aedbb599d47.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://parkdental.com' rel='nofollow noopener noreferrer' target='_blank'>parkdental.com</a>","group_name":"<a href='/group/chaos/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/chaos · Chaos is a ransomware-as-a-service operation that emerged in early 2025, likely formed by former BlackSuit/Royal members, offering cross-platform ransomware for Windows, Linux, ESXi, and NAS to aff…'>chaos</a>","discovered":"2026-10-01T12:26:41.502960+00:00","country":"GB","country_flag":"<a href='/country/gb/' title='Ransomware victims in United Kingdom'><span class='fi fi-gb fis'></span> <span>GB</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/3816af71bdc5e62e7551a7bcab85d515.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://.' rel='nofollow noopener noreferrer' target='_blank'>VPNE</a>","group_name":"<a href='/group/genesis/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/genesis · Genesis is an emerging ransomware group first observed in late 2025, targeting small to mid-sized US organizations across healthcare, retail, financial services, legal, and manufacturing using doub…'>genesis</a>","discovered":"2026-10-01T11:59:23.502551+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/0fcd39a1dcafd2032a6ada39bb11bf94.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://tlcperinatal.com' rel='nofollow noopener noreferrer' target='_blank'>TLC Perinatal</a>","group_name":"<a href='/group/genesis/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/genesis · Genesis is an emerging ransomware group first observed in late 2025, targeting small to mid-sized US organizations across healthcare, retail, financial services, legal, and manufacturing using doub…'>genesis</a>","discovered":"2026-10-01T11:59:01.967857+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e9a19c48dba93d96591bc17c3a7188d3.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://veroscience.com' rel='nofollow noopener noreferrer' target='_blank'>Vera Science</a>","group_name":"<a href='/group/genesis/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/genesis · Genesis is an emerging ransomware group first observed in late 2025, targeting small to mid-sized US organizations across healthcare, retail, financial services, legal, and manufacturing using doub…'>genesis</a>","discovered":"2026-10-01T11:58:41.192803+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/c20dde63e857c0c6a0f6372511c22f20.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://owensdistributors.com' rel='nofollow noopener noreferrer' target='_blank'>Owens Distributors</a>","group_name":"<a href='/group/genesis/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/genesis · Genesis is an emerging ransomware group first observed in late 2025, targeting small to mid-sized US organizations across healthcare, retail, financial services, legal, and manufacturing using doub…'>genesis</a>","discovered":"2026-10-01T11:58:21.143273+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e32202fc00cd185499e4a006121fb1c4.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"Guardian Pharmacy LLC","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-10-01T11:30:04.948126+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/79c54dcbb9a8e78e6df74a2f460c267d.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"Den Hartog Industries","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-10-01T11:29:48.323456+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/dcf77ed2206b396c2d2a38c15017324e.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://nchcvt.org' rel='nofollow noopener noreferrer' target='_blank'>Northern Counties Health Care</a>","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-10-01T11:29:32.755376+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/7e7005af0506cbef7a89db037fb866ac.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"Post Metal Recycling","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-10-01T11:29:12.461417+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/d14c84b302ab68a624660c16a608e1c4.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"LA PONDEROSA","group_name":"<a href='/group/emperador/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/emperador'>emperador</a>","discovered":"2026-10-01T09:51:43.266155+00:00","country":"MX","country_flag":"<a href='/country/mx/' title='Ransomware victims in Mexico'><span class='fi fi-mx fis'></span> <span>MX</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/25e4fd958073a1f9de6dced4a8a9d351.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Agriculture and Food Production"},
{"post_title":"<a href='https://www.dynamicos.co.uk' rel='nofollow noopener noreferrer' target='_blank'>Dynamic Office Solutions</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-10-01T09:04:21.073553+00:00","country":"GB","country_flag":"<a href='/country/gb/' title='Ransomware victims in United Kingdom'><span class='fi fi-gb fis'></span> <span>GB</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/7a241110e3efb94a4cf5b16631ce8de1.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://roemmers.com.ar' rel='nofollow noopener noreferrer' target='_blank'>Laboratorios Roemmers SAICF</a>","group_name":"<a href='/group/aurora/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/aurora · Aurora is a ransomware group associated with a multi-purpose Go-based malware distributed by multiple criminal teams from mid-2022, also sold as an infostealer/botnet under the same name on undergr…'>aurora</a>","discovered":"2026-10-01T06:55:01.164223+00:00","country":"AR","country_flag":"<a href='/country/ar/' title='Ransomware victims in Argentina'><span class='fi fi-ar fis'></span> <span>AR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e59490b8e017c5f0fc03f373a012c2c4.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"Houston Thyroid &amp; Endocrine Specialists","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-09-30T22:53:00.862321+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/f86697c644ca35be816fe74c8b56ffa3.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://softwareanswers.com' rel='nofollow noopener noreferrer' target='_blank'>Software Answers, a Banyan Software Company</a>","group_name":"<a href='/group/pear/' title='aka Pure Extraction And Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/pear · Pure Extraction And Ransom (PEAR) Team is the community of highly responsible and strictly disciplined members. We are a private team and have nothing common with any other threat actors. We&#x27;ve bee…'>pear</a>","discovered":"2026-09-30T22:34:21.282691+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Technology"},
{"post_title":"<a href='https://www.japantimes.co.jp' rel='nofollow noopener noreferrer' target='_blank'>The Japan Times</a>","group_name":"<a href='/group/eclipse/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Eclipse'>Eclipse</a>","discovered":"2026-09-30T21:53:18.441300+00:00","country":"JP","country_flag":"<a href='/country/jp/' title='Ransomware victims in Japan'><span class='fi fi-jp fis'></span> <span>JP</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/5f947813e6f44af6196e3c325748f6c0.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://summit.com' rel='nofollow noopener noreferrer' target='_blank'>Summit Electric Supply</a>","group_name":"<a href='/group/vexy-ransomware/' title='aka vexy · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Vexy%20Ransomware'>Vexy Ransomware</a>","discovered":"2026-09-30T20:55:47.014462+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Energy & Utilities"},
{"post_title":"<a href='https://wolfusofsky.de' rel='nofollow noopener noreferrer' target='_blank'>wolfusofsky.de</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-09-30T20:11:02.018212+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/45d5d96c12331fc63d180f98f9c7d940.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"Le Centre National de l'Expertise Hospitalière (CNEH)","group_name":"<a href='/group/kairos/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/kairos · Kairos is a data extortion group active since late 2024 that focuses solely on data theft with no encryption, primarily targeting small-to-mid-sized organizations in healthcare, manufacturing, and …'>kairos</a>","discovered":"2026-09-30T19:28:35.034407+00:00","country":"FR","country_flag":"<a href='/country/fr/' title='Ransomware victims in France'><span class='fi fi-fr fis'></span> <span>FR</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://www.titus.de' rel='nofollow noopener noreferrer' target='_blank'>Titus</a>","group_name":"<a href='/group/play/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/play · Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite simil…'>play</a>","discovered":"2026-09-30T17:37:25.753375+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/0a7ee0ecee7532d6b346edc5326358a2.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://www.airtechnc.com' rel='nofollow noopener noreferrer' target='_blank'>Airtech Mechanical Services</a>","group_name":"<a href='/group/play/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/play · Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite simil…'>play</a>","discovered":"2026-09-30T17:36:51.772932+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e49a4e251c2837ba9370d3c569ffd2d3.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://www.orth-automobile.de' rel='nofollow noopener noreferrer' target='_blank'>Orth Automobile</a>","group_name":"<a href='/group/play/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/play · Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite simil…'>play</a>","discovered":"2026-09-30T17:36:17.500405+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/c749cf9f6cd07dd58be1804f7a2ded41.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://bcbenderlaw.com' rel='nofollow noopener noreferrer' target='_blank'>Blaise C. Bender, PC</a>","group_name":"<a href='/group/interlock/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/interlock · Interlock is a ransomware group first observed in September 2024 that targets critical infrastructure sectors including healthcare, government, education, and technology across North America and Eu…'>interlock</a>","discovered":"2026-09-30T17:00:59.874044+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/f3d8b9e4e3070d37d84c568113991a9f.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://Buford-Thompson Company, LTD' rel='nofollow noopener noreferrer' target='_blank'>Buford-Thompson Company, LTD</a>","group_name":"<a href='/group/aurora/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/aurora · Aurora is a ransomware group associated with a multi-purpose Go-based malware distributed by multiple criminal teams from mid-2022, also sold as an infostealer/botnet under the same name on undergr…'>aurora</a>","discovered":"2026-09-30T16:55:16.586789+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/9fb9507c25fb4cbce4f04cf863550102.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://siteprorentals.com' rel='nofollow noopener noreferrer' target='_blank'>SitePro Rentals</a>","group_name":"<a href='/group/emperador/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/emperador'>emperador</a>","discovered":"2026-09-30T13:53:31.532445+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/c72daf9c45fd68efd1e7f9c1e7bc319b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://dfiretailgroup.com' rel='nofollow noopener noreferrer' target='_blank'>dfiretailgroup.com</a>","group_name":"<a href='/group/settra/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/settra'>settra</a>","discovered":"2026-09-30T13:37:55.297736+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/fa6d1e9e485de49d8b1e200bcb6622dc.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://econ-tec.com' rel='nofollow noopener noreferrer' target='_blank'>econ-tec.com</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-09-30T13:36:55.329864+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/d63c1a056ce0653837d00b50cbac7c79.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://assist2enjoy.be' rel='nofollow noopener noreferrer' target='_blank'>assist2enjoy.be</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-09-30T13:36:19.867572+00:00","country":"BE","country_flag":"<a href='/country/be/' title='Ransomware victims in Belgium'><span class='fi fi-be fis'></span> <span>BE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/04c6c12be51960ee82514c925ba03b22.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://pugliese.loс' rel='nofollow noopener noreferrer' target='_blank'>Dr Damiel Pugliese</a>","group_name":"<a href='/group/lamashtu/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/lamashtu · Lamashtu is an extortion group that first appeared in April 2026, claiming attacks against organizations in France, Romania, and Thailand across energy, pharmaceutical, and film sectors; it has not…'>lamashtu</a>","discovered":"2026-09-30T13:32:57.909932+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/a3fe932d0436f1057ed49aac9ca6c51e.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://bquadro.it' rel='nofollow noopener noreferrer' target='_blank'>Astidental di Sabbione</a>","group_name":"<a href='/group/lamashtu/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/lamashtu · Lamashtu is an extortion group that first appeared in April 2026, claiming attacks against organizations in France, Romania, and Thailand across energy, pharmaceutical, and film sectors; it has not…'>lamashtu</a>","discovered":"2026-09-30T13:32:20.239869+00:00","country":"IT","country_flag":"<a href='/country/it/' title='Ransomware victims in Italy'><span class='fi fi-it fis'></span> <span>IT</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/eeeae9b9bfc065e4b4b86ae9d96be5a1.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://vincoenergy.com' rel='nofollow noopener noreferrer' target='_blank'>Vinco Energy</a>","group_name":"<a href='/group/lamashtu/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/lamashtu · Lamashtu is an extortion group that first appeared in April 2026, claiming attacks against organizations in France, Romania, and Thailand across energy, pharmaceutical, and film sectors; it has not…'>lamashtu</a>","discovered":"2026-09-30T13:06:49.051896+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/0bbc3fe851ca076d2d9175ed3b45564e.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Energy & Utilities"},
{"post_title":"<a href='https://becker-logistik.de' rel='nofollow noopener noreferrer' target='_blank'>Becker Logistik</a>","group_name":"<a href='/group/lamashtu/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/lamashtu · Lamashtu is an extortion group that first appeared in April 2026, claiming attacks against organizations in France, Romania, and Thailand across energy, pharmaceutical, and film sectors; it has not…'>lamashtu</a>","discovered":"2026-09-30T13:06:09.140404+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/3282675dee9b9f2c85bed0def8aa5759.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Transportation"},
{"post_title":"<a href='https://wilhelm-kuehne.de' rel='nofollow noopener noreferrer' target='_blank'>Wilhelm Kühne</a>","group_name":"<a href='/group/lamashtu/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/lamashtu · Lamashtu is an extortion group that first appeared in April 2026, claiming attacks against organizations in France, Romania, and Thailand across energy, pharmaceutical, and film sectors; it has not…'>lamashtu</a>","discovered":"2026-09-30T13:05:31.662922+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/0e29faec33db60240e6ec847ce528182.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://fiducial.fr' rel='nofollow noopener noreferrer' target='_blank'>FIDUCIAL</a>","group_name":"<a href='/group/lamashtu/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/lamashtu · Lamashtu is an extortion group that first appeared in April 2026, claiming attacks against organizations in France, Romania, and Thailand across energy, pharmaceutical, and film sectors; it has not…'>lamashtu</a>","discovered":"2026-09-30T13:04:52.699342+00:00","country":"FR","country_flag":"<a href='/country/fr/' title='Ransomware victims in France'><span class='fi fi-fr fis'></span> <span>FR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/06af36f9546eec8b2a190e13e6be4107.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"<a href='https://virtualideas.com.au' rel='nofollow noopener noreferrer' target='_blank'>Virtual Ideas</a>","group_name":"<a href='/group/lamashtu/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/lamashtu · Lamashtu is an extortion group that first appeared in April 2026, claiming attacks against organizations in France, Romania, and Thailand across energy, pharmaceutical, and film sectors; it has not…'>lamashtu</a>","discovered":"2026-09-30T13:04:17.038760+00:00","country":"AU","country_flag":"<a href='/country/au/' title='Ransomware victims in Australia'><span class='fi fi-au fis'></span> <span>AU</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/db3d16c47cd053267e9988f625cf185c.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://projahn.de' rel='nofollow noopener noreferrer' target='_blank'>PROJAHN</a>","group_name":"<a href='/group/lamashtu/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/lamashtu · Lamashtu is an extortion group that first appeared in April 2026, claiming attacks against organizations in France, Romania, and Thailand across energy, pharmaceutical, and film sectors; it has not…'>lamashtu</a>","discovered":"2026-09-30T13:03:39.906954+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/d4f0c40f64b9b7276c8da84da79fb74b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://altmannshofer.de' rel='nofollow noopener noreferrer' target='_blank'>Altmannshofer Sicherheits-Videotechnik</a>","group_name":"<a href='/group/lamashtu/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/lamashtu · Lamashtu is an extortion group that first appeared in April 2026, claiming attacks against organizations in France, Romania, and Thailand across energy, pharmaceutical, and film sectors; it has not…'>lamashtu</a>","discovered":"2026-09-30T13:02:58.768381+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/89bf9e7091017cecc3a7a219bc2a7150.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"MCAP — MortgageHub commercial lending platform","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-09-30T12:52:16.238414+00:00","country":"CA","country_flag":"<a href='/country/ca/' title='Ransomware victims in Canada'><span class='fi fi-ca fis'></span> <span>CA</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e90be91dec3b966780116d9b18efe850.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"<a href='https://gerlon.com' rel='nofollow noopener noreferrer' target='_blank'>GERLON</a>","group_name":"<a href='/group/lamashtu/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/lamashtu · Lamashtu is an extortion group that first appeared in April 2026, claiming attacks against organizations in France, Romania, and Thailand across energy, pharmaceutical, and film sectors; it has not…'>lamashtu</a>","discovered":"2026-09-30T12:34:03.584289+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/ed6aa395a891ec1be72a3f299ccc7520.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"clicks digital GmbH Information","group_name":"<a href='/group/rhysida/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/rhysida · Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets&#x27; networks and d…'>rhysida</a>","discovered":"2026-09-30T12:07:42.311427+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/16cb615fb194dfa88bb4994c740cdfd9.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"Law Offices of R. David Williams, P.A.","group_name":"<a href='/group/rhysida/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/rhysida · Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets&#x27; networks and d…'>rhysida</a>","discovered":"2026-09-30T10:10:55.394139+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/69cc1c8f2f490aa82926d9b05b639e60.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://newyjh.com' rel='nofollow noopener noreferrer' target='_blank'>www.newyjh.com</a>","group_name":"<a href='http://egm34gsyx65wb6jyqds4esvkskl34barx4robuebjhqpc4dfeavg7fyd.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/ULose'>ULose</a>","discovered":"2026-09-30T07:51:07.773592+00:00","country":"KR","country_flag":"<a href='/country/kr/' title='Ransomware victims in South Korea'><span class='fi fi-kr fis'></span> <span>KR</span></a>","screenshot":"","activity":"Not Found"},
{"post_title":"West County Health Centers","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-09-30T06:19:03.279162+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/106350dd764262d2dbcbf39f558fb9fb.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://gardenersguild.com' rel='nofollow noopener noreferrer' target='_blank'>Gardeners' Guild</a>","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-09-30T06:18:31.268925+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/b74528a7786715ae88cad9376e2b53c8.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Agriculture and Food Production"},
{"post_title":"<a href='https://legalwise.co.za' rel='nofollow noopener noreferrer' target='_blank'>LegalWise</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-30T03:40:46.742073+00:00","country":"ZA","country_flag":"<a href='/country/za/' title='Ransomware victims in South Africa'><span class='fi fi-za fis'></span> <span>ZA</span></a>","screenshot":"","activity":"Professional Services"},
{"post_title":"<a href='https://samwumed.org' rel='nofollow noopener noreferrer' target='_blank'>Samwumed</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-30T03:40:29.255324+00:00","country":"KR","country_flag":"<a href='/country/kr/' title='Ransomware victims in South Korea'><span class='fi fi-kr fis'></span> <span>KR</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://edcon.co.za' rel='nofollow noopener noreferrer' target='_blank'>Edcon</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-30T03:40:25.808942+00:00","country":"ZA","country_flag":"<a href='/country/za/' title='Ransomware victims in South Africa'><span class='fi fi-za fis'></span> <span>ZA</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://defencebit.com' rel='nofollow noopener noreferrer' target='_blank'>Defencebit</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-30T03:40:07.208436+00:00","country":"GB","country_flag":"<a href='/country/gb/' title='Ransomware victims in United Kingdom'><span class='fi fi-gb fis'></span> <span>GB</span></a>","screenshot":"","activity":"Government & Defense"},
{"post_title":"<a href='https://dscdatacomm.com' rel='nofollow noopener noreferrer' target='_blank'>Datacomm Services</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-30T03:40:01.843686+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Technology"},
{"post_title":"<a href='https://webbelectric.com' rel='nofollow noopener noreferrer' target='_blank'>Webb Electric Company of Florida</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-30T03:39:46.557990+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Energy & Utilities"},
{"post_title":"<a href='https://solariaresto.co.id' rel='nofollow noopener noreferrer' target='_blank'>Solaria</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-30T03:39:40.566854+00:00","country":"ID","country_flag":"<a href='/country/id/' title='Ransomware victims in Indonesia'><span class='fi fi-id fis'></span> <span>ID</span></a>","screenshot":"","activity":"Agriculture and Food Production"},
{"post_title":"<a href='https://auren.es' rel='nofollow noopener noreferrer' target='_blank'>Auren</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-30T03:39:25.753475+00:00","country":"ES","country_flag":"<a href='/country/es/' title='Ransomware victims in Spain'><span class='fi fi-es fis'></span> <span>ES</span></a>","screenshot":"","activity":"Professional Services"},
{"post_title":"<a href='https://topsportitalia.it' rel='nofollow noopener noreferrer' target='_blank'>QUALITY SPORT Topsport Italia</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-30T03:39:19.790514+00:00","country":"IT","country_flag":"<a href='/country/it/' title='Ransomware victims in Italy'><span class='fi fi-it fis'></span> <span>IT</span></a>","screenshot":"","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://euro-prim.com' rel='nofollow noopener noreferrer' target='_blank'>Europrim</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-30T03:39:04.968151+00:00","country":"FR","country_flag":"<a href='/country/fr/' title='Ransomware victims in France'><span class='fi fi-fr fis'></span> <span>FR</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://telrad.com' rel='nofollow noopener noreferrer' target='_blank'>Telrad Networks</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-30T03:38:58.778606+00:00","country":"IL","country_flag":"<a href='/country/il/' title='Ransomware victims in Israel'><span class='fi fi-il fis'></span> <span>IL</span></a>","screenshot":"","activity":"Technology"},
{"post_title":"<a href='https://groupe-aprosep.com' rel='nofollow noopener noreferrer' target='_blank'>Groupe APROSEP</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-30T03:38:39.134710+00:00","country":"SN","country_flag":"<a href='/country/sn/' title='Ransomware victims in Senegal'><span class='fi fi-sn fis'></span> <span>SN</span></a>","screenshot":"","activity":"Other"},
{"post_title":"<a href='https://drinks.com.tw' rel='nofollow noopener noreferrer' target='_blank'>Drinks Wines Spirits</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-30T03:38:18.269037+00:00","country":"TW","country_flag":"<a href='/country/tw/' title='Ransomware victims in Taiwan'><span class='fi fi-tw fis'></span> <span>TW</span></a>","screenshot":"","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://customrxshoppe.com' rel='nofollow noopener noreferrer' target='_blank'>Custom Rx Shoppe</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-30T03:37:57.541995+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://williamsondacar.com' rel='nofollow noopener noreferrer' target='_blank'>Williamson Dacar Associates</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-30T03:37:36.288992+00:00","country":"GB","country_flag":"<a href='/country/gb/' title='Ransomware victims in United Kingdom'><span class='fi fi-gb fis'></span> <span>GB</span></a>","screenshot":"","activity":"Professional Services"},
{"post_title":"<a href='https://agospap.com' rel='nofollow noopener noreferrer' target='_blank'>Agospap</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-30T03:37:14.458576+00:00","country":"GR","country_flag":"<a href='/country/gr/' title='Ransomware victims in Greece'><span class='fi fi-gr fis'></span> <span>GR</span></a>","screenshot":"","activity":"Not Found"},
{"post_title":"<a href='https://dbu-construction.com' rel='nofollow noopener noreferrer' target='_blank'>DBU Construction</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-30T03:36:53.705657+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://nnjei.com' rel='nofollow noopener noreferrer' target='_blank'>Northern NJ Eye Institute</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-30T03:36:33.004280+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://tommygarner.com' rel='nofollow noopener noreferrer' target='_blank'>Tommy Garner Air Conditioning Heating</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-30T03:36:12.351113+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Professional Services"},
{"post_title":"<a href='https://autohoeller.at' rel='nofollow noopener noreferrer' target='_blank'>Auto Holler</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-30T03:35:51.816849+00:00","country":"AT","country_flag":"<a href='/country/at/' title='Ransomware victims in Austria'><span class='fi fi-at fis'></span> <span>AT</span></a>","screenshot":"","activity":"Retail & E-Commerce"},
{"post_title":"North Hills Facility Services","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-09-30T03:35:42.576546+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/98b7465e86df9a0b4caa1232da96aaa6.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://teachenglish.vus.edu.vn' rel='nofollow noopener noreferrer' target='_blank'>VUS - The English Center</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-30T03:35:31.133786+00:00","country":"VN","country_flag":"<a href='/country/vn/' title='Ransomware victims in Vietnam'><span class='fi fi-vn fis'></span> <span>VN</span></a>","screenshot":"","activity":"Education"},
{"post_title":"Olnick Rentals","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-09-30T03:35:11.421689+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/1c775672d9645b5b1739fd2618cc4d6b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Hospitality"},
{"post_title":"<a href='https://guybendana.com' rel='nofollow noopener noreferrer' target='_blank'>Josee Bendaaa-Guerrero Asociados</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-30T03:35:10.322195+00:00","country":"BZ","country_flag":"<span class='fi fi-bz fis'></span> <span>BZ</span>","screenshot":"","activity":"Professional Services"},
{"post_title":"<a href='https://donhierro.com' rel='nofollow noopener noreferrer' target='_blank'>Don Hierro</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-30T03:34:49.525683+00:00","country":"MX","country_flag":"<a href='/country/mx/' title='Ransomware victims in Mexico'><span class='fi fi-mx fis'></span> <span>MX</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"Century Management Services","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-09-30T03:34:40.453896+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/f87c4ce4ca0f6370f668140d1b2d180c.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://corswarem.eu' rel='nofollow noopener noreferrer' target='_blank'>Corswarem Group</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-30T03:34:28.816370+00:00","country":"BE","country_flag":"<a href='/country/be/' title='Ransomware victims in Belgium'><span class='fi fi-be fis'></span> <span>BE</span></a>","screenshot":"","activity":"Not Found"},
{"post_title":"<a href='https://silvercupstudios.com' rel='nofollow noopener noreferrer' target='_blank'>Silvercup Studios</a>","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-09-30T03:34:09.678997+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/191e95ba74f2ea455c8681957a687fc8.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://pulmonaryservicesgrouppr.com' rel='nofollow noopener noreferrer' target='_blank'>Pulmonary Services Group</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-30T03:34:08.167193+00:00","country":"PR","country_flag":"<a href='/country/pr/' title='Ransomware victims in Puerto Rico'><span class='fi fi-pr fis'></span> <span>PR</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://uccomponents.com' rel='nofollow noopener noreferrer' target='_blank'>UC Components</a>","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-09-30T03:33:38.633015+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/572400132f2ee0388eca28ba63ae0ba5.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://stockhamconstruction.com' rel='nofollow noopener noreferrer' target='_blank'>Stockham Construction</a>","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-09-30T03:33:07.608534+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/afd35b4e8d12d5c592ea9f74288d1b98.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"Vintners Distributors","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-09-30T03:32:36.858458+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/8836917a1cd22659d787fe35fb8ef4a8.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://agraind.com' rel='nofollow noopener noreferrer' target='_blank'>Agra Industries</a>","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-09-30T03:32:01.910392+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/05c1d85cc3c1111fd591785ef2c96b91.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Agriculture and Food Production"},
{"post_title":"<a href='https://pocavalleybank.com' rel='nofollow noopener noreferrer' target='_blank'>Poca Valley Bank</a>","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-09-30T03:31:27.760562+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e86459b0ff24a8039f649dc5468f3db3.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"<a href='https://intense.pl' rel='nofollow noopener noreferrer' target='_blank'>intense.pl</a>","group_name":"<a href='/group/m3rx/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/m3rx · M3rx is a small ransomware group first observed in 2025, using AES-CTR/AES-GCM encryption and targeting organizations in England, the US, Australia, Germany, Italy, and Switzerland, with around eig…'>m3rx</a>","discovered":"2026-09-29T20:30:19.592696+00:00","country":"PL","country_flag":"<a href='/country/pl/' title='Ransomware victims in Poland'><span class='fi fi-pl fis'></span> <span>PL</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/20e1d6141fdb2fd7eda80084d954d801.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"Unique Repair Services","group_name":"<a href='/group/kairos/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/kairos · Kairos is a data extortion group active since late 2024 that focuses solely on data theft with no encryption, primarily targeting small-to-mid-sized organizations in healthcare, manufacturing, and …'>kairos</a>","discovered":"2026-09-29T18:57:21.826119+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Other"},
{"post_title":"<a href='https://advantech.com' rel='nofollow noopener noreferrer' target='_blank'>advantech.com</a>","group_name":"<a href='/group/chaos/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/chaos · Chaos is a ransomware-as-a-service operation that emerged in early 2025, likely formed by former BlackSuit/Royal members, offering cross-platform ransomware for Windows, Linux, ESXi, and NAS to aff…'>chaos</a>","discovered":"2026-09-29T17:55:38.445114+00:00","country":"TW","country_flag":"<a href='/country/tw/' title='Ransomware victims in Taiwan'><span class='fi fi-tw fis'></span> <span>TW</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/5cbbb95d3c38dedd4e8764851f8e6b2b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://https:tekkoinc.com' rel='nofollow noopener noreferrer' target='_blank'>Tekko Enterprises, Inc</a>","group_name":"<a href='/group/interlock/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/interlock · Interlock is a ransomware group first observed in September 2024 that targets critical infrastructure sectors including healthcare, government, education, and technology across North America and Eu…'>interlock</a>","discovered":"2026-09-29T17:02:08.326207+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e9a8337ceb1a1d98690d5f5698bd9ac2.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://gibsonhospital.org' rel='nofollow noopener noreferrer' target='_blank'>Gibson Area Hospital &amp; Health Services</a>","group_name":"<a href='/group/wallstreet/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Wallstreet'>Wallstreet</a>","discovered":"2026-09-29T16:52:55.484639+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"Polikem","group_name":"<a href='/group/emperador/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/emperador'>emperador</a>","discovered":"2026-09-29T16:51:27.538790+00:00","country":"TR","country_flag":"<a href='/country/tr/' title='Ransomware victims in Turkey'><span class='fi fi-tr fis'></span> <span>TR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/d61bae0bd692563fafbd1a5ab4493d65.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://aheadstart.co.nz' rel='nofollow noopener noreferrer' target='_blank'>AHeadStart Tutoring</a>","group_name":"<a href='http://gammax6w3dkfdjfrjthtmqzsioue52vzy6lz54qy6jcvmogfpubutjyd.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Gammax'>Gammax</a>","discovered":"2026-09-29T16:22:45.183378+00:00","country":"NZ","country_flag":"<a href='/country/nz/' title='Ransomware victims in New Zealand'><span class='fi fi-nz fis'></span> <span>NZ</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/4dd25b449f4784dd6377f9718c800483.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Education"},
{"post_title":"<a href='https://crowderindustries.com' rel='nofollow noopener noreferrer' target='_blank'>Crowder Industries, Inc</a>","group_name":"<a href='http://gammax6w3dkfdjfrjthtmqzsioue52vzy6lz54qy6jcvmogfpubutjyd.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Gammax'>Gammax</a>","discovered":"2026-09-29T16:22:06.036328+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/abb5452cdb776a84b19cc0fcec47d362.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://latitudesubro.com' rel='nofollow noopener noreferrer' target='_blank'>latitudesubro.com</a>","group_name":"<a href='/group/braincipher/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/BrainCipher · Brain Cipher emerged in July 2024. Both Windows and Linux variants are available. Brain Cipher using the leaked build of LockBit Black for their operations. The group suspected to have exploited CV…'>BrainCipher</a>","discovered":"2026-09-29T15:51:06.957366+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://spg.co.kr' rel='nofollow noopener noreferrer' target='_blank'>spg.co.kr</a>","group_name":"<a href='/group/lockbit5/' title='Files (online) — needs Tor · Profile: https://www.ransomware.live/group/lockbit5 · LockBit 5.0 (&quot;ChuongDong&quot;) emerged in September 2025 as the group&#x27;s resurgence following the February 2024 law enforcement takedown, introducing cross-platform payloads targeting Windows, Linux, an…'>lockbit5</a>","discovered":"2026-09-29T15:38:48.982486+00:00","country":"KR","country_flag":"<a href='/country/kr/' title='Ransomware victims in South Korea'><span class='fi fi-kr fis'></span> <span>KR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/10445b5c84c2ef691d5b80211875f386.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://trailerbridge.com' rel='nofollow noopener noreferrer' target='_blank'>trailerbridge.com</a>","group_name":"<a href='/group/braincipher/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/BrainCipher · Brain Cipher emerged in July 2024. Both Windows and Linux variants are available. Brain Cipher using the leaked build of LockBit Black for their operations. The group suspected to have exploited CV…'>BrainCipher</a>","discovered":"2026-09-29T15:24:54.906884+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/45ac90ce8f9d0571628190f98cccd3ab.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Transportation"},
{"post_title":"<a href='https://mccordclaims.com' rel='nofollow noopener noreferrer' target='_blank'>mccordclaims.com</a>","group_name":"<a href='/group/braincipher/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/BrainCipher · Brain Cipher emerged in July 2024. Both Windows and Linux variants are available. Brain Cipher using the leaked build of LockBit Black for their operations. The group suspected to have exploited CV…'>BrainCipher</a>","discovered":"2026-09-29T15:24:19.024466+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/f7a1ed1cae3db17f28a768164bafc0d3.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"<a href='https://goriteway.com' rel='nofollow noopener noreferrer' target='_blank'>goriteway.com</a>","group_name":"<a href='/group/braincipher/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/BrainCipher · Brain Cipher emerged in July 2024. Both Windows and Linux variants are available. Brain Cipher using the leaked build of LockBit Black for their operations. The group suspected to have exploited CV…'>BrainCipher</a>","discovered":"2026-09-29T15:23:42.833654+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/bc22dc611616b6cef6245ef526bf12d7.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://northeastrehab.com' rel='nofollow noopener noreferrer' target='_blank'>northeastrehab.com</a>","group_name":"<a href='/group/braincipher/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/BrainCipher · Brain Cipher emerged in July 2024. Both Windows and Linux variants are available. Brain Cipher using the leaked build of LockBit Black for their operations. The group suspected to have exploited CV…'>BrainCipher</a>","discovered":"2026-09-29T15:23:07.057816+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/97d1a792d0efbb563bb20b143ce15059.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://mulholland.com' rel='nofollow noopener noreferrer' target='_blank'>mulholland.com</a>","group_name":"<a href='/group/braincipher/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/BrainCipher · Brain Cipher emerged in July 2024. Both Windows and Linux variants are available. Brain Cipher using the leaked build of LockBit Black for their operations. The group suspected to have exploited CV…'>BrainCipher</a>","discovered":"2026-09-29T15:22:00.745226+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e2c6d8d54ed240fad4b51db4b5ea1916.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://wildmanbg.com' rel='nofollow noopener noreferrer' target='_blank'>wildmanbg.com</a>","group_name":"<a href='/group/braincipher/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/BrainCipher · Brain Cipher emerged in July 2024. Both Windows and Linux variants are available. Brain Cipher using the leaked build of LockBit Black for their operations. The group suspected to have exploited CV…'>BrainCipher</a>","discovered":"2026-09-29T15:21:23.788570+00:00","country":"BG","country_flag":"<a href='/country/bg/' title='Ransomware victims in Bulgaria'><span class='fi fi-bg fis'></span> <span>BG</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/b8caeb85a51cff0167ff38d7d2e53916.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://maxwell-group.com' rel='nofollow noopener noreferrer' target='_blank'>maxwell-group.com</a>","group_name":"<a href='/group/braincipher/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/BrainCipher · Brain Cipher emerged in July 2024. Both Windows and Linux variants are available. Brain Cipher using the leaked build of LockBit Black for their operations. The group suspected to have exploited CV…'>BrainCipher</a>","discovered":"2026-09-29T15:20:48.696225+00:00","country":"GB","country_flag":"<a href='/country/gb/' title='Ransomware victims in United Kingdom'><span class='fi fi-gb fis'></span> <span>GB</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/3bc31702f957b732d72836325f6c0295.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"Paid Victim 32373FFB7AF7E725","group_name":"<a href='/group/auditteam/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/AuditTeam · AuditTeam is a small ransomware group with approximately 5 known victims, primarily targeting organizations in East and Southeast Asia across technology and manufacturing sectors, operating a data …'>AuditTeam</a>","discovered":"2026-09-29T12:50:25.921812+00:00","country":"IT","country_flag":"<a href='/country/it/' title='Ransomware victims in Italy'><span class='fi fi-it fis'></span> <span>IT</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e2ab796dd9bdbe1d5c1ca1256a8c96e7.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://bcx.co.za' rel='nofollow noopener noreferrer' target='_blank'>bcx.co.za</a>","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-09-29T12:32:11.425937+00:00","country":"ZA","country_flag":"<a href='/country/za/' title='Ransomware victims in South Africa'><span class='fi fi-za fis'></span> <span>ZA</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/d6d9fb501de4b6a7cc4043eb689fa85e.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://proxi.tel' rel='nofollow noopener noreferrer' target='_blank'>Groupe Proxitel</a>","group_name":"<a href='/group/vexy-ransomware/' title='aka vexy · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Vexy%20Ransomware'>Vexy Ransomware</a>","discovered":"2026-09-29T12:23:17.033382+00:00","country":"TL","country_flag":"<span class='fi fi-tl fis'></span> <span>TL</span>","screenshot":"","activity":"Technology"},
{"post_title":"<a href='https://carolinaasthma.com' rel='nofollow noopener noreferrer' target='_blank'>carolinaasthma.com</a>","group_name":"<a href='/group/chaos/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/chaos · Chaos is a ransomware-as-a-service operation that emerged in early 2025, likely formed by former BlackSuit/Royal members, offering cross-platform ransomware for Windows, Linux, ESXi, and NAS to aff…'>chaos</a>","discovered":"2026-09-29T10:55:04.392923+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/a53a65f00834c63eb552104e0c54ae91.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://oterolaw.com' rel='nofollow noopener noreferrer' target='_blank'>oterolaw.com</a>","group_name":"<a href='/group/m3rx/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/m3rx · M3rx is a small ransomware group first observed in 2025, using AES-CTR/AES-GCM encryption and targeting organizations in England, the US, Australia, Germany, Italy, and Switzerland, with around eig…'>m3rx</a>","discovered":"2026-09-29T10:37:35.432674+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/30a0fffa0c419d2f3e97583f9519198a.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://somasolucoes.com' rel='nofollow noopener noreferrer' target='_blank'>somasolucoes.com</a>","group_name":"<a href='/group/m3rx/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/m3rx · M3rx is a small ransomware group first observed in 2025, using AES-CTR/AES-GCM encryption and targeting organizations in England, the US, Australia, Germany, Italy, and Switzerland, with around eig…'>m3rx</a>","discovered":"2026-09-29T10:36:44.561205+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/97e10219e2073dbcbdc93f5de42b966b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://noonsugar.com' rel='nofollow noopener noreferrer' target='_blank'>noonsugar.com</a>","group_name":"<a href='/group/m3rx/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/m3rx · M3rx is a small ransomware group first observed in 2025, using AES-CTR/AES-GCM encryption and targeting organizations in England, the US, Australia, Germany, Italy, and Switzerland, with around eig…'>m3rx</a>","discovered":"2026-09-29T10:35:52.678125+00:00","country":"AE","country_flag":"<a href='/country/ae/' title='Ransomware victims in United Arab Emirates'><span class='fi fi-ae fis'></span> <span>AE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/3d5e7c77adf7f089ab4866d99888e1fb.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://iccsi.com' rel='nofollow noopener noreferrer' target='_blank'>iccsi.com</a>","group_name":"<a href='/group/m3rx/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/m3rx · M3rx is a small ransomware group first observed in 2025, using AES-CTR/AES-GCM encryption and targeting organizations in England, the US, Australia, Germany, Italy, and Switzerland, with around eig…'>m3rx</a>","discovered":"2026-09-29T10:34:59.653412+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/cf6505a1145c36a60c20c3fcfca3096a.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://cpacb.com' rel='nofollow noopener noreferrer' target='_blank'>cpacb.com</a>","group_name":"<a href='/group/m3rx/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/m3rx · M3rx is a small ransomware group first observed in 2025, using AES-CTR/AES-GCM encryption and targeting organizations in England, the US, Australia, Germany, Italy, and Switzerland, with around eig…'>m3rx</a>","discovered":"2026-09-29T09:42:07.920077+00:00","country":"CA","country_flag":"<a href='/country/ca/' title='Ransomware victims in Canada'><span class='fi fi-ca fis'></span> <span>CA</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/34bc6d8fe680acabcc393cd44cf83922.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://camorim.com.br' rel='nofollow noopener noreferrer' target='_blank'>camorim.com.br</a>","group_name":"<a href='/group/lockbit5/' title='Files (online) — needs Tor · Profile: https://www.ransomware.live/group/lockbit5 · LockBit 5.0 (&quot;ChuongDong&quot;) emerged in September 2025 as the group&#x27;s resurgence following the February 2024 law enforcement takedown, introducing cross-platform payloads targeting Windows, Linux, an…'>lockbit5</a>","discovered":"2026-09-29T06:00:24.386324+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/04695a95d3b5275a50098fd11c8c029b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"Precision Facades Ltd","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-09-29T05:51:30.708992+00:00","country":"GB","country_flag":"<a href='/country/gb/' title='Ransomware victims in United Kingdom'><span class='fi fi-gb fis'></span> <span>GB</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e41b2991f895b729b1ec5aa1735abd8f.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"MinMor Industries","group_name":"<a href='http://cryoblogedawivdcknyd4jsjxkrx3xrqqltxla6wwjjnzm3f3jaxjzqd.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/cry0 · Cry0 is a ransomware-as-a-service operation that recruits affiliates via underground forums, using a Rust-written payload with blockchain-based (Internet Computer Protocol) negotiation infrastructu…'>cry0</a>","discovered":"2026-09-28T22:56:41.792635+00:00","country":"","country_flag":"","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://www.arnoldcenter.org' rel='nofollow noopener noreferrer' target='_blank'>Arnold Center</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-28T20:01:05.988942+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/8f00764ddab4513b21dd4802bbbe7e76.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://bakemyday.se' rel='nofollow noopener noreferrer' target='_blank'>bakemyday.se</a>","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-09-28T19:30:12.166703+00:00","country":"SE","country_flag":"<a href='/country/se/' title='Ransomware victims in Sweden'><span class='fi fi-se fis'></span> <span>SE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/3f0a62436e6bfde1a15cad8e775f5933.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://safescaffolding.net' rel='nofollow noopener noreferrer' target='_blank'>safescaffolding.net</a>","group_name":"<a href='/group/threeam/' title='aka 3Am · Chat (online) — needs Tor · Profile: https://www.ransomware.live/group/threeam · A new Ransomware family identified by the name &#x27;3AM&#x27; or &#x27;ThreeAM&#x27; in September 2023. The ransomware operation was observed by the Symantec team, in which a ransomware affiliate attempted to deploy …'>threeam</a>","discovered":"2026-09-28T18:53:08.906692+00:00","country":"GB","country_flag":"<a href='/country/gb/' title='Ransomware victims in United Kingdom'><span class='fi fi-gb fis'></span> <span>GB</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/f5d71878f4070a09c094d2b436c35bbe.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://coosalud.com' rel='nofollow noopener noreferrer' target='_blank'>coosalud.com</a>","group_name":"<a href='/group/threeam/' title='aka 3Am · Chat (online) — needs Tor · Profile: https://www.ransomware.live/group/threeam · A new Ransomware family identified by the name &#x27;3AM&#x27; or &#x27;ThreeAM&#x27; in September 2023. The ransomware operation was observed by the Symantec team, in which a ransomware affiliate attempted to deploy …'>threeam</a>","discovered":"2026-09-28T18:52:35.108785+00:00","country":"CO","country_flag":"<a href='/country/co/' title='Ransomware victims in Colombia'><span class='fi fi-co fis'></span> <span>CO</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e7e6702fabd8dbc9c1ffc44c4739fefb.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://pistonespersan.com.ar' rel='nofollow noopener noreferrer' target='_blank'>pistonespersan.com.ar</a>","group_name":"<a href='/group/threeam/' title='aka 3Am · Chat (online) — needs Tor · Profile: https://www.ransomware.live/group/threeam · A new Ransomware family identified by the name &#x27;3AM&#x27; or &#x27;ThreeAM&#x27; in September 2023. The ransomware operation was observed by the Symantec team, in which a ransomware affiliate attempted to deploy …'>threeam</a>","discovered":"2026-09-28T18:52:00.934584+00:00","country":"AR","country_flag":"<a href='/country/ar/' title='Ransomware victims in Argentina'><span class='fi fi-ar fis'></span> <span>AR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/dbd299890e22d6e44b2d6a8013f48eb3.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://midwestbit.com' rel='nofollow noopener noreferrer' target='_blank'>midwestbit.com</a>","group_name":"<a href='/group/threeam/' title='aka 3Am · Chat (online) — needs Tor · Profile: https://www.ransomware.live/group/threeam · A new Ransomware family identified by the name &#x27;3AM&#x27; or &#x27;ThreeAM&#x27; in September 2023. The ransomware operation was observed by the Symantec team, in which a ransomware affiliate attempted to deploy …'>threeam</a>","discovered":"2026-09-28T18:51:26.727251+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/d39cee0e0418934d572c9d1ac294653a.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://apexus.com' rel='nofollow noopener noreferrer' target='_blank'>apexus.com</a>","group_name":"<a href='/group/threeam/' title='aka 3Am · Chat (online) — needs Tor · Profile: https://www.ransomware.live/group/threeam · A new Ransomware family identified by the name &#x27;3AM&#x27; or &#x27;ThreeAM&#x27; in September 2023. The ransomware operation was observed by the Symantec team, in which a ransomware affiliate attempted to deploy …'>threeam</a>","discovered":"2026-09-28T18:50:52.449363+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e698ada3cf715881faff0503773635cd.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://bhn-expertise.com' rel='nofollow noopener noreferrer' target='_blank'>bhn-expertise.com</a>","group_name":"<a href='/group/threeam/' title='aka 3Am · Chat (online) — needs Tor · Profile: https://www.ransomware.live/group/threeam · A new Ransomware family identified by the name &#x27;3AM&#x27; or &#x27;ThreeAM&#x27; in September 2023. The ransomware operation was observed by the Symantec team, in which a ransomware affiliate attempted to deploy …'>threeam</a>","discovered":"2026-09-28T18:50:17.665375+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/148c5f50eace596a7dc117807e7e3e44.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://stjames.wa.edu.au' rel='nofollow noopener noreferrer' target='_blank'>stjames.wa.edu.au</a>","group_name":"<a href='/group/threeam/' title='aka 3Am · Chat (online) — needs Tor · Profile: https://www.ransomware.live/group/threeam · A new Ransomware family identified by the name &#x27;3AM&#x27; or &#x27;ThreeAM&#x27; in September 2023. The ransomware operation was observed by the Symantec team, in which a ransomware affiliate attempted to deploy …'>threeam</a>","discovered":"2026-09-28T18:49:38.475443+00:00","country":"AU","country_flag":"<a href='/country/au/' title='Ransomware victims in Australia'><span class='fi fi-au fis'></span> <span>AU</span></a>","screenshot":"","activity":"Education"},
{"post_title":"Goodrich Logistics","group_name":"<a href='/group/doommageddon/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Doommageddon · Direct Extortion'>Doommageddon</a>","discovered":"2026-09-28T18:46:47.445594+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/4eea822ac6609a39edba877480fc6700.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Transportation"},
{"post_title":"Chem Process Systems Pvt. Ltd.","group_name":"<a href='/group/doommageddon/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Doommageddon · Direct Extortion'>Doommageddon</a>","discovered":"2026-09-28T18:46:12.359388+00:00","country":"IN","country_flag":"<a href='/country/in/' title='Ransomware victims in India'><span class='fi fi-in fis'></span> <span>IN</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/b0ccf45aa11993a46f28bac0e9aa8875.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://www.starrwhitehouse.com' rel='nofollow noopener noreferrer' target='_blank'>Starr Whitehouse Landscape Architects</a>","group_name":"<a href='/group/play/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/play · Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite simil…'>play</a>","discovered":"2026-09-28T18:33:25.750880+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/b3a3063c2180d0959bcc075f5434caaa.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://www.everreadyfirstaidusa.com' rel='nofollow noopener noreferrer' target='_blank'>Ever Ready First Aid</a>","group_name":"<a href='/group/play/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/play · Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite simil…'>play</a>","discovered":"2026-09-28T18:32:52.007763+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/33a6140c931f49855be40a5e492389db.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://08trl.exit' rel='nofollow noopener noreferrer' target='_blank'>PKSF — Palli Karma-Sahayak Foundation</a>","group_name":"<a href='/group/medusalocker/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/medusalocker · Medusa is a DDoS bot written in .NET 2.0. In its current incarnation its C&amp;C protocol is based on HTTP, while its predecessor made use of IRC.'>medusalocker</a>","discovered":"2026-09-28T18:03:04.304233+00:00","country":"BD","country_flag":"<a href='/country/bd/' title='Ransomware victims in Bangladesh'><span class='fi fi-bd fis'></span> <span>BD</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/685b233d9385db1305406015d4f22886.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"Amazon Informatica","group_name":"<a href='/group/emperador/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/emperador'>emperador</a>","discovered":"2026-09-28T17:51:32.755089+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/8aac7427d506422aa538bdb81bd6979f.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://www.nwdi.com.ph' rel='nofollow noopener noreferrer' target='_blank'>New World Diagnostics</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-28T17:00:04.105747+00:00","country":"PH","country_flag":"<a href='/country/ph/' title='Ransomware victims in Philippines'><span class='fi fi-ph fis'></span> <span>PH</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/158c767cc5c824ffafe5e7db0c6ce806.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"Netech (Neeser Technik AG)","group_name":"<a href='/group/payload/' title='Chat (online) — needs Tor · Profile: https://www.ransomware.live/group/payload · Payload is a ransomware group that emerged in early 2026, using Babuk-derived source code targeting both Windows and ESXi systems with cross-platform double-extortion attacks against healthcare, en…'>payload</a>","discovered":"2026-09-28T16:59:11.383587+00:00","country":"CH","country_flag":"<a href='/country/ch/' title='Ransomware victims in Switzerland'><span class='fi fi-ch fis'></span> <span>CH</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/b8cdef7e965fb282cd9892a06bf55fe0.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://juntadeandalucia.es' rel='nofollow noopener noreferrer' target='_blank'>Juntadeandalucia</a>","group_name":"<a href='/group/medusalocker/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/medusalocker · Medusa is a DDoS bot written in .NET 2.0. In its current incarnation its C&amp;C protocol is based on HTTP, while its predecessor made use of IRC.'>medusalocker</a>","discovered":"2026-09-28T16:00:59.327855+00:00","country":"ES","country_flag":"<a href='/country/es/' title='Ransomware victims in Spain'><span class='fi fi-es fis'></span> <span>ES</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/9513427f5cd7b8596b7f9fc09a206e6d.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Government & Defense"},
{"post_title":"<a href='https://premiumfruits.eu' rel='nofollow noopener noreferrer' target='_blank'>Premiumfruits</a>","group_name":"<a href='/group/medusalocker/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/medusalocker · Medusa is a DDoS bot written in .NET 2.0. In its current incarnation its C&amp;C protocol is based on HTTP, while its predecessor made use of IRC.'>medusalocker</a>","discovered":"2026-09-28T16:00:23.742793+00:00","country":"ES","country_flag":"<a href='/country/es/' title='Ransomware victims in Spain'><span class='fi fi-es fis'></span> <span>ES</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e606429f4ab7651c2e335dfb08c5eafc.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Agriculture and Food Production"},
{"post_title":"<a href='https://https:renaldocs.com' rel='nofollow noopener noreferrer' target='_blank'>The Center for Kidney Care</a>","group_name":"<a href='/group/interlock/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/interlock · Interlock is a ransomware group first observed in September 2024 that targets critical infrastructure sectors including healthcare, government, education, and technology across North America and Eu…'>interlock</a>","discovered":"2026-09-28T15:58:06.779865+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/68c2554faf538486e0065c8d6b81d6a8.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"S...d","group_name":"<a href='/group/silentransomgroup/' title='aka Luna Moth · DLS (online) · Profile: https://www.ransomware.live/group/silentransomgroup · A former Conti team'>SilentRansomGroup</a>","discovered":"2026-09-28T15:52:22.602645+00:00","country":"","country_flag":"","screenshot":"","activity":"Not Found"},
{"post_title":"Geebee Garments","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-09-28T14:55:10.972625+00:00","country":"","country_flag":"","screenshot":"","activity":"Retail & E-Commerce"},
{"post_title":"Knit","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-09-28T14:25:30.583350+00:00","country":"","country_flag":"","screenshot":"","activity":"Technology"},
{"post_title":"<a href='https://www.sklg.co.jp' rel='nofollow noopener noreferrer' target='_blank'>SKLG</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-28T14:03:31.763228+00:00","country":"JP","country_flag":"<a href='/country/jp/' title='Ransomware victims in Japan'><span class='fi fi-jp fis'></span> <span>JP</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/a3df404ecc226a58bfe4e5b37f042ddd.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://mail.gmail.com' rel='nofollow noopener noreferrer' target='_blank'>ATCO Ltd</a>","group_name":"<a href='/group/medusalocker/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/medusalocker · Medusa is a DDoS bot written in .NET 2.0. In its current incarnation its C&amp;C protocol is based on HTTP, while its predecessor made use of IRC.'>medusalocker</a>","discovered":"2026-09-28T10:59:30.614815+00:00","country":"CA","country_flag":"<a href='/country/ca/' title='Ransomware victims in Canada'><span class='fi fi-ca fis'></span> <span>CA</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/6d9c064b206c41c1c721e26193ac529e.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Energy & Utilities"},
{"post_title":"<a href='https://npiprofile.com' rel='nofollow noopener noreferrer' target='_blank'>Kellys Home Center</a>","group_name":"<a href='/group/pear/' title='aka Pure Extraction And Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/pear · Pure Extraction And Ransom (PEAR) Team is the community of highly responsible and strictly disciplined members. We are a private team and have nothing common with any other threat actors. We&#x27;ve bee…'>pear</a>","discovered":"2026-09-28T10:01:39.461478+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/a9ceabbb8cff117a03be9f0465883185.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://www.nisshodenki.com' rel='nofollow noopener noreferrer' target='_blank'>Nissho Electric Manufacturing Co., Ltd.</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-28T08:59:05.334779+00:00","country":"JP","country_flag":"<a href='/country/jp/' title='Ransomware victims in Japan'><span class='fi fi-jp fis'></span> <span>JP</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/68a782f5ac5cb804b2f79d8849641968.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://manno.ch' rel='nofollow noopener noreferrer' target='_blank'>manno.ch</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-09-28T08:34:02.142903+00:00","country":"CH","country_flag":"<a href='/country/ch/' title='Ransomware victims in Switzerland'><span class='fi fi-ch fis'></span> <span>CH</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/f3088f998bbeff85d009320e373f4c58.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://auromex.com' rel='nofollow noopener noreferrer' target='_blank'>auromex.com</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-09-28T08:33:27.538776+00:00","country":"MX","country_flag":"<a href='/country/mx/' title='Ransomware victims in Mexico'><span class='fi fi-mx fis'></span> <span>MX</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/d608a968ac6b218ae227abf33fc00b50.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://cromados.com' rel='nofollow noopener noreferrer' target='_blank'>cromados.com</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-09-28T08:32:52.143553+00:00","country":"ES","country_flag":"<a href='/country/es/' title='Ransomware victims in Spain'><span class='fi fi-es fis'></span> <span>ES</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/73850dfb8acb805a571ed712c5054538.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://lfgholding.com' rel='nofollow noopener noreferrer' target='_blank'>lfgholding.com</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-09-28T07:33:24.735301+00:00","country":"CH","country_flag":"<a href='/country/ch/' title='Ransomware victims in Switzerland'><span class='fi fi-ch fis'></span> <span>CH</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/a478d57b923be2fabbb422b9964a5abf.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://fedelmundo.com.ph' rel='nofollow noopener noreferrer' target='_blank'>fedelmundo.com.ph</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-09-28T07:32:49.640577+00:00","country":"PH","country_flag":"<a href='/country/ph/' title='Ransomware victims in Philippines'><span class='fi fi-ph fis'></span> <span>PH</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/670c7cc1da2af9bc8b9dbbfb0374ced9.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://bio-strath.com' rel='nofollow noopener noreferrer' target='_blank'>bio-strath.com</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-09-28T07:32:13.912669+00:00","country":"CH","country_flag":"<a href='/country/ch/' title='Ransomware victims in Switzerland'><span class='fi fi-ch fis'></span> <span>CH</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/74069a9a2c8d51bdd4d7e049b46dcb28.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://sumperk.cz' rel='nofollow noopener noreferrer' target='_blank'>sumperk.cz</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-09-28T07:31:38.552815+00:00","country":"CZ","country_flag":"<a href='/country/cz/' title='Ransomware victims in Czechia'><span class='fi fi-cz fis'></span> <span>CZ</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/d588c12b009baed5b1ae6281de2b305b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://eagroep.com' rel='nofollow noopener noreferrer' target='_blank'>eagroep.com</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-09-28T07:31:04.793923+00:00","country":"BE","country_flag":"<a href='/country/be/' title='Ransomware victims in Belgium'><span class='fi fi-be fis'></span> <span>BE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/2d2d953ebef464b580720a69671aeded.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Agriculture and Food Production"},
{"post_title":"<a href='https://Holiday Inn Vilnius' rel='nofollow noopener noreferrer' target='_blank'>Holiday Inn Vilnius</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-09-28T07:30:29.452487+00:00","country":"LT","country_flag":"<a href='/country/lt/' title='Ransomware victims in Lithuania'><span class='fi fi-lt fis'></span> <span>LT</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/4d69cde6b283e8b8063b325bea181dd4.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Hospitality"},
{"post_title":"Dediserve Ltd","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-09-28T05:51:12.504866+00:00","country":"GB","country_flag":"<a href='/country/gb/' title='Ransomware victims in United Kingdom'><span class='fi fi-gb fis'></span> <span>GB</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/7513f489eb7cce793215023d6b102636.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"SiteProRentals","group_name":"<a href='/group/emperador/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/emperador'>emperador</a>","discovered":"2026-09-28T02:51:39.941454+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/f9ac8aa001fa9962f4f2d40a6e4555a0.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Hospitality"},
{"post_title":"Electrolux 2...","group_name":"<a href='/group/emperador/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/emperador'>emperador</a>","discovered":"2026-09-28T02:51:03.276890+00:00","country":"SE","country_flag":"<a href='/country/se/' title='Ransomware victims in Sweden'><span class='fi fi-se fis'></span> <span>SE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/ce7d7eef2a04743f881d9f6c0d06fd4b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"SMCare","group_name":"<a href='/group/panzer/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Panzer'>Panzer</a>","discovered":"2026-09-28T01:22:48.356222+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/567a858382ac5b989774332223770299.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"AHEAD","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-09-28T00:35:17.931454+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/83a160fe0297a024a6acbd193c2764e6.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://nsbsd.org' rel='nofollow noopener noreferrer' target='_blank'>nsbsd.org</a>","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-09-28T00:34:42.734180+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/d34e128dc97e868e0e544aa01d16f86e.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Government & Defense"},
{"post_title":"Asesoría FAR","group_name":"<a href='/group/panzer/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Panzer'>Panzer</a>","discovered":"2026-09-27T22:25:06.347330+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/ac62d65a98fed5a4a17e0fbd4c07b92f.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"Ressources Si","group_name":"<a href='/group/panzer/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Panzer'>Panzer</a>","discovered":"2026-09-27T22:24:33.339674+00:00","country":"FR","country_flag":"<a href='/country/fr/' title='Ransomware victims in France'><span class='fi fi-fr fis'></span> <span>FR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/5cd077fb6790743d4e69a1b8c72d99e2.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"First Secure Bank Group","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-09-27T17:53:23.053212+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/ba031767fe565c001f7184fb09c09fd3.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"<a href='https://www.xicoled.com' rel='nofollow noopener noreferrer' target='_blank'>XICO</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-27T17:03:11.072620+00:00","country":"MX","country_flag":"<a href='/country/mx/' title='Ransomware victims in Mexico'><span class='fi fi-mx fis'></span> <span>MX</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/8e9803afb3f40dd817646d2cfc9b7423.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://www.island.ca' rel='nofollow noopener noreferrer' target='_blank'>Island</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-27T17:02:29.099119+00:00","country":"CA","country_flag":"<a href='/country/ca/' title='Ransomware victims in Canada'><span class='fi fi-ca fis'></span> <span>CA</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e67d48837df25a7c3291e388e863e319.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://www.gruporevenga.com' rel='nofollow noopener noreferrer' target='_blank'>Revenga Smart Solutions</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-27T16:06:05.111130+00:00","country":"ES","country_flag":"<a href='/country/es/' title='Ransomware victims in Spain'><span class='fi fi-es fis'></span> <span>ES</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/b0ab0b0baf17b9da464a940aa74d3b56.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://www.wfaustin.com' rel='nofollow noopener noreferrer' target='_blank'>Willatt &amp; Flickinger</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-27T16:05:11.768205+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/5b87e150bca667d89d1eb64bb9ed86a7.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"Pantaneiro Capas","group_name":"<a href='/group/arcusmedia/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/arcusmedia · Arcus Media is a ransomware-as-a-service group that emerged in May 2024, employing double extortion with ChaCha20 + RSA-2048 encryption and recruiting affiliates via a referral-based vetting proces…'>arcusmedia</a>","discovered":"2026-09-27T13:53:21.721586+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/66c42520d5ddbc14b11b704087b28c43.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"Car Service Abschlepp","group_name":"<a href='/group/emperador/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/emperador'>emperador</a>","discovered":"2026-09-27T09:51:32.444206+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/1196d425cb2e61cd0e080e3037159081.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Transportation"},
{"post_title":"ARCA UNLIMITED Architects","group_name":"<a href='http://ybvjht7qcuhcml4pjcs7fgk57tzysplqtfq4i7yrwc6vjilin2dt2qad.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/BlackLocks'>BlackLocks</a>","discovered":"2026-09-26T17:07:42.056972+00:00","country":"ZA","country_flag":"<a href='/country/za/' title='Ransomware victims in South Africa'><span class='fi fi-za fis'></span> <span>ZA</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/eaa9ca8e85523f7e4fe62c82aa2db322.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://cipher.systems' rel='nofollow noopener noreferrer' target='_blank'>cipher.systems</a>","group_name":"<a href='/group/m3rx/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/m3rx · M3rx is a small ransomware group first observed in 2025, using AES-CTR/AES-GCM encryption and targeting organizations in England, the US, Australia, Germany, Italy, and Switzerland, with around eig…'>m3rx</a>","discovered":"2026-09-26T17:02:51.145975+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/ce4ca133ec9184214e7f3fb88f7ad83d.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"International Chemical Co.","group_name":"<a href='/group/barracuda/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Barracuda'>Barracuda</a>","discovered":"2026-09-26T15:51:01.584677+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/0189c8e1c75d6904bc4236ef6d4c57a4.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"M****n","group_name":"<a href='/group/payoutsking/' title='aka Payouts King · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/payoutsking · PayoutsKing is an active ransomware group observed through at least 2026 that has claimed attacks against a wide range of industries internationally — including Del Monte Foods and V. FRAAS — acros…'>payoutsking</a>","discovered":"2026-09-26T08:55:32.683964+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Not Found"},
{"post_title":"<a href='https://apollo21.co.za' rel='nofollow noopener noreferrer' target='_blank'>Apollo 21 – Quality Truck, Bus &amp; Trailer Spare Parts South Africa</a>","group_name":"<a href='http://ybvjht7qcuhcml4pjcs7fgk57tzysplqtfq4i7yrwc6vjilin2dt2qad.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/BlackLocks'>BlackLocks</a>","discovered":"2026-09-26T08:50:49.032431+00:00","country":"ZA","country_flag":"<a href='/country/za/' title='Ransomware victims in South Africa'><span class='fi fi-za fis'></span> <span>ZA</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/c362c66b83296c5211aa2f5c16c36c67.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Transportation"},
{"post_title":"<a href='https://appliedcomposites.com' rel='nofollow noopener noreferrer' target='_blank'>Applied Composites</a>","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-09-26T08:48:35.034186+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/6e3d8646f7f2a6485e91eb91b7c1c86f.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://guardrisk.co.za' rel='nofollow noopener noreferrer' target='_blank'>Guardrisk</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-26T08:48:17.963292+00:00","country":"ZA","country_flag":"<a href='/country/za/' title='Ransomware victims in South Africa'><span class='fi fi-za fis'></span> <span>ZA</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/957c8860be8ae1429c7c8cbe4820107e.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"<a href='https://metalware.ca' rel='nofollow noopener noreferrer' target='_blank'>Metalware Corporation</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-26T08:48:02.502579+00:00","country":"CA","country_flag":"<a href='/country/ca/' title='Ransomware victims in Canada'><span class='fi fi-ca fis'></span> <span>CA</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://magnals.com' rel='nofollow noopener noreferrer' target='_blank'>Magna Legal Services</a>","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-09-26T08:48:02.341778+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/de492daf9e4d9740c58a77a43899de62.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://st.com' rel='nofollow noopener noreferrer' target='_blank'>StMicroelectronics</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-26T08:47:57.238559+00:00","country":"IT","country_flag":"<a href='/country/it/' title='Ransomware victims in Italy'><span class='fi fi-it fis'></span> <span>IT</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/223f5106730236d9682fee2ce37704f6.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://fachhandel-hell.at' rel='nofollow noopener noreferrer' target='_blank'>Hell Helmut GmbH</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-26T08:47:41.826850+00:00","country":"AT","country_flag":"<a href='/country/at/' title='Ransomware victims in Austria'><span class='fi fi-at fis'></span> <span>AT</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://magnetos.com.mx' rel='nofollow noopener noreferrer' target='_blank'>Magnetos y Refacciones</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-26T08:47:37.459157+00:00","country":"MX","country_flag":"<a href='/country/mx/' title='Ransomware victims in Mexico'><span class='fi fi-mx fis'></span> <span>MX</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://anphealthsolutions.com' rel='nofollow noopener noreferrer' target='_blank'>ANP Health</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-26T08:47:19.097573+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://progenyag.com' rel='nofollow noopener noreferrer' target='_blank'>Progeny</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-26T08:47:16.638725+00:00","country":"AG","country_flag":"<span class='fi fi-ag fis'></span> <span>AG</span>","screenshot":"","activity":"Technology"},
{"post_title":"<a href='https://grupomarsan.com' rel='nofollow noopener noreferrer' target='_blank'>Grupo MARSAN</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-26T08:46:55.683269+00:00","country":"MX","country_flag":"<a href='/country/mx/' title='Ransomware victims in Mexico'><span class='fi fi-mx fis'></span> <span>MX</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://agrocampo.com.co' rel='nofollow noopener noreferrer' target='_blank'>Agrocampo</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-26T08:46:34.628903+00:00","country":"CO","country_flag":"<a href='/country/co/' title='Ransomware victims in Colombia'><span class='fi fi-co fis'></span> <span>CO</span></a>","screenshot":"","activity":"Agriculture and Food Production"},
{"post_title":"<a href='https://markisol.se' rel='nofollow noopener noreferrer' target='_blank'>Markisol</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-26T08:46:13.633119+00:00","country":"SE","country_flag":"<a href='/country/se/' title='Ransomware victims in Sweden'><span class='fi fi-se fis'></span> <span>SE</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://trifectasoftware.com' rel='nofollow noopener noreferrer' target='_blank'>Trifecta Software</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-26T08:45:52.629931+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Technology"},
{"post_title":"<a href='https://puroclean.com' rel='nofollow noopener noreferrer' target='_blank'>PuroClean</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-26T08:45:31.677857+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Other"},
{"post_title":"<a href='https://brancoptica.pt' rel='nofollow noopener noreferrer' target='_blank'>Brancoptica</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-26T08:45:10.566102+00:00","country":"PT","country_flag":"<a href='/country/pt/' title='Ransomware victims in Portugal'><span class='fi fi-pt fis'></span> <span>PT</span></a>","screenshot":"","activity":"Other"},
{"post_title":"<a href='https://craisa.com' rel='nofollow noopener noreferrer' target='_blank'>Craisa</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-26T08:44:49.721471+00:00","country":"","country_flag":"","screenshot":"","activity":"Not Found"},
{"post_title":"<a href='https://crystalglassltd.co.uk' rel='nofollow noopener noreferrer' target='_blank'>Crystal Glass</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-26T08:44:28.616265+00:00","country":"GB","country_flag":"<a href='/country/gb/' title='Ransomware victims in United Kingdom'><span class='fi fi-gb fis'></span> <span>GB</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://pajulahti.com' rel='nofollow noopener noreferrer' target='_blank'>Pajulahti</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-26T08:44:07.398976+00:00","country":"FI","country_flag":"<a href='/country/fi/' title='Ransomware victims in Finland'><span class='fi fi-fi fis'></span> <span>FI</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://grupoligue-se.pt' rel='nofollow noopener noreferrer' target='_blank'>Ligue se Grupo</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-26T08:43:46.371446+00:00","country":"PT","country_flag":"<a href='/country/pt/' title='Ransomware victims in Portugal'><span class='fi fi-pt fis'></span> <span>PT</span></a>","screenshot":"","activity":"Other"},
{"post_title":"<a href='https://charleskeith.com' rel='nofollow noopener noreferrer' target='_blank'>Charles Keith</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-26T08:43:25.529856+00:00","country":"SG","country_flag":"<a href='/country/sg/' title='Ransomware victims in Singapore'><span class='fi fi-sg fis'></span> <span>SG</span></a>","screenshot":"","activity":"Retail & E-Commerce"},
{"post_title":"ENKEI*******","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-26T08:43:03.052002+00:00","country":"","country_flag":"","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://ftapi.com' rel='nofollow noopener noreferrer' target='_blank'>FTAPI Software</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-26T08:42:43.611644+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Technology"},
{"post_title":"<a href='https://www.crossettinc.com' rel='nofollow noopener noreferrer' target='_blank'>Crossett</a>","group_name":"<a href='/group/termite/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/termite · Termite is a ransomware group first identified in late 2024 using a modified version of Babuk ransomware code; its most notable attack was the November 2024 breach of supply-chain software firm Blu…'>termite</a>","discovered":"2026-09-26T00:43:37.349060+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/2f1446b98325457f57bf87710f523419.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"N...","group_name":"<a href='/group/silentransomgroup/' title='aka Luna Moth · DLS (online) · Profile: https://www.ransomware.live/group/silentransomgroup · A former Conti team'>SilentRansomGroup</a>","discovered":"2026-09-25T19:28:34.527489+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/3d9e9f2130737edb16c36eed78b560a2.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"S...","group_name":"<a href='/group/silentransomgroup/' title='aka Luna Moth · DLS (online) · Profile: https://www.ransomware.live/group/silentransomgroup · A former Conti team'>SilentRansomGroup</a>","discovered":"2026-09-25T19:27:29.125288+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/ac67d0321bfbdc0b4dc163d838aa8d4e.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://gevernova.com' rel='nofollow noopener noreferrer' target='_blank'>GE Vernova Inc.</a>","group_name":"<a href='/group/metaencryptor/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/metaencryptor · MetaEncryptor is a ransomware group first observed in mid-2023, targeting medium-to-large enterprises in legal, technology, logistics, manufacturing, and finance sectors primarily in the UK, Europe…'>metaencryptor</a>","discovered":"2026-09-25T19:01:27.889978+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/a9ad06780135540458763e3a4f8a7d43.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Energy & Utilities"},
{"post_title":"<a href='https://pkfhadiwinata.com' rel='nofollow noopener noreferrer' target='_blank'>PKF Hadiwinata</a>","group_name":"<a href='/group/metaencryptor/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/metaencryptor · MetaEncryptor is a ransomware group first observed in mid-2023, targeting medium-to-large enterprises in legal, technology, logistics, manufacturing, and finance sectors primarily in the UK, Europe…'>metaencryptor</a>","discovered":"2026-09-25T19:00:47.943822+00:00","country":"ID","country_flag":"<a href='/country/id/' title='Ransomware victims in Indonesia'><span class='fi fi-id fis'></span> <span>ID</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/f468ea9c8f4e39ad10b36bba92ba7a1e.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://platinumhs.com' rel='nofollow noopener noreferrer' target='_blank'>Platinum Healthcare Staffing</a>","group_name":"<a href='/group/metaencryptor/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/metaencryptor · MetaEncryptor is a ransomware group first observed in mid-2023, targeting medium-to-large enterprises in legal, technology, logistics, manufacturing, and finance sectors primarily in the UK, Europe…'>metaencryptor</a>","discovered":"2026-09-25T19:00:09.243370+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/b8cf92148d9b7a2b581cd841581a2523.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"Electrolux &amp; Ontrac","group_name":"<a href='/group/emperador/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/emperador'>emperador</a>","discovered":"2026-09-25T17:51:02.090231+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/cb35cdf48b9dc2c240996a9b22a236a4.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"Securitas Group","group_name":"<a href='/group/everest/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/everest · Everest ransom group collects and analyzes information about their victims. They specialize in customer privacy data, financial information, databases, credit card information, and more. The Everes…'>everest</a>","discovered":"2026-09-25T16:29:00.128112+00:00","country":"SE","country_flag":"<a href='/country/se/' title='Ransomware victims in Sweden'><span class='fi fi-se fis'></span> <span>SE</span></a>","screenshot":"","activity":"Professional Services"},
{"post_title":"<a href='https://morulaivf.co.id' rel='nofollow noopener noreferrer' target='_blank'>Morula IVF</a>","group_name":"<a href='/group/everest/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/everest · Everest ransom group collects and analyzes information about their victims. They specialize in customer privacy data, financial information, databases, credit card information, and more. The Everes…'>everest</a>","discovered":"2026-09-25T16:28:05.214616+00:00","country":"ZA","country_flag":"<a href='/country/za/' title='Ransomware victims in South Africa'><span class='fi fi-za fis'></span> <span>ZA</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://tobinandco.com' rel='nofollow noopener noreferrer' target='_blank'>Tobin &amp; Company</a>","group_name":"<a href='/group/wallstreet/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Wallstreet'>Wallstreet</a>","discovered":"2026-09-25T15:53:56.395279+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Financial Services"},
{"post_title":"<a href='https://ar-resources.com' rel='nofollow noopener noreferrer' target='_blank'>Ar Valve Resources</a>","group_name":"<a href='/group/wallstreet/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Wallstreet'>Wallstreet</a>","discovered":"2026-09-25T15:53:37.201195+00:00","country":"GB","country_flag":"<a href='/country/gb/' title='Ransomware victims in United Kingdom'><span class='fi fi-gb fis'></span> <span>GB</span></a>","screenshot":"","activity":"Energy & Utilities"},
{"post_title":"GTFM","group_name":"<a href='/group/wallstreet/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Wallstreet'>Wallstreet</a>","discovered":"2026-09-25T15:53:17.656722+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Not Found"},
{"post_title":"<a href='https://beatuscartons.co.uk' rel='nofollow noopener noreferrer' target='_blank'>Beatus Cartons</a>","group_name":"<a href='/group/wallstreet/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Wallstreet'>Wallstreet</a>","discovered":"2026-09-25T15:52:58.349036+00:00","country":"GB","country_flag":"<a href='/country/gb/' title='Ransomware victims in United Kingdom'><span class='fi fi-gb fis'></span> <span>GB</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"Reliance Audit","group_name":"<a href='/group/everest/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/everest · Everest ransom group collects and analyzes information about their victims. They specialize in customer privacy data, financial information, databases, credit card information, and more. The Everes…'>everest</a>","discovered":"2026-09-25T15:34:31.884119+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/7fee2c004f6658100520acb44e4962ed.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://unirita.co.jp' rel='nofollow noopener noreferrer' target='_blank'>UNIRITA</a>","group_name":"<a href='/group/everest/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/everest · Everest ransom group collects and analyzes information about their victims. They specialize in customer privacy data, financial information, databases, credit card information, and more. The Everes…'>everest</a>","discovered":"2026-09-25T15:33:52.140982+00:00","country":"JP","country_flag":"<a href='/country/jp/' title='Ransomware victims in Japan'><span class='fi fi-jp fis'></span> <span>JP</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e477959936bdd67489da4ee0212f9456.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"CENELEC","group_name":"<a href='/group/everest/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/everest · Everest ransom group collects and analyzes information about their victims. They specialize in customer privacy data, financial information, databases, credit card information, and more. The Everes…'>everest</a>","discovered":"2026-09-25T15:33:13.807097+00:00","country":"BE","country_flag":"<a href='/country/be/' title='Ransomware victims in Belgium'><span class='fi fi-be fis'></span> <span>BE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/9664bdd80c332f0a29f6610cc2e900b8.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"ETS","group_name":"<a href='/group/everest/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/everest · Everest ransom group collects and analyzes information about their victims. They specialize in customer privacy data, financial information, databases, credit card information, and more. The Everes…'>everest</a>","discovered":"2026-09-25T15:32:32.232232+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/2dfe53f33dc90eecabfff977f5219089.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Education"},
{"post_title":"<a href='https://breastimplantcenterofhawaii.com' rel='nofollow noopener noreferrer' target='_blank'>Breast Implant Center of Hawaii</a>","group_name":"<a href='/group/wallstreet/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Wallstreet'>Wallstreet</a>","discovered":"2026-09-25T15:25:13.785460+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://majaninsure.com' rel='nofollow noopener noreferrer' target='_blank'>Majani Insurance Brokers</a>","group_name":"<a href='/group/vexy-ransomware/' title='aka vexy · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Vexy%20Ransomware'>Vexy Ransomware</a>","discovered":"2026-09-25T13:24:43.407188+00:00","country":"KE","country_flag":"<a href='/country/ke/' title='Ransomware victims in Kenya'><span class='fi fi-ke fis'></span> <span>KE</span></a>","screenshot":"","activity":"Financial Services"},
{"post_title":"<a href='https://www.iberiacompositech.com' rel='nofollow noopener noreferrer' target='_blank'>Iberia Compositech Manufacturing</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-25T12:48:32.797370+00:00","country":"ES","country_flag":"<a href='/country/es/' title='Ransomware victims in Spain'><span class='fi fi-es fis'></span> <span>ES</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e7fde83189bea427e95f27afaf173238.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://taspenlife.com' rel='nofollow noopener noreferrer' target='_blank'>taspenlife.com</a>","group_name":"<a href='/group/lockbit5/' title='Files (online) — needs Tor · Profile: https://www.ransomware.live/group/lockbit5 · LockBit 5.0 (&quot;ChuongDong&quot;) emerged in September 2025 as the group&#x27;s resurgence following the February 2024 law enforcement takedown, introducing cross-platform payloads targeting Windows, Linux, an…'>lockbit5</a>","discovered":"2026-09-25T12:40:42.379616+00:00","country":"KZ","country_flag":"<span class='fi fi-kz fis'></span> <span>KZ</span>","screenshot":"<a href='https://images.ransomware.live/victims/d9de89f855d771a5aaefe0e05836958a.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://anery.com.br' rel='nofollow noopener noreferrer' target='_blank'>anery.com.br</a>","group_name":"<a href='/group/lockbit5/' title='Files (online) — needs Tor · Profile: https://www.ransomware.live/group/lockbit5 · LockBit 5.0 (&quot;ChuongDong&quot;) emerged in September 2025 as the group&#x27;s resurgence following the February 2024 law enforcement takedown, introducing cross-platform payloads targeting Windows, Linux, an…'>lockbit5</a>","discovered":"2026-09-25T12:38:34.184085+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/29edac3bc198a2c711448c3b0a068c56.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Agriculture and Food Production"},
{"post_title":"<a href='https://corisricambi.it' rel='nofollow noopener noreferrer' target='_blank'>corisricambi.it</a>","group_name":"<a href='/group/lockbit5/' title='Files (online) — needs Tor · Profile: https://www.ransomware.live/group/lockbit5 · LockBit 5.0 (&quot;ChuongDong&quot;) emerged in September 2025 as the group&#x27;s resurgence following the February 2024 law enforcement takedown, introducing cross-platform payloads targeting Windows, Linux, an…'>lockbit5</a>","discovered":"2026-09-25T12:36:29.202121+00:00","country":"IT","country_flag":"<a href='/country/it/' title='Ransomware victims in Italy'><span class='fi fi-it fis'></span> <span>IT</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/2508bfdee2afba5069656b84a7c18e85.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://pharma5.ma' rel='nofollow noopener noreferrer' target='_blank'>pharma5.ma</a>","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-09-25T10:33:40.339269+00:00","country":"MA","country_flag":"<a href='/country/ma/' title='Ransomware victims in Morocco'><span class='fi fi-ma fis'></span> <span>MA</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/4312a13a1e8029539c51478c38efc838.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"TapClicks (marketing analytics platform)","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-09-25T03:21:46.506246+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/71e340002e041eb6b6f6bee0721021ab.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://www.armadacrb.co.ug' rel='nofollow noopener noreferrer' target='_blank'>Armada Credit Bureau</a>","group_name":"<a href='http://spiralstfe7rtbna7zlv6szdwmjvjszf2d64zkf6z5jykrwnw5jbgpyd.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Spirals'>Spirals</a>","discovered":"2026-09-24T22:23:56.245321+00:00","country":"UG","country_flag":"<span class='fi fi-ug fis'></span> <span>UG</span>","screenshot":"","activity":"Financial Services"},
{"post_title":"<a href='https://westsidegicenter.com' rel='nofollow noopener noreferrer' target='_blank'>Westside GI</a>","group_name":"<a href='/group/pear/' title='aka Pure Extraction And Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/pear · Pure Extraction And Ransom (PEAR) Team is the community of highly responsible and strictly disciplined members. We are a private team and have nothing common with any other threat actors. We&#x27;ve bee…'>pear</a>","discovered":"2026-09-24T21:40:03.968565+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/ac05383ebf2de779e5a3c9d3e735be0b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://martinlawrence.com' rel='nofollow noopener noreferrer' target='_blank'>Martin Lawrence Galleries</a>","group_name":"<a href='/group/pear/' title='aka Pure Extraction And Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/pear · Pure Extraction And Ransom (PEAR) Team is the community of highly responsible and strictly disciplined members. We are a private team and have nothing common with any other threat actors. We&#x27;ve bee…'>pear</a>","discovered":"2026-09-24T21:39:04.054012+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/5165275c3618a3291d7e398f2abaae94.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://npiprofile.com' rel='nofollow noopener noreferrer' target='_blank'>Indroj Medical Group Inc.</a>","group_name":"<a href='/group/pear/' title='aka Pure Extraction And Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/pear · Pure Extraction And Ransom (PEAR) Team is the community of highly responsible and strictly disciplined members. We are a private team and have nothing common with any other threat actors. We&#x27;ve bee…'>pear</a>","discovered":"2026-09-24T21:38:02.153160+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/35f140c3ecef5df4d62b4b5cee21274b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://efada.sa' rel='nofollow noopener noreferrer' target='_blank'>efada.sa</a>","group_name":"<a href='/group/krybit/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/krybit · Krybit is an emerging RaaS group that launched in late March 2026, offering affiliates an 80/20 revenue split with support for Windows, Linux, ESXi, and NAS device encryption, and became notable fo…'>krybit</a>","discovered":"2026-09-24T20:01:08.851154+00:00","country":"SA","country_flag":"<a href='/country/sa/' title='Ransomware victims in Saudi Arabia'><span class='fi fi-sa fis'></span> <span>SA</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/c57cd22c5cbc6bf7fe9cc269cd8bed49.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"NEAD Pro","group_name":"<a href='/group/rhysida/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/rhysida · Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets&#x27; networks and d…'>rhysida</a>","discovered":"2026-09-24T18:01:29.579614+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/69cc1c8f2f490aa82926d9b05b639e60.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"bnlawmacau.com www.bn-ip.com","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-09-24T17:58:23.744897+00:00","country":"MO","country_flag":"<span class='fi fi-mo fis'></span> <span>MO</span>","screenshot":"<a href='https://images.ransomware.live/victims/98bcc4e8f63753a9a40d49f00475f9d8.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://welgenone.com' rel='nofollow noopener noreferrer' target='_blank'>welgenone.com</a>","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-09-24T17:08:57.902259+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/7602af1a949e0801eab9a056cf654fc4.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://ukbjja.org' rel='nofollow noopener noreferrer' target='_blank'>ukbjja.org</a>","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-09-24T17:07:56.532081+00:00","country":"GB","country_flag":"<a href='/country/gb/' title='Ransomware victims in United Kingdom'><span class='fi fi-gb fis'></span> <span>GB</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/5586487e59490228736a6f41fbe5c382.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"Prater &amp; Ridley Attorneys At Law","group_name":"<a href='/group/wallstreet/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Wallstreet'>Wallstreet</a>","discovered":"2026-09-24T15:07:29.844770+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Professional Services"},
{"post_title":"Catholic University of El Salvador","group_name":"<a href='/group/wallstreet/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Wallstreet'>Wallstreet</a>","discovered":"2026-09-24T14:28:46.535418+00:00","country":"SV","country_flag":"<a href='/country/sv/' title='Ransomware victims in El Salvador'><span class='fi fi-sv fis'></span> <span>SV</span></a>","screenshot":"","activity":"Education"},
{"post_title":"<a href='https://www.daogroup.com' rel='nofollow noopener noreferrer' target='_blank'>Dao Group</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-24T14:24:06.432946+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/1cd5483ff63e3f23d48f1c5fa98922ca.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://www.alltechinc.com' rel='nofollow noopener noreferrer' target='_blank'>All Tech Machine &amp; Engineering</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-24T14:23:28.512655+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/64bdd31e235cea486b82724156009d76.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://www.proyectosdevida.com' rel='nofollow noopener noreferrer' target='_blank'>Inversiones Bolívar</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-24T14:22:50.156804+00:00","country":"CO","country_flag":"<a href='/country/co/' title='Ransomware victims in Colombia'><span class='fi fi-co fis'></span> <span>CO</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/ecda66873eee1c65215744e111cd841f.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"<a href='https://www.prospecthillcamberwell.com.au' rel='nofollow noopener noreferrer' target='_blank'>Zig Inge Group</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-24T14:22:10.675361+00:00","country":"AU","country_flag":"<a href='/country/au/' title='Ransomware victims in Australia'><span class='fi fi-au fis'></span> <span>AU</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/0821f2b51c9a9a813c95612aa2223398.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"Wallatec","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-09-24T13:56:18.753785+00:00","country":"","country_flag":"","screenshot":"","activity":"Other"},
{"post_title":"<a href='https://coopagora.fr' rel='nofollow noopener noreferrer' target='_blank'>Agora coopérative agricole</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-24T13:46:11.050170+00:00","country":"FR","country_flag":"<a href='/country/fr/' title='Ransomware victims in France'><span class='fi fi-fr fis'></span> <span>FR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/0077ee6083f15318978ce7ac709eadd8.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Agriculture and Food Production"},
{"post_title":"<a href='https://www.gdmpipelines.com' rel='nofollow noopener noreferrer' target='_blank'>GDM Pipelines</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-24T13:45:30.309552+00:00","country":"GB","country_flag":"<a href='/country/gb/' title='Ransomware victims in United Kingdom'><span class='fi fi-gb fis'></span> <span>GB</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/b5812efd39f7c3c28f50077e626083cb.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Energy & Utilities"},
{"post_title":"Strack Companies","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-09-24T13:26:41.048603+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://revolut.com' rel='nofollow noopener noreferrer' target='_blank'>Revolut</a>","group_name":"<a href='http://o6rtgcjdjqyimjxexpejddhdfbehsjn4fcsazfkgwydeb27gqhtdntyd.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/ImNotAVillain'>ImNotAVillain</a>","discovered":"2026-09-24T13:22:27.135504+00:00","country":"GB","country_flag":"<a href='/country/gb/' title='Ransomware victims in United Kingdom'><span class='fi fi-gb fis'></span> <span>GB</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/d498e19092e32f4a8a3f0603f6e49f92.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"Italy","group_name":"<a href='http://o6rtgcjdjqyimjxexpejddhdfbehsjn4fcsazfkgwydeb27gqhtdntyd.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/ImNotAVillain'>ImNotAVillain</a>","discovered":"2026-09-24T13:21:32.131653+00:00","country":"IT","country_flag":"<a href='/country/it/' title='Ransomware victims in Italy'><span class='fi fi-it fis'></span> <span>IT</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/aa1ea13dd495456ab227aac7862c5688.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Government & Defense"},
{"post_title":"<a href='https://airtanzania.co.tz / airtanzania.com' rel='nofollow noopener noreferrer' target='_blank'>airtanzania.co.tz / airtanzania.com</a>","group_name":"<a href='/group/krybit/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/krybit · Krybit is an emerging RaaS group that launched in late March 2026, offering affiliates an 80/20 revenue split with support for Windows, Linux, ESXi, and NAS device encryption, and became notable fo…'>krybit</a>","discovered":"2026-09-24T12:09:22.266539+00:00","country":"TZ","country_flag":"<a href='/country/tz/' title='Ransomware victims in Tanzania'><span class='fi fi-tz fis'></span> <span>TZ</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/5aee73303b828e711f2cc806c14659d4.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Transportation"},
{"post_title":"<a href='https://www.jonesthegrocer.com' rel='nofollow noopener noreferrer' target='_blank'>www.jonesthegrocer.com</a>","group_name":"<a href='/group/krybit/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/krybit · Krybit is an emerging RaaS group that launched in late March 2026, offering affiliates an 80/20 revenue split with support for Windows, Linux, ESXi, and NAS device encryption, and became notable fo…'>krybit</a>","discovered":"2026-09-24T12:08:43.092764+00:00","country":"AU","country_flag":"<a href='/country/au/' title='Ransomware victims in Australia'><span class='fi fi-au fis'></span> <span>AU</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/342f52cce6b7846eb4c49326c85f00e1.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"Grupo Caberj","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-09-24T12:07:14.853458+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/ed0971a60929543aacd1788fdf77aebb.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://winfashion.com' rel='nofollow noopener noreferrer' target='_blank'>winfashion</a>","group_name":"<a href='/group/dragonforce/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/dragonforce · DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a &quot;ransomware cartel&quot; i…'>dragonforce</a>","discovered":"2026-09-24T11:56:35.298360+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/0e4d33b0cd0b6693449db2248bf9fc66.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://agiliance.fr' rel='nofollow noopener noreferrer' target='_blank'>agiliance.fr</a>","group_name":"<a href='/group/zawoo/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/zawoo'>ZaWoo</a>","discovered":"2026-09-24T10:54:46.872589+00:00","country":"FR","country_flag":"<a href='/country/fr/' title='Ransomware victims in France'><span class='fi fi-fr fis'></span> <span>FR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/852bc9a21d51f3cd441795f5b7760cbe.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://www.francare.com' rel='nofollow noopener noreferrer' target='_blank'>www.francare.com</a>","group_name":"<a href='/group/zawoo/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/zawoo'>ZaWoo</a>","discovered":"2026-09-24T10:54:11.176387+00:00","country":"FR","country_flag":"<a href='/country/fr/' title='Ransomware victims in France'><span class='fi fi-fr fis'></span> <span>FR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/483f8e94a8c8583d498377f8dc70bef8.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://amb-pvc.com' rel='nofollow noopener noreferrer' target='_blank'>amb-pvc.com</a>","group_name":"<a href='/group/zawoo/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/zawoo'>ZaWoo</a>","discovered":"2026-09-24T10:53:34.027294+00:00","country":"FR","country_flag":"<a href='/country/fr/' title='Ransomware victims in France'><span class='fi fi-fr fis'></span> <span>FR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/5c7d0a95efbd1816fb089c6dc5ca19d5.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://arizonavascular.com' rel='nofollow noopener noreferrer' target='_blank'>Arizona Vascular Medical Equipment, Inc</a>","group_name":"<a href='/group/dragonforce/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/dragonforce · DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a &quot;ransomware cartel&quot; i…'>dragonforce</a>","discovered":"2026-09-24T10:00:20.939101+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e544c3003540f41a7677e55e679e2360.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://polyresine.com' rel='nofollow noopener noreferrer' target='_blank'>BMGP Groupe</a>","group_name":"<a href='/group/dragonforce/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/dragonforce · DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a &quot;ransomware cartel&quot; i…'>dragonforce</a>","discovered":"2026-09-24T09:59:19.780535+00:00","country":"FR","country_flag":"<a href='/country/fr/' title='Ransomware victims in France'><span class='fi fi-fr fis'></span> <span>FR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/02a5d34b5879a72dc3effc2316a18e19.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://pjemetal.com' rel='nofollow noopener noreferrer' target='_blank'>Elite Industech Co., Ltd</a>","group_name":"<a href='/group/dragonforce/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/dragonforce · DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a &quot;ransomware cartel&quot; i…'>dragonforce</a>","discovered":"2026-09-24T09:58:17.449497+00:00","country":"TH","country_flag":"<a href='/country/th/' title='Ransomware victims in Thailand'><span class='fi fi-th fis'></span> <span>TH</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/65fb22d751d53a10830b70fad00083be.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://hec-group.com.tw' rel='nofollow noopener noreferrer' target='_blank'>HEC Group</a>","group_name":"<a href='/group/dragonforce/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/dragonforce · DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a &quot;ransomware cartel&quot; i…'>dragonforce</a>","discovered":"2026-09-24T09:57:15.569603+00:00","country":"TW","country_flag":"<a href='/country/tw/' title='Ransomware victims in Taiwan'><span class='fi fi-tw fis'></span> <span>TW</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e52219f447b4682c1ea9dca48324e19f.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"Final statement re PSA","group_name":"<a href='/group/shinyhunters/' title='DLS (online) · Profile: https://www.ransomware.live/group/shinyhunters · ShinyHunters is a financially motivated data-theft and extortion group active since 2020, responsible for high-profile breaches including Ticketmaster (via Snowflake) and PowerSchool; by 2025 they …'>shinyhunters</a>","discovered":"2026-09-24T08:44:48.048248+00:00","country":"","country_flag":"","screenshot":"","activity":"Not Found"},
{"post_title":"Solucioning S.A.","group_name":"<a href='/group/barracuda/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Barracuda'>Barracuda</a>","discovered":"2026-09-24T02:21:19.755959+00:00","country":"AR","country_flag":"<a href='/country/ar/' title='Ransomware victims in Argentina'><span class='fi fi-ar fis'></span> <span>AR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/0189c8e1c75d6904bc4236ef6d4c57a4.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"eTeam","group_name":"<a href='http://endzonezgz3sqzmtqg4acp4z7ao7xc6vunfhezjsnfqrm2ksudsredyd.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/EndZone'>EndZone</a>","discovered":"2026-09-24T01:21:36.513046+00:00","country":"","country_flag":"","screenshot":"","activity":"Professional Services"},
{"post_title":"OnTrac","group_name":"<a href='/group/emperador/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/emperador'>emperador</a>","discovered":"2026-09-23T20:51:04.749900+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/99b55914d402f242236a1b483b167508.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Transportation"},
{"post_title":"Abtach Ltd.","group_name":"<a href='/group/barracuda/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Barracuda'>Barracuda</a>","discovered":"2026-09-23T19:20:51.283138+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/0189c8e1c75d6904bc4236ef6d4c57a4.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://goldstarfinancial.com' rel='nofollow noopener noreferrer' target='_blank'>goldstarfinancial.com</a>","group_name":"<a href='/group/braincipher/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/BrainCipher · Brain Cipher emerged in July 2024. Both Windows and Linux variants are available. Brain Cipher using the leaked build of LockBit Black for their operations. The group suspected to have exploited CV…'>BrainCipher</a>","discovered":"2026-09-23T18:20:39.427019+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/bf0ec893b5d206a86c0808c4488cf923.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"<a href='https://tomix.com.pt' rel='nofollow noopener noreferrer' target='_blank'>Tomix / Grupo JOPER</a>","group_name":"<a href='/group/spacebears/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/spacebears · Space Bears is a double-extortion ransomware group that emerged in April 2024, distinguished by a professional &quot;corporate&quot; aesthetic on its leak site, leveraging Phobos RaaS infrastructure and targ…'>spacebears</a>","discovered":"2026-09-23T17:44:57.376445+00:00","country":"PT","country_flag":"<a href='/country/pt/' title='Ransomware victims in Portugal'><span class='fi fi-pt fis'></span> <span>PT</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/4e2484a53ef520ec5f1bd167a572dff4.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://vestfrostsolutions.com' rel='nofollow noopener noreferrer' target='_blank'>vestfrostsolutions.com</a>","group_name":"<a href='/group/settra/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/settra'>settra</a>","discovered":"2026-09-23T16:23:12.813229+00:00","country":"NO","country_flag":"<a href='/country/no/' title='Ransomware victims in Norway'><span class='fi fi-no fis'></span> <span>NO</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/4ba1082131569b5d664dedc5b8fa44b6.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"Legis","group_name":"<a href='/group/rhysida/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/rhysida · Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets&#x27; networks and d…'>rhysida</a>","discovered":"2026-09-23T16:22:15.987690+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/688d685e55d897704892bff97d2cc056.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://www.asyad.com' rel='nofollow noopener noreferrer' target='_blank'>ASYAD GROUP</a>","group_name":"<a href='http://spiralstfe7rtbna7zlv6szdwmjvjszf2d64zkf6z5jykrwnw5jbgpyd.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Spirals'>Spirals</a>","discovered":"2026-09-23T15:53:48.708765+00:00","country":"OM","country_flag":"<a href='/country/om/' title='Ransomware victims in Oman'><span class='fi fi-om fis'></span> <span>OM</span></a>","screenshot":"","activity":"Transportation"},
{"post_title":"<a href='https://trumpmobile.com' rel='nofollow noopener noreferrer' target='_blank'>Trump Mobile</a>","group_name":"<a href='http://endzonezgz3sqzmtqg4acp4z7ao7xc6vunfhezjsnfqrm2ksudsredyd.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/EndZone'>EndZone</a>","discovered":"2026-09-23T15:21:01.778316+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Technology"},
{"post_title":"Urban Engineering","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-09-23T13:24:53.745474+00:00","country":"","country_flag":"","screenshot":"","activity":"Manufacturing"},
{"post_title":"Lemon Law","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-09-23T12:47:50.382166+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/4f5cfa622db2679e11b454ab31fc9af5.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"HIT dd","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-09-23T12:23:35.249184+00:00","country":"","country_flag":"","screenshot":"","activity":"Not Found"},
{"post_title":"Apex Litigation Support","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-09-23T12:23:15.329907+00:00","country":"","country_flag":"","screenshot":"","activity":"Professional Services"},
{"post_title":"<a href='https://www.inkript.com' rel='nofollow noopener noreferrer' target='_blank'>Inkript</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-23T11:51:41.719722+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/af2020e405f35ee551372426bfbf5417.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"AGROFRUTO SAC","group_name":"<a href='/group/arcusmedia/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/arcusmedia · Arcus Media is a ransomware-as-a-service group that emerged in May 2024, employing double extortion with ChaCha20 + RSA-2048 encryption and recruiting affiliates via a referral-based vetting proces…'>arcusmedia</a>","discovered":"2026-09-23T10:24:53.839828+00:00","country":"PE","country_flag":"<a href='/country/pe/' title='Ransomware victims in Peru'><span class='fi fi-pe fis'></span> <span>PE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/803b57c1539a943c35cda8c10d3d41ef.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Agriculture and Food Production"},
{"post_title":"<a href='https://cosef.fvg.it' rel='nofollow noopener noreferrer' target='_blank'>COSEF - Consorzio di Sviluppo Economico del Friuli</a>","group_name":"<a href='/group/booba-project/' title='aka Booba Team · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Booba%20Project · Booba'>Booba Project</a>","discovered":"2026-09-23T10:21:32.142591+00:00","country":"IT","country_flag":"<a href='/country/it/' title='Ransomware victims in Italy'><span class='fi fi-it fis'></span> <span>IT</span></a>","screenshot":"","activity":"Other"},
{"post_title":"<a href='https://www.merrimackcounty.net' rel='nofollow noopener noreferrer' target='_blank'>The Merrimack County</a>","group_name":"<a href='/group/booba-project/' title='aka Booba Team · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Booba%20Project · Booba'>Booba Project</a>","discovered":"2026-09-23T10:21:11.050272+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Government & Defense"},
{"post_title":"<a href='https://www.smarteyecare.com' rel='nofollow noopener noreferrer' target='_blank'>Smart Eye Care</a>","group_name":"<a href='/group/booba-project/' title='aka Booba Team · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Booba%20Project · Booba'>Booba Project</a>","discovered":"2026-09-23T10:20:50.133660+00:00","country":"","country_flag":"","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://washingtoncountymaine.com' rel='nofollow noopener noreferrer' target='_blank'>Washington County</a>","group_name":"<a href='/group/booba-project/' title='aka Booba Team · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Booba%20Project · Booba'>Booba Project</a>","discovered":"2026-09-23T10:20:28.538851+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Government & Defense"},
{"post_title":"RECEITA FEDERAL DO BRASIL","group_name":"<a href='/group/emperador/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/emperador'>emperador</a>","discovered":"2026-09-23T09:20:59.298791+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/127d3032d7644bd5e264165cef8dc74b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Government & Defense"},
{"post_title":"<a href='https://aokkef.fr' rel='nofollow noopener noreferrer' target='_blank'>Aokkef</a>","group_name":"<a href='/group/medusalocker/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/medusalocker · Medusa is a DDoS bot written in .NET 2.0. In its current incarnation its C&amp;C protocol is based on HTTP, while its predecessor made use of IRC.'>medusalocker</a>","discovered":"2026-09-23T07:41:04.829054+00:00","country":"FR","country_flag":"<a href='/country/fr/' title='Ransomware victims in France'><span class='fi fi-fr fis'></span> <span>FR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/d3e366b87960334a62a72f7be245c41a.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://seznam.cz' rel='nofollow noopener noreferrer' target='_blank'>Seznam</a>","group_name":"<a href='/group/medusalocker/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/medusalocker · Medusa is a DDoS bot written in .NET 2.0. In its current incarnation its C&amp;C protocol is based on HTTP, while its predecessor made use of IRC.'>medusalocker</a>","discovered":"2026-09-23T07:40:37.231015+00:00","country":"CZ","country_flag":"<a href='/country/cz/' title='Ransomware victims in Czechia'><span class='fi fi-cz fis'></span> <span>CZ</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e5ee0a1d77c174ffb6505edf79307edf.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://abv.bg' rel='nofollow noopener noreferrer' target='_blank'>Abv</a>","group_name":"<a href='/group/medusalocker/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/medusalocker · Medusa is a DDoS bot written in .NET 2.0. In its current incarnation its C&amp;C protocol is based on HTTP, while its predecessor made use of IRC.'>medusalocker</a>","discovered":"2026-09-23T07:39:33.505905+00:00","country":"BG","country_flag":"<a href='/country/bg/' title='Ransomware victims in Bulgaria'><span class='fi fi-bg fis'></span> <span>BG</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/9e82ba523d71247ce7b8048637db1ad8.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"W... B...","group_name":"<a href='/group/silentransomgroup/' title='aka Luna Moth · DLS (online) · Profile: https://www.ransomware.live/group/silentransomgroup · A former Conti team'>SilentRansomGroup</a>","discovered":"2026-09-23T00:22:21.462121+00:00","country":"","country_flag":"","screenshot":"","activity":"Not Found"},
{"post_title":"Clark Hill","group_name":"<a href='/group/silentransomgroup/' title='aka Luna Moth · DLS (online) · Profile: https://www.ransomware.live/group/silentransomgroup · A former Conti team'>SilentRansomGroup</a>","discovered":"2026-09-22T22:52:34.143004+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Professional Services"},
{"post_title":"Fresenius Medical Care","group_name":"<a href='/group/shinyhunters/' title='DLS (online) · Profile: https://www.ransomware.live/group/shinyhunters · ShinyHunters is a financially motivated data-theft and extortion group active since 2020, responsible for high-profile breaches including Ticketmaster (via Snowflake) and PowerSchool; by 2025 they …'>shinyhunters</a>","discovered":"2026-09-22T22:42:24.389477+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"Gaedke &amp; Partner Steuerberatung","group_name":"<a href='/group/anubis/' title='Chat (online) — needs Tor · Profile: https://www.ransomware.live/group/anubis · Anubis is a ransomware-as-a-service group active since December 2024 that targets healthcare, engineering, construction, and professional services sectors, offering affiliates a flexible revenue sp…'>anubis</a>","discovered":"2026-09-22T22:24:10.904495+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/519bbde100de2daa3697017549d39e55.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"Grupo Hospifar S.R.L.","group_name":"<a href='/group/titan/' title='DLS (online) · Profile: https://www.ransomware.live/group/titan · Founded 4 April 2026'>titan</a>","discovered":"2026-09-22T19:55:20.352291+00:00","country":"AR","country_flag":"<a href='/country/ar/' title='Ransomware victims in Argentina'><span class='fi fi-ar fis'></span> <span>AR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/c950371cb807fc5165bd4e78b33fb09f.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"Sherman Chan, DDS, Inc.","group_name":"<a href='/group/titan/' title='DLS (online) · Profile: https://www.ransomware.live/group/titan · Founded 4 April 2026'>titan</a>","discovered":"2026-09-22T19:54:43.098501+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/2bf2a6eee21b7425115e5ffcd72e6a5c.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"B...","group_name":"<a href='/group/silentransomgroup/' title='aka Luna Moth · DLS (online) · Profile: https://www.ransomware.live/group/silentransomgroup · A former Conti team'>SilentRansomGroup</a>","discovered":"2026-09-22T19:30:50.964435+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/98e55f35c6b3d5a66aa0645fbd66e9ca.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"Cozen O'Connor","group_name":"<a href='/group/silentransomgroup/' title='aka Luna Moth · DLS (online) · Profile: https://www.ransomware.live/group/silentransomgroup · A former Conti team'>SilentRansomGroup</a>","discovered":"2026-09-22T19:29:26.646048+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Professional Services"},
{"post_title":"W...","group_name":"<a href='/group/silentransomgroup/' title='aka Luna Moth · DLS (online) · Profile: https://www.ransomware.live/group/silentransomgroup · A former Conti team'>SilentRansomGroup</a>","discovered":"2026-09-22T19:29:02.834035+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/71a1b3df93fb4ccfeb36a36086772ef7.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"PSA - READ THIS NOW","group_name":"<a href='/group/shinyhunters/' title='DLS (online) · Profile: https://www.ransomware.live/group/shinyhunters · ShinyHunters is a financially motivated data-theft and extortion group active since 2020, responsible for high-profile breaches including Ticketmaster (via Snowflake) and PowerSchool; by 2025 they …'>shinyhunters</a>","discovered":"2026-09-22T18:51:02.990444+00:00","country":"","country_flag":"","screenshot":"","activity":"Not Found"},
{"post_title":"AFRICA-TECH (IT services / document processing)","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-09-22T17:22:04.310703+00:00","country":"ML","country_flag":"<span class='fi fi-ml fis'></span> <span>ML</span>","screenshot":"<a href='https://images.ransomware.live/victims/faa38495c3755b59c229ddbb55f5911f.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://universalautogroup.com' rel='nofollow noopener noreferrer' target='_blank'>universalautogroup.com</a>","group_name":"<a href='/group/settra/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/settra'>settra</a>","discovered":"2026-09-22T16:52:53.151073+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/375afd651ff1790d0ae62ffdf6df4a4c.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Transportation"},
{"post_title":"<a href='https://namtheun2.com' rel='nofollow noopener noreferrer' target='_blank'>namtheun2.com</a>","group_name":"<a href='/group/settra/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/settra'>settra</a>","discovered":"2026-09-22T16:52:19.141664+00:00","country":"LA","country_flag":"<span class='fi fi-la fis'></span> <span>LA</span>","screenshot":"<a href='https://images.ransomware.live/victims/575565a2443810e3b4aba533d6f4d91c.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Energy & Utilities"},
{"post_title":"<a href='https://lakebeverage.com' rel='nofollow noopener noreferrer' target='_blank'>lakebeverage.com</a>","group_name":"<a href='/group/settra/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/settra'>settra</a>","discovered":"2026-09-22T16:51:44.681815+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/eaf23cc4d827cb6ec97b984e678c812a.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://quantummarketing-group.com' rel='nofollow noopener noreferrer' target='_blank'>quantummarketing-group.com</a>","group_name":"<a href='/group/settra/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/settra'>settra</a>","discovered":"2026-09-22T16:50:49.826841+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/70b4f1397e95629bec3b28ca8b49da67.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://moscone.com' rel='nofollow noopener noreferrer' target='_blank'>moscone.com</a>","group_name":"<a href='/group/settra/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/settra'>settra</a>","discovered":"2026-09-22T16:50:08.887345+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/bdcd57a7feb408947e99fccbd50b77e9.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Hospitality"},
{"post_title":"<a href='https://gregjoneslaw.com' rel='nofollow noopener noreferrer' target='_blank'>gregjoneslaw.com</a>","group_name":"<a href='/group/settra/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/settra'>settra</a>","discovered":"2026-09-22T16:49:34.544462+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/524a1002424595f19d6d2366f8c7443b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"Krapf Group","group_name":"<a href='/group/kairos/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/kairos · Kairos is a data extortion group active since late 2024 that focuses solely on data theft with no encryption, primarily targeting small-to-mid-sized organizations in healthcare, manufacturing, and …'>kairos</a>","discovered":"2026-09-22T15:45:48.484772+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://www.tjuhsd.org' rel='nofollow noopener noreferrer' target='_blank'>Tulare Western High School</a>","group_name":"<a href='/group/booba-project/' title='aka Booba Team · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Booba%20Project · Booba'>Booba Project</a>","discovered":"2026-09-22T14:50:47.613268+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Education"},
{"post_title":"<a href='https://www.gotthelfmd.com' rel='nofollow noopener noreferrer' target='_blank'>GOTTHELF</a>","group_name":"<a href='/group/booba-project/' title='aka Booba Team · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Booba%20Project · Booba'>Booba Project</a>","discovered":"2026-09-22T14:50:26.634669+00:00","country":"MD","country_flag":"<span class='fi fi-md fis'></span> <span>MD</span>","screenshot":"","activity":"Not Found"},
{"post_title":"Coe Press Equipment","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-09-22T13:29:07.814346+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"TDMI","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-09-22T13:28:48.077806+00:00","country":"","country_flag":"","screenshot":"","activity":"Not Found"},
{"post_title":"<a href='https://www.thefifty50.com' rel='nofollow noopener noreferrer' target='_blank'>The Fifty/50</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-22T13:23:32.188210+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Not Found"},
{"post_title":"DI.C.S.EL. S.R.L.","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-09-22T12:52:00.770230+00:00","country":"IT","country_flag":"<a href='/country/it/' title='Ransomware victims in Italy'><span class='fi fi-it fis'></span> <span>IT</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://vit.ac.in' rel='nofollow noopener noreferrer' target='_blank'>vit.ac.in</a>","group_name":"<a href='/group/auditteam/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/AuditTeam · AuditTeam is a small ransomware group with approximately 5 known victims, primarily targeting organizations in East and Southeast Asia across technology and manufacturing sectors, operating a data …'>AuditTeam</a>","discovered":"2026-09-22T11:51:00.276184+00:00","country":"IN","country_flag":"<a href='/country/in/' title='Ransomware victims in India'><span class='fi fi-in fis'></span> <span>IN</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/5ff5184d3b0906a6d4dab759b37ae6e6.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Education"},
{"post_title":"Pr***IT","group_name":"<a href='/group/auditteam/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/AuditTeam · AuditTeam is a small ransomware group with approximately 5 known victims, primarily targeting organizations in East and Southeast Asia across technology and manufacturing sectors, operating a data …'>AuditTeam</a>","discovered":"2026-09-22T11:50:21.724962+00:00","country":"IT","country_flag":"<a href='/country/it/' title='Ransomware victims in Italy'><span class='fi fi-it fis'></span> <span>IT</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/51fe1485e6cb464fe157dcaac6e2b9f5.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://www.textilecity.ca' rel='nofollow noopener noreferrer' target='_blank'>Textile City</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-22T11:12:13.506098+00:00","country":"CA","country_flag":"<a href='/country/ca/' title='Ransomware victims in Canada'><span class='fi fi-ca fis'></span> <span>CA</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/d0b1b8710952023b2aeb752ebaf8e1f8.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://www.columbusinformatica.it' rel='nofollow noopener noreferrer' target='_blank'>Columbus Informatica</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-22T10:18:01.849173+00:00","country":"IT","country_flag":"<a href='/country/it/' title='Ransomware victims in Italy'><span class='fi fi-it fis'></span> <span>IT</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/136cbc2dc6b5b227428f10132ed511e2.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"NAI Earle Furman","group_name":"<a href='http://secponewsxgrlnirowclps2kllzaotaf5w2bsvktdnz4qhjr2jnwvvyd.onion/' rel='nofollow noopener noreferrer' target='_blank' title='aka secpo · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/secp0 · Encrypted Extension: .vanhelsing, .vanlocker. Targets Windows Platform only'>secp0</a>","discovered":"2026-09-22T03:38:30.754998+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/c880169e4931b8f387ce875d41fe7847.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://www.sealconusa.com' rel='nofollow noopener noreferrer' target='_blank'>Sealcon</a>","group_name":"<a href='/group/termite/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/termite · Termite is a ransomware group first identified in late 2024 using a modified version of Babuk ransomware code; its most notable attack was the November 2024 breach of supply-chain software firm Blu…'>termite</a>","discovered":"2026-09-22T02:45:36.882685+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/f62e14b4770df1122e2ff3edbfaa3e86.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"FinSoft (Kolibri retail back-office software)","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-09-22T01:51:38.794148+00:00","country":"UZ","country_flag":"<span class='fi fi-uz fis'></span> <span>UZ</span>","screenshot":"<a href='https://images.ransomware.live/victims/0759219a232fd8ea3a951aa2788ee6c2.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://www.truamerica.com' rel='nofollow noopener noreferrer' target='_blank'>TruAmerica Multifamily</a>","group_name":"<a href='/group/termite/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/termite · Termite is a ransomware group first identified in late 2024 using a modified version of Babuk ransomware code; its most notable attack was the November 2024 breach of supply-chain software firm Blu…'>termite</a>","discovered":"2026-09-22T01:45:30.663148+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/f6e9fa1f668d8e34324b17025f19534f.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://thelender.com' rel='nofollow noopener noreferrer' target='_blank'>theLender</a>","group_name":"<a href='/group/termite/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/termite · Termite is a ransomware group first identified in late 2024 using a modified version of Babuk ransomware code; its most notable attack was the November 2024 breach of supply-chain software firm Blu…'>termite</a>","discovered":"2026-09-22T01:44:58.093768+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/398d141d0f2706b988f50b22cdde741d.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"<a href='https://www.metallco.com' rel='nofollow noopener noreferrer' target='_blank'>Metallco</a>","group_name":"<a href='/group/play/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/play · Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite simil…'>play</a>","discovered":"2026-09-21T22:16:54.217399+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/3209cd1113c22f92f1c6907b25452baa.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://www.hurleyco.net' rel='nofollow noopener noreferrer' target='_blank'>Hurley</a>","group_name":"<a href='/group/play/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/play · Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite simil…'>play</a>","discovered":"2026-09-21T22:16:19.325560+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/53407e1bccf904be2d897779e9b40cca.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://www.astemo.com/en' rel='nofollow noopener noreferrer' target='_blank'>Astemo, Ltd.</a>","group_name":"<a href='/group/metaencryptor/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/metaencryptor · MetaEncryptor is a ransomware group first observed in mid-2023, targeting medium-to-large enterprises in legal, technology, logistics, manufacturing, and finance sectors primarily in the UK, Europe…'>metaencryptor</a>","discovered":"2026-09-21T22:14:32.083951+00:00","country":"JP","country_flag":"<a href='/country/jp/' title='Ransomware victims in Japan'><span class='fi fi-jp fis'></span> <span>JP</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/df6be4d6983d33ebed673fb4d6b4108a.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"Hogan Lovells Cadwalader","group_name":"<a href='/group/silentransomgroup/' title='aka Luna Moth · DLS (online) · Profile: https://www.ransomware.live/group/silentransomgroup · A former Conti team'>SilentRansomGroup</a>","discovered":"2026-09-21T21:55:47.896780+00:00","country":"","country_flag":"","screenshot":"","activity":"Professional Services"},
{"post_title":"<a href='https://kyyba.com' rel='nofollow noopener noreferrer' target='_blank'>kyyba.com</a>","group_name":"<a href='/group/unsafe/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/unsafe · A group which seems to recycle leak from other ransomware groups'>unsafe</a>","discovered":"2026-09-21T19:23:38.618927+00:00","country":"FI","country_flag":"<a href='/country/fi/' title='Ransomware victims in Finland'><span class='fi fi-fi fis'></span> <span>FI</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/68858da022ae255bd4c9f6b357ad2cf6.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://www.360consulenza.com' rel='nofollow noopener noreferrer' target='_blank'>360 Consulenza S.r.l.</a>","group_name":"<a href='/group/nightspire/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/nightspire · NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, In…'>nightspire</a>","discovered":"2026-09-21T18:43:28.757817+00:00","country":"IT","country_flag":"<a href='/country/it/' title='Ransomware victims in Italy'><span class='fi fi-it fis'></span> <span>IT</span></a>","screenshot":"","activity":"Professional Services"},
{"post_title":"Spo**** Schools","group_name":"<a href='/group/nightspire/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/nightspire · NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, In…'>nightspire</a>","discovered":"2026-09-21T18:43:08.077144+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Education"},
{"post_title":"Summa Gold","group_name":"<a href='/group/anubis/' title='Chat (online) — needs Tor · Profile: https://www.ransomware.live/group/anubis · Anubis is a ransomware-as-a-service group active since December 2024 that targets healthcare, engineering, construction, and professional services sectors, offering affiliates a flexible revenue sp…'>anubis</a>","discovered":"2026-09-21T18:22:50.400306+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/cb41f49abdcaefdce9185e7ef55ff14e.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"Allied Supply Co.","group_name":"<a href='/group/global-secret-group/' title='aka GSG · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Global%20Secret%20Group'>Global Secret Group</a>","discovered":"2026-09-21T17:53:28.897930+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/d448b698d27b7b40df9d83a827431407.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://kjla.com' rel='nofollow noopener noreferrer' target='_blank'>Kjla</a>","group_name":"<a href='/group/global-secret-group/' title='aka GSG · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Global%20Secret%20Group'>Global Secret Group</a>","discovered":"2026-09-21T17:52:29.577566+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Not Found"},
{"post_title":"<a href='https://www.telrad.com' rel='nofollow noopener noreferrer' target='_blank'>Telrad Networks</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-21T17:22:14.870319+00:00","country":"IL","country_flag":"<a href='/country/il/' title='Ransomware victims in Israel'><span class='fi fi-il fis'></span> <span>IL</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/20bccbad8aea121b9c8f36862b9871d6.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"U.S. Electrical Services and Wiedenbach Brown","group_name":"<a href='/group/moneymessage/' title='aka ThreatLabz · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/moneymessage · Money Message emerged in March 2023 targeting Windows and Linux systems across banking, transportation, and professional services sectors, demanding ransoms in the millions and publishing stolen da…'>moneymessage</a>","discovered":"2026-09-21T15:12:20.806801+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/4a3bee41e75c432dacd07bb978c8f3cb.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Energy & Utilities"},
{"post_title":"<a href='https://www.hudsonmdgroup.com' rel='nofollow noopener noreferrer' target='_blank'>Hudson MD Group, LLC</a>","group_name":"<a href='/group/metaencryptor/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/metaencryptor · MetaEncryptor is a ransomware group first observed in mid-2023, targeting medium-to-large enterprises in legal, technology, logistics, manufacturing, and finance sectors primarily in the UK, Europe…'>metaencryptor</a>","discovered":"2026-09-21T13:08:14.932281+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/0387a99c5c2b83c9c5d2cfcd260b0fbe.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://flex.com' rel='nofollow noopener noreferrer' target='_blank'>Flex Ltd</a>","group_name":"<a href='/group/metaencryptor/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/metaencryptor · MetaEncryptor is a ransomware group first observed in mid-2023, targeting medium-to-large enterprises in legal, technology, logistics, manufacturing, and finance sectors primarily in the UK, Europe…'>metaencryptor</a>","discovered":"2026-09-21T13:06:25.909929+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/1d545cba97859a4f9d629f4319d889f0.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://en.hyvision.co.kr' rel='nofollow noopener noreferrer' target='_blank'>HyVision System. Inc</a>","group_name":"<a href='/group/metaencryptor/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/metaencryptor · MetaEncryptor is a ransomware group first observed in mid-2023, targeting medium-to-large enterprises in legal, technology, logistics, manufacturing, and finance sectors primarily in the UK, Europe…'>metaencryptor</a>","discovered":"2026-09-21T13:05:38.592556+00:00","country":"KR","country_flag":"<a href='/country/kr/' title='Ransomware victims in South Korea'><span class='fi fi-kr fis'></span> <span>KR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/b259d2820d7b01f9c0a3a42f151a45eb.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://visualintelligenceinc.com' rel='nofollow noopener noreferrer' target='_blank'>Visual Intelligence, Inc.</a>","group_name":"<a href='/group/metaencryptor/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/metaencryptor · MetaEncryptor is a ransomware group first observed in mid-2023, targeting medium-to-large enterprises in legal, technology, logistics, manufacturing, and finance sectors primarily in the UK, Europe…'>metaencryptor</a>","discovered":"2026-09-21T13:04:07.966017+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/769a98c0bc8b9b298c00d7c2be6fd044.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://prestigemgt.com' rel='nofollow noopener noreferrer' target='_blank'>Prestige Management</a>","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-09-21T12:24:42.712887+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Professional Services"},
{"post_title":"<a href='https://grupolider-ao.com' rel='nofollow noopener noreferrer' target='_blank'>Grupolider</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-21T11:42:16.073177+00:00","country":"AO","country_flag":"<a href='/country/ao/' title='Ransomware victims in Angola'><span class='fi fi-ao fis'></span> <span>AO</span></a>","screenshot":"","activity":"Other"},
{"post_title":"<a href='https://themoneystore.com' rel='nofollow noopener noreferrer' target='_blank'>The Money Store</a>","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-09-21T11:31:54.260657+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/542e98ef99b7cb9ad58ad21fee2b6346.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"<a href='https://truecorebehavioral.com' rel='nofollow noopener noreferrer' target='_blank'>TrueCore Behavioral Solutions</a>","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-09-21T11:31:22.958248+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/391eed18da1a4df3874d6be2b331d797.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://manroc.com' rel='nofollow noopener noreferrer' target='_blank'>Manroc Developments</a>","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-09-21T11:30:51.754788+00:00","country":"CA","country_flag":"<a href='/country/ca/' title='Ransomware victims in Canada'><span class='fi fi-ca fis'></span> <span>CA</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/82c8f9c790bf813db6b96cbfaac5da2f.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://cpdcareers.com' rel='nofollow noopener noreferrer' target='_blank'>Charlottesville Police Department</a>","group_name":"<a href='/group/doommageddon/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Doommageddon · Direct Extortion'>Doommageddon</a>","discovered":"2026-09-21T10:21:20.195134+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Government & Defense"},
{"post_title":"<a href='https://momentumtelecom.com' rel='nofollow noopener noreferrer' target='_blank'>Gomomentum.com</a>","group_name":"<a href='http://endzonezgz3sqzmtqg4acp4z7ao7xc6vunfhezjsnfqrm2ksudsredyd.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/EndZone'>EndZone</a>","discovered":"2026-09-21T09:20:55.521959+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Not Found"},
{"post_title":"<a href='https://www.ikegami.co.jp' rel='nofollow noopener noreferrer' target='_blank'>IKEGAMI TSUSHINKI COMPANY LIMITED</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-21T08:01:50.407973+00:00","country":"JP","country_flag":"<a href='/country/jp/' title='Ransomware victims in Japan'><span class='fi fi-jp fis'></span> <span>JP</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/9220f43cc95b08824f8fd489fdfdfd56.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://siinqeebank.com' rel='nofollow noopener noreferrer' target='_blank'>siinqeebank.com</a>","group_name":"<a href='/group/lockbit5/' title='Files (online) — needs Tor · Profile: https://www.ransomware.live/group/lockbit5 · LockBit 5.0 (&quot;ChuongDong&quot;) emerged in September 2025 as the group&#x27;s resurgence following the February 2024 law enforcement takedown, introducing cross-platform payloads targeting Windows, Linux, an…'>lockbit5</a>","discovered":"2026-09-21T06:10:58.119416+00:00","country":"SO","country_flag":"<span class='fi fi-so fis'></span> <span>SO</span>","screenshot":"<a href='https://images.ransomware.live/victims/11d8c9c7c0e42ca4ab4432285ac4f2bb.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"<a href='https://newmantractor.com' rel='nofollow noopener noreferrer' target='_blank'>newmantractor.com</a>","group_name":"<a href='/group/threeam/' title='aka 3Am · Chat (online) — needs Tor · Profile: https://www.ransomware.live/group/threeam · A new Ransomware family identified by the name &#x27;3AM&#x27; or &#x27;ThreeAM&#x27; in September 2023. The ransomware operation was observed by the Symantec team, in which a ransomware affiliate attempted to deploy …'>threeam</a>","discovered":"2026-09-21T06:07:48.540462+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/7ef29a6903f416846afe85fe10698c12.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://secondhouse.es' rel='nofollow noopener noreferrer' target='_blank'>SECOND HOUSE</a>","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-09-21T00:35:05.808718+00:00","country":"ES","country_flag":"<a href='/country/es/' title='Ransomware victims in Spain'><span class='fi fi-es fis'></span> <span>ES</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/401ea6f60dd429a98f26b20d88241a50.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Hospitality"},
{"post_title":"<a href='https://bonitaortho.com' rel='nofollow noopener noreferrer' target='_blank'>Maryann Kriger</a>","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-09-21T00:34:36.706236+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/2f361942f96d496f364104d89071329b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://arsrenacer.com' rel='nofollow noopener noreferrer' target='_blank'>arsrenacer.com</a>","group_name":"<a href='/group/dragonforce/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/dragonforce · DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a &quot;ransomware cartel&quot; i…'>dragonforce</a>","discovered":"2026-09-20T20:58:23.037069+00:00","country":"AR","country_flag":"<a href='/country/ar/' title='Ransomware victims in Argentina'><span class='fi fi-ar fis'></span> <span>AR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/82fe0fcceb50deb2e1141e403cf93c25.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://alabamawomenshealth.com' rel='nofollow noopener noreferrer' target='_blank'>Alabama Woman's Health Care</a>","group_name":"<a href='/group/emperador/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/emperador'>emperador</a>","discovered":"2026-09-20T15:51:17.640727+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/170e7ad6ce99aff54cd891f375825850.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://tek-spb.ru' rel='nofollow noopener noreferrer' target='_blank'>TEK SPB</a>","group_name":"<a href='/group/auditteam/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/AuditTeam · AuditTeam is a small ransomware group with approximately 5 known victims, primarily targeting organizations in East and Southeast Asia across technology and manufacturing sectors, operating a data …'>AuditTeam</a>","discovered":"2026-09-20T14:50:56.977259+00:00","country":"RU","country_flag":"<a href='/country/ru/' title='Ransomware victims in Russia'><span class='fi fi-ru fis'></span> <span>RU</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/bf70d3f4a52526ba144c55f908f40bbe.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"st***co","group_name":"<a href='/group/auditteam/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/AuditTeam · AuditTeam is a small ransomware group with approximately 5 known victims, primarily targeting organizations in East and Southeast Asia across technology and manufacturing sectors, operating a data …'>AuditTeam</a>","discovered":"2026-09-20T14:50:19.435450+00:00","country":"IT","country_flag":"<a href='/country/it/' title='Ransomware victims in Italy'><span class='fi fi-it fis'></span> <span>IT</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/b5d1db4ab35b2587d7d6ee5ffa9b70d3.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://siddhigreen.com' rel='nofollow noopener noreferrer' target='_blank'>Siddhi Green Excellence Pvt. Ltd</a>","group_name":"<a href='/group/orova/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Orova · First seen 2026-07-07'>Orova</a>","discovered":"2026-09-20T14:21:12.939737+00:00","country":"IN","country_flag":"<a href='/country/in/' title='Ransomware victims in India'><span class='fi fi-in fis'></span> <span>IN</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/f88c598a3c4a0f19a326018ef69ce70e.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Energy & Utilities"},
{"post_title":"<a href='https://acilnet.com' rel='nofollow noopener noreferrer' target='_blank'>acilnet.com</a>","group_name":"<a href='/group/krybit/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/krybit · Krybit is an emerging RaaS group that launched in late March 2026, offering affiliates an 80/20 revenue split with support for Windows, Linux, ESXi, and NAS device encryption, and became notable fo…'>krybit</a>","discovered":"2026-09-20T14:11:58.952794+00:00","country":"TR","country_flag":"<a href='/country/tr/' title='Ransomware victims in Turkey'><span class='fi fi-tr fis'></span> <span>TR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/670ac9c8397c73f15ba7862a2b0c5a26.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://avilare.com' rel='nofollow noopener noreferrer' target='_blank'>Euramex Management Group</a>","group_name":"<a href='/group/orova/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Orova · First seen 2026-07-07'>Orova</a>","discovered":"2026-09-20T13:51:47.255355+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/cbcce569a88a9a476d4b7ed83d271d1f.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://www.zorlu.com' rel='nofollow noopener noreferrer' target='_blank'>Zorlu Holding</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-20T12:15:03.477485+00:00","country":"TR","country_flag":"<a href='/country/tr/' title='Ransomware victims in Turkey'><span class='fi fi-tr fis'></span> <span>TR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/66fa3f8451171985f225ef19823d1950.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://www.shopdunk.com' rel='nofollow noopener noreferrer' target='_blank'>ShopDunk</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-20T12:14:25.639076+00:00","country":"TH","country_flag":"<a href='/country/th/' title='Ransomware victims in Thailand'><span class='fi fi-th fis'></span> <span>TH</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/ae49679759af4524c3942c83a7847694.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://www.kmls.de' rel='nofollow noopener noreferrer' target='_blank'>KMLS</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-20T12:13:43.083355+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/5bf3005d273367c48505fa654eee1e58.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://www.tcs.ch' rel='nofollow noopener noreferrer' target='_blank'>Touring Club Suisse</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-20T12:13:05.737287+00:00","country":"CH","country_flag":"<a href='/country/ch/' title='Ransomware victims in Switzerland'><span class='fi fi-ch fis'></span> <span>CH</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e7d6c3ee924cf48f643848368ab3d41a.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Transportation"},
{"post_title":"<a href='https://costantinofavarato.it' rel='nofollow noopener noreferrer' target='_blank'>Studio Notarile Associato Salvatore Costantino E Anna Favarato</a>","group_name":"<a href='/group/emperador/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/emperador'>emperador</a>","discovered":"2026-09-20T09:35:30.781513+00:00","country":"IT","country_flag":"<a href='/country/it/' title='Ransomware victims in Italy'><span class='fi fi-it fis'></span> <span>IT</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/1a7e115d59cc65f4b2feb6765fb96a0d.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://greatbay-bio.com' rel='nofollow noopener noreferrer' target='_blank'>Great Bay Bio</a>","group_name":"<a href='/group/nightspire/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/nightspire · NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, In…'>nightspire</a>","discovered":"2026-09-20T06:40:26.051276+00:00","country":"HK","country_flag":"<a href='/country/hk/' title='Ransomware victims in Hong Kong'><span class='fi fi-hk fis'></span> <span>HK</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://www.towill.com' rel='nofollow noopener noreferrer' target='_blank'>TOWILL</a>","group_name":"<a href='/group/bravox/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/bravox · BravoX is a selective ransomware-as-a-service operation that surfaced publicly in January 2026 after advertising on the RAMP underground forum, targeting primarily US-based organizations in healthc…'>bravox</a>","discovered":"2026-09-20T06:24:14.282329+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/3d61640a78dcf448704ccd12bfcb47dc.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://fanatics.com' rel='nofollow noopener noreferrer' target='_blank'>Fanatics (global sports commerce platform)</a>","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-09-20T02:51:07.611792+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/eb4211112e60459b4d8270967ec93208.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"HEOLIS","group_name":"<a href='/group/zawoo/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/zawoo'>ZaWoo</a>","discovered":"2026-09-19T17:24:22.589187+00:00","country":"FR","country_flag":"<a href='/country/fr/' title='Ransomware victims in France'><span class='fi fi-fr fis'></span> <span>FR</span></a>","screenshot":"","activity":"Energy & Utilities"},
{"post_title":"FRANCARETRAD","group_name":"<a href='/group/zawoo/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/zawoo'>ZaWoo</a>","discovered":"2026-09-19T17:23:32.491474+00:00","country":"FR","country_flag":"<a href='/country/fr/' title='Ransomware victims in France'><span class='fi fi-fr fis'></span> <span>FR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/483f8e94a8c8583d498377f8dc70bef8.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"ambpvc","group_name":"<a href='/group/zawoo/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/zawoo'>ZaWoo</a>","discovered":"2026-09-19T17:22:42.282425+00:00","country":"FR","country_flag":"<a href='/country/fr/' title='Ransomware victims in France'><span class='fi fi-fr fis'></span> <span>FR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/5c7d0a95efbd1816fb089c6dc5ca19d5.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://scomputing.ca' rel='nofollow noopener noreferrer' target='_blank'>Schneider’s Computing</a>","group_name":"<a href='/group/arcusmedia/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/arcusmedia · Arcus Media is a ransomware-as-a-service group that emerged in May 2024, employing double extortion with ChaCha20 + RSA-2048 encryption and recruiting affiliates via a referral-based vetting proces…'>arcusmedia</a>","discovered":"2026-09-19T16:53:54.774549+00:00","country":"CA","country_flag":"<a href='/country/ca/' title='Ransomware victims in Canada'><span class='fi fi-ca fis'></span> <span>CA</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/cc19f111625acbab33a94b269ff342df.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://akazzo.com.br' rel='nofollow noopener noreferrer' target='_blank'>AKAZZO</a>","group_name":"<a href='/group/arcusmedia/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/arcusmedia · Arcus Media is a ransomware-as-a-service group that emerged in May 2024, employing double extortion with ChaCha20 + RSA-2048 encryption and recruiting affiliates via a referral-based vetting proces…'>arcusmedia</a>","discovered":"2026-09-19T16:53:14.452502+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/daa2872fa95b24c7f85b106d658b28b8.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://voltgames.io' rel='nofollow noopener noreferrer' target='_blank'>voltgames.io</a>","group_name":"<a href='/group/unsafe/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/unsafe · A group which seems to recycle leak from other ransomware groups'>unsafe</a>","discovered":"2026-09-19T16:20:33.854537+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/2038848f7265346314726324e3e68a68.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://electroluxgroup.com' rel='nofollow noopener noreferrer' target='_blank'>Electrolux</a>","group_name":"<a href='/group/emperador/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/emperador'>emperador</a>","discovered":"2026-09-19T15:50:53.665077+00:00","country":"SE","country_flag":"<a href='/country/se/' title='Ransomware victims in Sweden'><span class='fi fi-se fis'></span> <span>SE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/64f02caadca9086a4b41e9e6183ebb2e.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://kh-borken.de' rel='nofollow noopener noreferrer' target='_blank'>Kreishandwerkerschaft Borken</a>","group_name":"<a href='/group/rhysida/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/rhysida · Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets&#x27; networks and d…'>rhysida</a>","discovered":"2026-09-19T15:07:38.388719+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"","activity":"Professional Services"},
{"post_title":"Young Injury Law","group_name":"<a href='http://cryoblogedawivdcknyd4jsjxkrx3xrqqltxla6wwjjnzm3f3jaxjzqd.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/cry0 · Cry0 is a ransomware-as-a-service operation that recruits affiliates via underground forums, using a Rust-written payload with blockchain-based (Internet Computer Protocol) negotiation infrastructu…'>cry0</a>","discovered":"2026-09-19T13:25:01.672733+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Professional Services"},
{"post_title":"td***up","group_name":"<a href='/group/auditteam/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/AuditTeam · AuditTeam is a small ransomware group with approximately 5 known victims, primarily targeting organizations in East and Southeast Asia across technology and manufacturing sectors, operating a data …'>AuditTeam</a>","discovered":"2026-09-19T10:50:28.792216+00:00","country":"IT","country_flag":"<a href='/country/it/' title='Ransomware victims in Italy'><span class='fi fi-it fis'></span> <span>IT</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e2ab796dd9bdbe1d5c1ca1256a8c96e7.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://qnu.edu.vn' rel='nofollow noopener noreferrer' target='_blank'>Quy Nhon University</a>","group_name":"<a href='/group/vexy-ransomware/' title='aka vexy · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Vexy%20Ransomware'>Vexy Ransomware</a>","discovered":"2026-09-19T07:54:22.255428+00:00","country":"VN","country_flag":"<a href='/country/vn/' title='Ransomware victims in Vietnam'><span class='fi fi-vn fis'></span> <span>VN</span></a>","screenshot":"","activity":"Education"},
{"post_title":"<a href='https://cassia.mg.gov.br' rel='nofollow noopener noreferrer' target='_blank'>Cassias MG Government</a>","group_name":"<a href='/group/emperador/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/emperador'>emperador</a>","discovered":"2026-09-19T07:50:51.612488+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/c2021581f800c5b83882d43d78f29c6f.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Government & Defense"},
{"post_title":"<a href='https://questgroupsearch.com' rel='nofollow noopener noreferrer' target='_blank'>Quest Group</a>","group_name":"<a href='/group/anubis/' title='Chat (online) — needs Tor · Profile: https://www.ransomware.live/group/anubis · Anubis is a ransomware-as-a-service group active since December 2024 that targets healthcare, engineering, construction, and professional services sectors, offering affiliates a flexible revenue sp…'>anubis</a>","discovered":"2026-09-18T23:55:10.634158+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/50d09192e033a23bbac427d70f5d761c.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://k3gsolutions.com.br' rel='nofollow noopener noreferrer' target='_blank'>K3G Solutions Brazil</a>","group_name":"<a href='/group/panzer/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Panzer'>Panzer</a>","discovered":"2026-09-18T22:23:09.430695+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/abe341c9c909a7ab4e04e8e19df99db4.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://hygear.com' rel='nofollow noopener noreferrer' target='_blank'>hygear.com</a>","group_name":"<a href='/group/lockbit5/' title='Files (online) — needs Tor · Profile: https://www.ransomware.live/group/lockbit5 · LockBit 5.0 (&quot;ChuongDong&quot;) emerged in September 2025 as the group&#x27;s resurgence following the February 2024 law enforcement takedown, introducing cross-platform payloads targeting Windows, Linux, an…'>lockbit5</a>","discovered":"2026-09-18T21:49:22.248691+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/3c0939ac526e7a0955765958c4eb6e1c.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://forus.cl' rel='nofollow noopener noreferrer' target='_blank'>forus.cl</a>","group_name":"<a href='/group/lockbit5/' title='Files (online) — needs Tor · Profile: https://www.ransomware.live/group/lockbit5 · LockBit 5.0 (&quot;ChuongDong&quot;) emerged in September 2025 as the group&#x27;s resurgence following the February 2024 law enforcement takedown, introducing cross-platform payloads targeting Windows, Linux, an…'>lockbit5</a>","discovered":"2026-09-18T21:48:40.205034+00:00","country":"CL","country_flag":"<a href='/country/cl/' title='Ransomware victims in Chile'><span class='fi fi-cl fis'></span> <span>CL</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/83a2b43b1eb6e19da2c9075c02e8aaa7.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://www.vistahelps.com' rel='nofollow noopener noreferrer' target='_blank'>Vista Plastic Solutions</a>","group_name":"<a href='/group/play/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/play · Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite simil…'>play</a>","discovered":"2026-09-18T20:44:20.711951+00:00","country":"CA","country_flag":"<a href='/country/ca/' title='Ransomware victims in Canada'><span class='fi fi-ca fis'></span> <span>CA</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/868fe81372d2ae2bda43db356bb505ed.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://www.inglewoodgolfclub.ca' rel='nofollow noopener noreferrer' target='_blank'>Inglewood Golf</a>","group_name":"<a href='/group/play/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/play · Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite simil…'>play</a>","discovered":"2026-09-18T20:43:47.009719+00:00","country":"CA","country_flag":"<a href='/country/ca/' title='Ransomware victims in Canada'><span class='fi fi-ca fis'></span> <span>CA</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/8051a6065b2582c4b8d642991f8b83ca.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Hospitality"},
{"post_title":"<a href='https://www.barrettmahony.com' rel='nofollow noopener noreferrer' target='_blank'>Barrett Mahony Consulting Engineers</a>","group_name":"<a href='/group/play/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/play · Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite simil…'>play</a>","discovered":"2026-09-18T20:43:11.872555+00:00","country":"IE","country_flag":"<a href='/country/ie/' title='Ransomware victims in Ireland'><span class='fi fi-ie fis'></span> <span>IE</span></a>","screenshot":"","activity":"Professional Services"},
{"post_title":"<a href='https://pittsrad.net' rel='nofollow noopener noreferrer' target='_blank'>PITTSRAD</a>","group_name":"<a href='http://spiralstfe7rtbna7zlv6szdwmjvjszf2d64zkf6z5jykrwnw5jbgpyd.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Spirals'>Spirals</a>","discovered":"2026-09-18T20:24:29.068946+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://inter.com.ve' rel='nofollow noopener noreferrer' target='_blank'>Inter (Venezuela's largest internet provider)</a>","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-09-18T19:51:07.604510+00:00","country":"VE","country_flag":"<a href='/country/ve/' title='Ransomware victims in Venezuela'><span class='fi fi-ve fis'></span> <span>VE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/bc68bed920c5ed1b44ec27bc063c3582.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://premierlight.com' rel='nofollow noopener noreferrer' target='_blank'>Premier Lighting &amp; Controls</a>","group_name":"<a href='http://gammax6w3dkfdjfrjthtmqzsioue52vzy6lz54qy6jcvmogfpubutjyd.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Gammax'>Gammax</a>","discovered":"2026-09-18T17:52:03.699855+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://kit-e.jp' rel='nofollow noopener noreferrer' target='_blank'>kit-e.jp</a>","group_name":"<a href='/group/auditteam/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/AuditTeam · AuditTeam is a small ransomware group with approximately 5 known victims, primarily targeting organizations in East and Southeast Asia across technology and manufacturing sectors, operating a data …'>AuditTeam</a>","discovered":"2026-09-18T15:50:58.076527+00:00","country":"JP","country_flag":"<a href='/country/jp/' title='Ransomware victims in Japan'><span class='fi fi-jp fis'></span> <span>JP</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e904fa2e2f53da4feb0b5293db4ffe01.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"Paid Victim 192EB2B6AD7B98D9","group_name":"<a href='/group/auditteam/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/AuditTeam · AuditTeam is a small ransomware group with approximately 5 known victims, primarily targeting organizations in East and Southeast Asia across technology and manufacturing sectors, operating a data …'>AuditTeam</a>","discovered":"2026-09-18T15:50:21.961822+00:00","country":"RU","country_flag":"<a href='/country/ru/' title='Ransomware victims in Russia'><span class='fi fi-ru fis'></span> <span>RU</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/36bee1856fdf96af07b7be1482ffff84.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://www.prefix.com' rel='nofollow noopener noreferrer' target='_blank'>Prefix Corp</a>","group_name":"<a href='/group/securotrop/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/securotrop · Securotrop is a ransomware group established in early 2025 that operates within the Qilin affiliate network while maintaining an independent public identity, focusing exclusively on commercial targ…'>securotrop</a>","discovered":"2026-09-18T15:45:39.091519+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/803e55e296e455f81d0ab9e71f8387ab.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://transcom.com' rel='nofollow noopener noreferrer' target='_blank'>PayPal support operations (Transcom WorldWide)</a>","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-09-18T15:27:18.196030+00:00","country":"SE","country_flag":"<a href='/country/se/' title='Ransomware victims in Sweden'><span class='fi fi-se fis'></span> <span>SE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/58e32ed0c1c2b0fc6946da8719b87e95.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"<a href='https://argentina.gob.ar' rel='nofollow noopener noreferrer' target='_blank'>Ministry of Education — Argentina</a>","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-09-18T15:26:43.848015+00:00","country":"AR","country_flag":"<a href='/country/ar/' title='Ransomware victims in Argentina'><span class='fi fi-ar fis'></span> <span>AR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/eb18f7d348cd7bef92cb798bf883c42d.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Government & Defense"},
{"post_title":"<a href='https://argentemcreek.com' rel='nofollow noopener noreferrer' target='_blank'>Argentem Creek Partners (investment firm)</a>","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-09-18T15:26:08.569411+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/5300504d3bd946e1873c09c1221f7b15.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"<a href='https://astrazeneca.com.tr' rel='nofollow noopener noreferrer' target='_blank'>AstraZeneca Türkiye</a>","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-09-18T15:25:43.614300+00:00","country":"TR","country_flag":"<a href='/country/tr/' title='Ransomware victims in Turkey'><span class='fi fi-tr fis'></span> <span>TR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/ceb2ef216858eb491ab2685961e63906.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://stokr.io' rel='nofollow noopener noreferrer' target='_blank'>STOKR (digital securities platform)</a>","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-09-18T15:25:08.389430+00:00","country":"LU","country_flag":"<a href='/country/lu/' title='Ransomware victims in Luxembourg'><span class='fi fi-lu fis'></span> <span>LU</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/9239fe5ba509dd02a55b2f77ce6073b6.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"Konnatus (usucapião legal services)","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-09-18T15:24:33.536579+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/1e3cde325c01761f42b90725a6802754.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://beliteachers.com' rel='nofollow noopener noreferrer' target='_blank'>BeLi Teacher / FSC education centers (AWS)</a>","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-09-18T15:23:59.412779+00:00","country":"VN","country_flag":"<a href='/country/vn/' title='Ransomware victims in Vietnam'><span class='fi fi-vn fis'></span> <span>VN</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/8f8b1800b0ad33bd82a52d5e213ceef8.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Education"},
{"post_title":"Vietnamese betting operator (GC789 network / Boundless TE)","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-09-18T15:23:23.007025+00:00","country":"VN","country_flag":"<a href='/country/vn/' title='Ransomware victims in Vietnam'><span class='fi fi-vn fis'></span> <span>VN</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/b030ea31941779ae78da1006e0b75298.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://uft.org' rel='nofollow noopener noreferrer' target='_blank'>United Federation of Teachers</a>","group_name":"<a href='/group/n0n/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/N0n'>N0n</a>","discovered":"2026-09-18T15:22:48.612462+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/c9208d0402744c08eef5b9da802bcecf.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Education"},
{"post_title":"<a href='https://mpapharma.de' rel='nofollow noopener noreferrer' target='_blank'>MPA Pharma</a>","group_name":"<a href='/group/rhysida/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/rhysida · Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets&#x27; networks and d…'>rhysida</a>","discovered":"2026-09-18T13:48:49.890285+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/b36a81a2bdc8c574a7401ccf2a995ca7.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://anderson-industries.com' rel='nofollow noopener noreferrer' target='_blank'>Anderson Industries</a>","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-09-18T13:24:19.257383+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://www.roancampingholidays.com' rel='nofollow noopener noreferrer' target='_blank'>www.roancampingholidays.com</a>","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-09-18T12:42:56.146503+00:00","country":"NL","country_flag":"<a href='/country/nl/' title='Ransomware victims in Netherlands'><span class='fi fi-nl fis'></span> <span>NL</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/842b5c96fe3f714395c266a231075d65.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Hospitality"},
{"post_title":"<a href='https://www.kendallhunt.com' rel='nofollow noopener noreferrer' target='_blank'>www.kendallhunt.com</a>","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-09-18T12:42:19.468052+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/7ff1e9b5a8acf214bebf4b856433244c.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Education"},
{"post_title":"<a href='https://www.ascendcom.com.sg' rel='nofollow noopener noreferrer' target='_blank'>Ascend Com</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-18T10:12:12.276011+00:00","country":"SG","country_flag":"<a href='/country/sg/' title='Ransomware victims in Singapore'><span class='fi fi-sg fis'></span> <span>SG</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/118f1130f0aa16409dd507a2974b9978.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://www.cerestolvas.com.ar' rel='nofollow noopener noreferrer' target='_blank'>Ceres Tolvas</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-18T10:11:27.447248+00:00","country":"AR","country_flag":"<a href='/country/ar/' title='Ransomware victims in Argentina'><span class='fi fi-ar fis'></span> <span>AR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/cba6fd366d6b96645dcd4bbe324cbeb9.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Agriculture and Food Production"},
{"post_title":"<a href='https://www.futuroforestal.com' rel='nofollow noopener noreferrer' target='_blank'>Futuro Forestal</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-18T10:10:42.446298+00:00","country":"CL","country_flag":"<a href='/country/cl/' title='Ransomware victims in Chile'><span class='fi fi-cl fis'></span> <span>CL</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/4be20cbde8f09dc74ac3240c52cb014e.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Agriculture and Food Production"},
{"post_title":"<a href='https://www.grupojuste.com' rel='nofollow noopener noreferrer' target='_blank'>Grupo Juste</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-18T10:09:56.603763+00:00","country":"MX","country_flag":"<a href='/country/mx/' title='Ransomware victims in Mexico'><span class='fi fi-mx fis'></span> <span>MX</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/17090925ca7c9ad13f6c7dac19592a42.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://www.iocltt.com' rel='nofollow noopener noreferrer' target='_blank'>Inland and Offshore Contractors</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-18T10:09:09.954520+00:00","country":"TT","country_flag":"<a href='/country/tt/' title='Ransomware victims in Trinidad and Tobago'><span class='fi fi-tt fis'></span> <span>TT</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/cabc6e90d1a4fd4f289b679d1de052fb.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Energy & Utilities"},
{"post_title":"<a href='https://americancastingco.com' rel='nofollow noopener noreferrer' target='_blank'>American Casting Company</a>","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-09-18T07:51:54.315828+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/f134ba8a81f5e6768ecbbddd5b004e9f.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://johnsoninv.com' rel='nofollow noopener noreferrer' target='_blank'>Johnson Investment Counsel</a>","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-09-18T07:51:22.892150+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/0e88747c5643d0975e408f366c321b29.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"<a href='https://1stsecurebank.com' rel='nofollow noopener noreferrer' target='_blank'>First Secure Community Bank</a>","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-09-18T07:50:52.053135+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/9091582f2a6662b5e8ca9f96048754f4.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"<a href='https://thestatebankgroup.com' rel='nofollow noopener noreferrer' target='_blank'>The State Bank</a>","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-09-18T07:50:21.637759+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/15361f30ca64e86753b45a9881ebfe93.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"<a href='https://firstsecurebank.com' rel='nofollow noopener noreferrer' target='_blank'>First Secure Bank and Trust</a>","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-09-18T07:49:50.710298+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/250dd4dc6556d9cb7308bc359fb6cc84.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"<a href='https://Accela.com' rel='nofollow noopener noreferrer' target='_blank'>Accela.com</a>","group_name":"<a href='http://endzonezgz3sqzmtqg4acp4z7ao7xc6vunfhezjsnfqrm2ksudsredyd.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/EndZone'>EndZone</a>","discovered":"2026-09-18T07:06:41.424685+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Government & Defense"},
{"post_title":"<a href='https://att.com' rel='nofollow noopener noreferrer' target='_blank'>AT&amp;T</a>","group_name":"<a href='http://endzonezgz3sqzmtqg4acp4z7ao7xc6vunfhezjsnfqrm2ksudsredyd.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/EndZone'>EndZone</a>","discovered":"2026-09-18T07:06:21.557117+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Technology"},
{"post_title":"<a href='https://www.anythingit.com' rel='nofollow noopener noreferrer' target='_blank'>ANYTHINGIT</a>","group_name":"<a href='http://spiralstfe7rtbna7zlv6szdwmjvjszf2d64zkf6z5jykrwnw5jbgpyd.onion' rel='nofollow noopener noreferrer' target='_blank' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Spirals'>Spirals</a>","discovered":"2026-09-18T07:03:21.102539+00:00","country":"","country_flag":"","screenshot":"","activity":"Technology"},
{"post_title":"<a href='https://giti-corp.com' rel='nofollow noopener noreferrer' target='_blank'>Giti Corp</a>","group_name":"<a href='/group/killsec/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/killsec · KillSec originated as a hacktivist group aligned with the Anonymous movement before pivoting to ransomware operations in October 2023, officially launching a RaaS platform in June 2024 with an affi…'>killsec</a>","discovered":"2026-09-18T02:02:22.189825+00:00","country":"SG","country_flag":"<a href='/country/sg/' title='Ransomware victims in Singapore'><span class='fi fi-sg fis'></span> <span>SG</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://uni-hamburg.de' rel='nofollow noopener noreferrer' target='_blank'>Universitt Hamburg</a>","group_name":"<a href='/group/panzer/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Panzer'>Panzer</a>","discovered":"2026-09-18T00:23:38.112427+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/2e92305cf48a74a8c3daf76abd722aa6.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Education"},
{"post_title":"<a href='https://inovapy.com' rel='nofollow noopener noreferrer' target='_blank'>Inovapy</a>","group_name":"<a href='/group/panzer/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Panzer'>Panzer</a>","discovered":"2026-09-18T00:23:07.460324+00:00","country":"PY","country_flag":"<a href='/country/py/' title='Ransomware victims in Paraguay'><span class='fi fi-py fis'></span> <span>PY</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/db41740b2faf3a9f4601807a12dd0878.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://stim.fr' rel='nofollow noopener noreferrer' target='_blank'>Stim</a>","group_name":"<a href='/group/panzer/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Panzer'>Panzer</a>","discovered":"2026-09-18T00:22:35.462541+00:00","country":"FR","country_flag":"<a href='/country/fr/' title='Ransomware victims in France'><span class='fi fi-fr fis'></span> <span>FR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e3f35a31d0049595a9a85a00f653f2b6.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"C...","group_name":"<a href='/group/silentransomgroup/' title='aka Luna Moth · DLS (online) · Profile: https://www.ransomware.live/group/silentransomgroup · A former Conti team'>SilentRansomGroup</a>","discovered":"2026-09-17T22:54:46.483222+00:00","country":"","country_flag":"","screenshot":"","activity":"Not Found"},
{"post_title":"<a href='https://www.harputyapi.com' rel='nofollow noopener noreferrer' target='_blank'>www.harputyapi.com</a>","group_name":"<a href='/group/krybit/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/krybit · Krybit is an emerging RaaS group that launched in late March 2026, offering affiliates an 80/20 revenue split with support for Windows, Linux, ESXi, and NAS device encryption, and became notable fo…'>krybit</a>","discovered":"2026-09-17T22:31:56.163903+00:00","country":"TR","country_flag":"<a href='/country/tr/' title='Ransomware victims in Turkey'><span class='fi fi-tr fis'></span> <span>TR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/3f9de9392d8c320267bedd8d9136ab4f.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://www.diakonie-apolda.de' rel='nofollow noopener noreferrer' target='_blank'>www.diakonie-apolda.de</a>","group_name":"<a href='/group/krybit/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/krybit · Krybit is an emerging RaaS group that launched in late March 2026, offering affiliates an 80/20 revenue split with support for Windows, Linux, ESXi, and NAS device encryption, and became notable fo…'>krybit</a>","discovered":"2026-09-17T22:31:17.184459+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/85e33dfd72862cafa33bb59bca3d2ea5.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://www.vigatec.com' rel='nofollow noopener noreferrer' target='_blank'>Vigatec</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-17T20:58:39.918548+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/31d2e9a55a31a0164a5c37bcd4531619.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://www.invinciblegg.com' rel='nofollow noopener noreferrer' target='_blank'>Invincible GG</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-17T19:03:55.192442+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/b670327272a2967edbaeec82085150bd.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://expresspros.com' rel='nofollow noopener noreferrer' target='_blank'>expresspros.com</a>","group_name":"<a href='/group/chaos/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/chaos · Chaos is a ransomware-as-a-service operation that emerged in early 2025, likely formed by former BlackSuit/Royal members, offering cross-platform ransomware for Windows, Linux, ESXi, and NAS to aff…'>chaos</a>","discovered":"2026-09-17T16:25:49.137734+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e82248c85b0413bef834248e84495f19.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://hoyletanner.com' rel='nofollow noopener noreferrer' target='_blank'>hoyletanner.com</a>","group_name":"<a href='/group/braincipher/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/BrainCipher · Brain Cipher emerged in July 2024. Both Windows and Linux variants are available. Brain Cipher using the leaked build of LockBit Black for their operations. The group suspected to have exploited CV…'>BrainCipher</a>","discovered":"2026-09-17T16:21:16.157857+00:00","country":"GB","country_flag":"<a href='/country/gb/' title='Ransomware victims in United Kingdom'><span class='fi fi-gb fis'></span> <span>GB</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/c4700684775d8cdb3370640650d330ac.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://aecom.com' rel='nofollow noopener noreferrer' target='_blank'>aecom.com</a>","group_name":"<a href='/group/braincipher/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/BrainCipher · Brain Cipher emerged in July 2024. Both Windows and Linux variants are available. Brain Cipher using the leaked build of LockBit Black for their operations. The group suspected to have exploited CV…'>BrainCipher</a>","discovered":"2026-09-17T16:20:40.449862+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/f63ab3013cc127108dd6d5a4b028db52.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://www.techwise.com.ar' rel='nofollow noopener noreferrer' target='_blank'>Techwise</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-17T16:03:05.744131+00:00","country":"AR","country_flag":"<a href='/country/ar/' title='Ransomware victims in Argentina'><span class='fi fi-ar fis'></span> <span>AR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/5db1c28741d959d9760776c5532aa633.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://www.granhotelingles.com' rel='nofollow noopener noreferrer' target='_blank'>The Gran Hotel Ingles</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-17T16:02:26.222726+00:00","country":"ES","country_flag":"<a href='/country/es/' title='Ransomware victims in Spain'><span class='fi fi-es fis'></span> <span>ES</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/69372cd42c5efd51c2898e0afaf753a0.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Hospitality"},
{"post_title":"<a href='https://rottner-tresor.at' rel='nofollow noopener noreferrer' target='_blank'>rottner-tresor.at</a>","group_name":"<a href='/group/settra/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/settra'>settra</a>","discovered":"2026-09-17T15:32:36.876686+00:00","country":"AT","country_flag":"<a href='/country/at/' title='Ransomware victims in Austria'><span class='fi fi-at fis'></span> <span>AT</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/9d9049eb18799b653fd8812f74515e66.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://naturesplus.com' rel='nofollow noopener noreferrer' target='_blank'>naturesplus.com</a>","group_name":"<a href='/group/settra/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/settra'>settra</a>","discovered":"2026-09-17T15:32:04.685966+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/cd9705d59a0e2142836ed7b6195ffce7.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://pacificabs.com' rel='nofollow noopener noreferrer' target='_blank'>pacificabs.com</a>","group_name":"<a href='/group/settra/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/settra'>settra</a>","discovered":"2026-09-17T15:31:31.563751+00:00","country":"AU","country_flag":"<a href='/country/au/' title='Ransomware victims in Australia'><span class='fi fi-au fis'></span> <span>AU</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e3c1fb259e5deddd5f7645785032c971.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://fchhotels.com' rel='nofollow noopener noreferrer' target='_blank'>fchhotels.com</a>","group_name":"<a href='/group/settra/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/settra'>settra</a>","discovered":"2026-09-17T15:30:58.748100+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/f4a6fb67efc9028f7c97179238c4929d.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Hospitality"},
{"post_title":"<a href='https://budgetms.com' rel='nofollow noopener noreferrer' target='_blank'>budgetms.com</a>","group_name":"<a href='/group/settra/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/settra'>settra</a>","discovered":"2026-09-17T15:30:26.520659+00:00","country":"MS","country_flag":"<span class='fi fi-ms fis'></span> <span>MS</span>","screenshot":"<a href='https://images.ransomware.live/victims/bb309d2e4e7a80846edaadf54e6fcc04.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"<a href='https://sym.com.mx' rel='nofollow noopener noreferrer' target='_blank'>sym.com.mx</a>","group_name":"<a href='/group/settra/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/settra'>settra</a>","discovered":"2026-09-17T15:29:52.062745+00:00","country":"MX","country_flag":"<a href='/country/mx/' title='Ransomware victims in Mexico'><span class='fi fi-mx fis'></span> <span>MX</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/8e7e889e9634a5a34c4969ce65c22032.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://xpera.ca' rel='nofollow noopener noreferrer' target='_blank'>xpera.ca</a>","group_name":"<a href='/group/braincipher/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/BrainCipher · Brain Cipher emerged in July 2024. Both Windows and Linux variants are available. Brain Cipher using the leaked build of LockBit Black for their operations. The group suspected to have exploited CV…'>BrainCipher</a>","discovered":"2026-09-17T15:21:08.683727+00:00","country":"CA","country_flag":"<a href='/country/ca/' title='Ransomware victims in Canada'><span class='fi fi-ca fis'></span> <span>CA</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/c12019ca85614f5b5414970c207c6a21.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://pertamina.com' rel='nofollow noopener noreferrer' target='_blank'>Pertamina</a>","group_name":"<a href='/group/ransomhouse/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/ransomhouse · RansomHouse is a double-extortion RaaS operation active since late 2021, attributed to the threat actor &quot;Jolly Scorpius,&quot; targeting over 120 organizations across healthcare, finance, transportation…'>ransomhouse</a>","discovered":"2026-09-17T14:31:55.173448+00:00","country":"ID","country_flag":"<a href='/country/id/' title='Ransomware victims in Indonesia'><span class='fi fi-id fis'></span> <span>ID</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/286b36d5ff70b33ee99d6347c057046e.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Energy & Utilities"},
{"post_title":"<a href='https://sis.com' rel='nofollow noopener noreferrer' target='_blank'>Silicon Integrated Systems</a>","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-09-17T14:27:16.493402+00:00","country":"TW","country_flag":"<a href='/country/tw/' title='Ransomware victims in Taiwan'><span class='fi fi-tw fis'></span> <span>TW</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/47dea4c4858d684bce0d385b9796a04f.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://maximizedrevenue.com' rel='nofollow noopener noreferrer' target='_blank'>Practice Management (maximizedrevenue.com)</a>","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-09-17T13:52:14.523659+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Professional Services"},
{"post_title":"<a href='https://vetta.digital' rel='nofollow noopener noreferrer' target='_blank'>Vetta</a>","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-09-17T13:24:13.577335+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"","activity":"Technology"},
{"post_title":"<a href='https://javepchevrolet.com.br' rel='nofollow noopener noreferrer' target='_blank'>Javep Chevrolet</a>","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-09-17T13:23:54.271641+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://www.beckmancoulter.com' rel='nofollow noopener noreferrer' target='_blank'>Beckman Coulter, Inc</a>","group_name":"<a href='/group/metaencryptor/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/metaencryptor · MetaEncryptor is a ransomware group first observed in mid-2023, targeting medium-to-large enterprises in legal, technology, logistics, manufacturing, and finance sectors primarily in the UK, Europe…'>metaencryptor</a>","discovered":"2026-09-17T13:06:14.342679+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/bee3005a113720ec4ee9247dfb9330c8.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://aecom.com' rel='nofollow noopener noreferrer' target='_blank'>AECOM</a>","group_name":"<a href='/group/metaencryptor/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/metaencryptor · MetaEncryptor is a ransomware group first observed in mid-2023, targeting medium-to-large enterprises in legal, technology, logistics, manufacturing, and finance sectors primarily in the UK, Europe…'>metaencryptor</a>","discovered":"2026-09-17T13:05:28.259842+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/1e7ecb18453d1bf6e3f5c5ed43242028.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://promantra.us' rel='nofollow noopener noreferrer' target='_blank'>Promantra, Inc</a>","group_name":"<a href='/group/metaencryptor/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/metaencryptor · MetaEncryptor is a ransomware group first observed in mid-2023, targeting medium-to-large enterprises in legal, technology, logistics, manufacturing, and finance sectors primarily in the UK, Europe…'>metaencryptor</a>","discovered":"2026-09-17T13:04:44.711719+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Technology"},
{"post_title":"<a href='https://stpfashionlab.it' rel='nofollow noopener noreferrer' target='_blank'>STP Fashion Lab</a>","group_name":"<a href='/group/vexy-ransomware/' title='aka vexy · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Vexy%20Ransomware'>Vexy Ransomware</a>","discovered":"2026-09-17T09:51:37.319780+00:00","country":"IT","country_flag":"<a href='/country/it/' title='Ransomware victims in Italy'><span class='fi fi-it fis'></span> <span>IT</span></a>","screenshot":"","activity":"Retail & E-Commerce"},
{"post_title":"Westbridge Institute of Technology, Inc.","group_name":"<a href='/group/emperador/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/emperador'>emperador</a>","discovered":"2026-09-17T09:20:37.646173+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/7a5dc57b093bf01e6abf006f41a658bf.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Education"},
{"post_title":"<a href='https://www.appliancefactory.com' rel='nofollow noopener noreferrer' target='_blank'>www.appliancefactory.com</a>","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-09-17T07:25:33.093862+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e9beb4c39472d4ff6512335799299247.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://www.diarco.com.ar' rel='nofollow noopener noreferrer' target='_blank'>www.diarco.com.ar</a>","group_name":"<a href='/group/incransom/' title='aka Inc Ransom · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/incransom · INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europ…'>incransom</a>","discovered":"2026-09-17T07:24:58.489284+00:00","country":"AR","country_flag":"<a href='/country/ar/' title='Ransomware victims in Argentina'><span class='fi fi-ar fis'></span> <span>AR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/ff96c8f32f2cde22f00af73326ffc8a7.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"Qi****","group_name":"<a href='/group/shinyhunters/' title='DLS (online) · Profile: https://www.ransomware.live/group/shinyhunters · ShinyHunters is a financially motivated data-theft and extortion group active since 2020, responsible for high-profile breaches including Ticketmaster (via Snowflake) and PowerSchool; by 2025 they …'>shinyhunters</a>","discovered":"2026-09-17T01:28:52.351958+00:00","country":"","country_flag":"","screenshot":"","activity":"Not Found"},
{"post_title":"<a href='https://new.handytrac.com' rel='nofollow noopener noreferrer' target='_blank'>HandyTrac Greystar AZ WARNING</a>","group_name":"<a href='/group/shadowbyt3/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/ShadowByt3%24 · ShadowByt3$ is a ransomware-as-a-service group first observed in October 2025, using multi-method extortion and communicating via Telegram and Tox, with a very small confirmed victim list suggestin…'>ShadowByt3$</a>","discovered":"2026-09-16T21:53:11.343671+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/5acd5db6df9f20f498252241f798169a.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://rda-stellantis.it' rel='nofollow noopener noreferrer' target='_blank'>RDA MOTORS S.P.A.</a>","group_name":"<a href='/group/emperador/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/emperador'>emperador</a>","discovered":"2026-09-16T20:50:58.426399+00:00","country":"IT","country_flag":"<a href='/country/it/' title='Ransomware victims in Italy'><span class='fi fi-it fis'></span> <span>IT</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/50858e8ea313ad0692366423611f1031.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"Optimum First Mortgage (Pear's acting group's promotional blog)","group_name":"<a href='/group/blacknevas/' title='aka Trial Recovery · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/blacknevas · BlackNevas is a ransomware group first observed in November 2024, believed to be derived from the Trigona ransomware family, targeting telecommunications, manufacturing, medical, and legal industri…'>blacknevas</a>","discovered":"2026-09-16T19:54:07.070553+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/d9d8b3f0a648cdd61667fa6b2af4634b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"<a href='https://7oaks.cz' rel='nofollow noopener noreferrer' target='_blank'>SEVENOAKS s.r.o.</a>","group_name":"<a href='/group/emperador/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/emperador'>emperador</a>","discovered":"2026-09-16T18:54:25.922000+00:00","country":"CZ","country_flag":"<a href='/country/cz/' title='Ransomware victims in Czechia'><span class='fi fi-cz fis'></span> <span>CZ</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/89ddd071dc5042151a624e34d601e7c9.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://palletshop.ru' rel='nofollow noopener noreferrer' target='_blank'>palletshop</a>","group_name":"<a href='/group/auditteam/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/AuditTeam · AuditTeam is a small ransomware group with approximately 5 known victims, primarily targeting organizations in East and Southeast Asia across technology and manufacturing sectors, operating a data …'>AuditTeam</a>","discovered":"2026-09-16T18:22:57.742737+00:00","country":"RU","country_flag":"<a href='/country/ru/' title='Ransomware victims in Russia'><span class='fi fi-ru fis'></span> <span>RU</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/78b3ae65f7b429b151d99ec64264934f.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://wiseit.com.ua' rel='nofollow noopener noreferrer' target='_blank'>Wise IT</a>","group_name":"<a href='/group/auditteam/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/AuditTeam · AuditTeam is a small ransomware group with approximately 5 known victims, primarily targeting organizations in East and Southeast Asia across technology and manufacturing sectors, operating a data …'>AuditTeam</a>","discovered":"2026-09-16T18:22:34.502968+00:00","country":"UA","country_flag":"<span class='fi fi-ua fis'></span> <span>UA</span>","screenshot":"<a href='https://images.ransomware.live/victims/41d5ac66d4cf12675c402e717f7bbaab.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://buben.it' rel='nofollow noopener noreferrer' target='_blank'>buben</a>","group_name":"<a href='/group/auditteam/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/AuditTeam · AuditTeam is a small ransomware group with approximately 5 known victims, primarily targeting organizations in East and Southeast Asia across technology and manufacturing sectors, operating a data …'>AuditTeam</a>","discovered":"2026-09-16T18:22:08.730296+00:00","country":"IT","country_flag":"<a href='/country/it/' title='Ransomware victims in Italy'><span class='fi fi-it fis'></span> <span>IT</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/ce23529eff53de7943c2333e298ca0d8.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://dg.ac.kr' rel='nofollow noopener noreferrer' target='_blank'>dg.ac.kr</a>","group_name":"<a href='/group/auditteam/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/AuditTeam · AuditTeam is a small ransomware group with approximately 5 known victims, primarily targeting organizations in East and Southeast Asia across technology and manufacturing sectors, operating a data …'>AuditTeam</a>","discovered":"2026-09-16T18:21:45.296077+00:00","country":"KR","country_flag":"<a href='/country/kr/' title='Ransomware victims in South Korea'><span class='fi fi-kr fis'></span> <span>KR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/5a67ed6c7cc8515b22de7de1525be675.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Education"},
{"post_title":"<a href='https://gownet.net' rel='nofollow noopener noreferrer' target='_blank'>gownet.net</a>","group_name":"<a href='/group/auditteam/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/AuditTeam · AuditTeam is a small ransomware group with approximately 5 known victims, primarily targeting organizations in East and Southeast Asia across technology and manufacturing sectors, operating a data …'>AuditTeam</a>","discovered":"2026-09-16T18:21:20.232642+00:00","country":"KR","country_flag":"<a href='/country/kr/' title='Ransomware victims in South Korea'><span class='fi fi-kr fis'></span> <span>KR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/242923cb31e750aeabe6388601c40d30.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://krimax.org' rel='nofollow noopener noreferrer' target='_blank'>krimax.org</a>","group_name":"<a href='/group/auditteam/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/AuditTeam · AuditTeam is a small ransomware group with approximately 5 known victims, primarily targeting organizations in East and Southeast Asia across technology and manufacturing sectors, operating a data …'>AuditTeam</a>","discovered":"2026-09-16T18:20:54.551776+00:00","country":"AR","country_flag":"<a href='/country/ar/' title='Ransomware victims in Argentina'><span class='fi fi-ar fis'></span> <span>AR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/7055a168859595166c9e15f931704d54.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"Leisure Coast Kitchens","group_name":"<a href='/group/kairos/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/kairos · Kairos is a data extortion group active since late 2024 that focuses solely on data theft with no encryption, primarily targeting small-to-mid-sized organizations in healthcare, manufacturing, and …'>kairos</a>","discovered":"2026-09-16T17:57:09.232092+00:00","country":"AU","country_flag":"<a href='/country/au/' title='Ransomware victims in Australia'><span class='fi fi-au fis'></span> <span>AU</span></a>","screenshot":"","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://www.reddrop.com.au' rel='nofollow noopener noreferrer' target='_blank'>Reddrop Group</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-16T17:02:52.900583+00:00","country":"AU","country_flag":"<a href='/country/au/' title='Ransomware victims in Australia'><span class='fi fi-au fis'></span> <span>AU</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/97f87027600d0574ffbddbd697df2d2c.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://www.inthecompanyofhuskies.com' rel='nofollow noopener noreferrer' target='_blank'>In The Company of Huskies</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-16T17:02:23.386174+00:00","country":"CA","country_flag":"<a href='/country/ca/' title='Ransomware victims in Canada'><span class='fi fi-ca fis'></span> <span>CA</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/47280a6f3315c7a58d14ae5f0bbbdab9.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"Odyssey Charter School, Inc.","group_name":"<a href='/group/wallstreet/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Wallstreet'>Wallstreet</a>","discovered":"2026-09-16T16:22:21.437082+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Education"},
{"post_title":"Roshd Sanat","group_name":"<a href='/group/wallstreet/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Wallstreet'>Wallstreet</a>","discovered":"2026-09-16T16:22:09.883088+00:00","country":"IR","country_flag":"<a href='/country/ir/' title='Ransomware victims in Iran'><span class='fi fi-ir fis'></span> <span>IR</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://www.mod.gov.na' rel='nofollow noopener noreferrer' target='_blank'>Namibian Defence Force</a>","group_name":"<a href='/group/ransomhouse/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/ransomhouse · RansomHouse is a double-extortion RaaS operation active since late 2021, attributed to the threat actor &quot;Jolly Scorpius,&quot; targeting over 120 organizations across healthcare, finance, transportation…'>ransomhouse</a>","discovered":"2026-09-16T15:32:23.584466+00:00","country":"NA","country_flag":"<a href='/country/na/' title='Ransomware victims in Namibia'><span class='fi fi-na fis'></span> <span>NA</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/fdd391bf70cdabb78d3b659664c2336d.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Government & Defense"},
{"post_title":"<a href='https://www.thorndale.com.au' rel='nofollow noopener noreferrer' target='_blank'>Thorndale Foundation</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-16T15:05:57.178270+00:00","country":"AU","country_flag":"<a href='/country/au/' title='Ransomware victims in Australia'><span class='fi fi-au fis'></span> <span>AU</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/ae5755a2c6be7916fa69ff9b90fc0a90.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://www.thema-foundries.com' rel='nofollow noopener noreferrer' target='_blank'>Thema Foundries</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-16T15:05:26.483528+00:00","country":"FR","country_flag":"<a href='/country/fr/' title='Ransomware victims in France'><span class='fi fi-fr fis'></span> <span>FR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/bf65564dedf888181150f08df8346d16.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"Blossomland Accounting","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-09-16T14:54:53.767236+00:00","country":"","country_flag":"","screenshot":"","activity":"Professional Services"},
{"post_title":"Bee Maid Honey","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-09-16T14:54:41.649240+00:00","country":"CA","country_flag":"<a href='/country/ca/' title='Ransomware victims in Canada'><span class='fi fi-ca fis'></span> <span>CA</span></a>","screenshot":"","activity":"Agriculture and Food Production"},
{"post_title":"Manders","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-09-16T14:23:12.995518+00:00","country":"GB","country_flag":"<a href='/country/gb/' title='Ransomware victims in United Kingdom'><span class='fi fi-gb fis'></span> <span>GB</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"ARDA","group_name":"<a href='/group/arcusmedia/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/arcusmedia · Arcus Media is a ransomware-as-a-service group that emerged in May 2024, employing double extortion with ChaCha20 + RSA-2048 encryption and recruiting affiliates via a referral-based vetting proces…'>arcusmedia</a>","discovered":"2026-09-16T13:53:57.333588+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/f9969d01f2ea0922baca116ead0de0af.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Government & Defense"},
{"post_title":"Nielsen Design","group_name":"<a href='/group/panzer/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Panzer'>Panzer</a>","discovered":"2026-09-16T13:22:39.132189+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/1353057f8888d31b4ea7fae81b148772.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://www.aarsleff.se' rel='nofollow noopener noreferrer' target='_blank'>Aarsleff</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-16T04:01:03.907051+00:00","country":"SE","country_flag":"<a href='/country/se/' title='Ransomware victims in Sweden'><span class='fi fi-se fis'></span> <span>SE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/36adf15f0acef57b82df3e597fc67a46.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://cpm1.com' rel='nofollow noopener noreferrer' target='_blank'>Community Property Management</a>","group_name":"<a href='/group/dragonforce/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/dragonforce · DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a &quot;ransomware cartel&quot; i…'>dragonforce</a>","discovered":"2026-09-16T03:55:01.189986+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/9454f01de383ca12d3bdf5436901426d.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://owenleighoptometry.co.uk' rel='nofollow noopener noreferrer' target='_blank'>Owen Leigh Optometry</a>","group_name":"<a href='/group/dragonforce/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/dragonforce · DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a &quot;ransomware cartel&quot; i…'>dragonforce</a>","discovered":"2026-09-16T03:54:08.705686+00:00","country":"GB","country_flag":"<a href='/country/gb/' title='Ransomware victims in United Kingdom'><span class='fi fi-gb fis'></span> <span>GB</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/309ff6f687de6532ccdb144d0f0f6a44.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://aoa21.com' rel='nofollow noopener noreferrer' target='_blank'>Hashimoto Jimuki</a>","group_name":"<a href='/group/vexy-ransomware/' title='aka vexy · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Vexy%20Ransomware'>Vexy Ransomware</a>","discovered":"2026-09-15T19:58:08.769486+00:00","country":"JP","country_flag":"<a href='/country/jp/' title='Ransomware victims in Japan'><span class='fi fi-jp fis'></span> <span>JP</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://marlinhvac.com' rel='nofollow noopener noreferrer' target='_blank'>marlinhvac.com</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-09-15T19:33:37.459652+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/09995c4266a99f4c051c18b457a96458.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://neumerkel-gmbh.de' rel='nofollow noopener noreferrer' target='_blank'>neumerkel-gmbh.de</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-09-15T19:33:01.897687+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/a6497a51cdd623873dd369e5e3430f9b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://triniticaring.org' rel='nofollow noopener noreferrer' target='_blank'>triniticaring.org</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-09-15T19:32:29.559176+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/665cf32cb166dcada4e655b885aa616f.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://laconcepcion.com.mx' rel='nofollow noopener noreferrer' target='_blank'>laconcepcion.com.mx</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-09-15T19:31:55.620235+00:00","country":"MX","country_flag":"<a href='/country/mx/' title='Ransomware victims in Mexico'><span class='fi fi-mx fis'></span> <span>MX</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/998d83a126ef918196df0f32e48b4d07.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://meterex.com' rel='nofollow noopener noreferrer' target='_blank'>meterex.com</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-09-15T19:31:20.079261+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/a5ddcc37acfd4d886da41d15b52343a9.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://stoecklin-kuechen.ch' rel='nofollow noopener noreferrer' target='_blank'>stoecklin-kuechen.ch</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-09-15T19:30:46.777907+00:00","country":"CH","country_flag":"<a href='/country/ch/' title='Ransomware victims in Switzerland'><span class='fi fi-ch fis'></span> <span>CH</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/247552084be090998f9675f7e8a17c4b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://ryomo.co.jp' rel='nofollow noopener noreferrer' target='_blank'>ryomo.co.jp</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-09-15T19:30:13.792277+00:00","country":"JP","country_flag":"<a href='/country/jp/' title='Ransomware victims in Japan'><span class='fi fi-jp fis'></span> <span>JP</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/a68abfb8add7faa1fd0b2289b49be48e.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://ara-lyss.ch' rel='nofollow noopener noreferrer' target='_blank'>ara-lyss.ch</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-09-15T19:29:39.873697+00:00","country":"CH","country_flag":"<a href='/country/ch/' title='Ransomware victims in Switzerland'><span class='fi fi-ch fis'></span> <span>CH</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/6935c2a554612b5676fe04d61fc89774.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://gob.pe' rel='nofollow noopener noreferrer' target='_blank'>gob.pe</a>","group_name":"<a href='/group/safepay/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/safepay · SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid…'>safepay</a>","discovered":"2026-09-15T19:29:06.619312+00:00","country":"PE","country_flag":"<a href='/country/pe/' title='Ransomware victims in Peru'><span class='fi fi-pe fis'></span> <span>PE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/6e442ad72c3ab567ac84f9b2eba01f8d.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Government & Defense"},
{"post_title":"<a href='https://springfieldpublicschools.com' rel='nofollow noopener noreferrer' target='_blank'>Springfield Public Schools</a>","group_name":"<a href='/group/interlock/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/interlock · Interlock is a ransomware group first observed in September 2024 that targets critical infrastructure sectors including healthcare, government, education, and technology across North America and Eu…'>interlock</a>","discovered":"2026-09-15T18:58:09.416791+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e2eb3ec3dcd250d93c4704450c1daf43.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Education"},
{"post_title":"<a href='https://www.wigginschilds.com' rel='nofollow noopener noreferrer' target='_blank'>Wiggins, Childs, Pantazis, Fisher, &amp; Goldfarb LLC</a>","group_name":"<a href='/group/insomnia/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/insomnia · Insomnia is a data-theft and extortion group that emerged in October 2025, targeting primarily US-based healthcare organizations — stealing patient files and threatening public exposure rather than…'>insomnia</a>","discovered":"2026-09-15T17:30:14.921178+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/16a2a3d8df9467d07f496627552f176b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://fortsmithar.gov' rel='nofollow noopener noreferrer' target='_blank'>City of Fort Smith Arkansas</a>","group_name":"<a href='/group/interlock/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/interlock · Interlock is a ransomware group first observed in September 2024 that targets critical infrastructure sectors including healthcare, government, education, and technology across North America and Eu…'>interlock</a>","discovered":"2026-09-15T15:31:16.639907+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/014af34f30f01937e79538793ce3f4f7.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Government & Defense"},
{"post_title":"<a href='https://www.cumar.com' rel='nofollow noopener noreferrer' target='_blank'>Cumar Marble &amp; Granite</a>","group_name":"<a href='/group/dark-project/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Dark%20Project · Dark Project is a newly emerged ransomware leak operation active as of August 2026. The group utilizes a double extortion model (stealing sensitive data before encrypting local systems and threaten…'>Dark Project</a>","discovered":"2026-09-15T15:21:02.888784+00:00","country":"TR","country_flag":"<a href='/country/tr/' title='Ransomware victims in Turkey'><span class='fi fi-tr fis'></span> <span>TR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/8db11dbdc6e23c011971ef8a2786090c.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://www.taurusiberica.com' rel='nofollow noopener noreferrer' target='_blank'>Taurus Ibérica</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-15T15:01:54.994110+00:00","country":"ES","country_flag":"<a href='/country/es/' title='Ransomware victims in Spain'><span class='fi fi-es fis'></span> <span>ES</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/94e09348b55eda2894a99f11bd6895ec.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"Pilot Precision","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-09-15T14:53:24.483482+00:00","country":"","country_flag":"","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://lazyboyz.no' rel='nofollow noopener noreferrer' target='_blank'>Lazyboyz</a>","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-09-15T14:22:06.844241+00:00","country":"","country_flag":"","screenshot":"","activity":"Other"},
{"post_title":"<a href='https://www.montanacivil.com' rel='nofollow noopener noreferrer' target='_blank'>Montana Civil Contractors</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-15T14:02:02.124378+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/ce86b9dffda57a310a7163b171e53f18.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"Southern California Telephone Company","group_name":"<a href='/group/akira/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/akira · The Akira ransomware group is said to have emerged in March 2023, and there&#x27;s much speculation about its ties to the former CONTI ransomware group.&lt;br&gt; &lt;br&gt; It&#x27;s worth noting that with the end of C…'>akira</a>","discovered":"2026-09-15T13:53:02.378312+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Energy & Utilities"},
{"post_title":"<a href='https://www.resolvelawgroup.com' rel='nofollow noopener noreferrer' target='_blank'>Resolve Law Group</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-15T13:03:21.669546+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/f90502e8a19123970ac255ad84ec0593.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://www.adm.com' rel='nofollow noopener noreferrer' target='_blank'>ADM</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-15T12:01:12.647322+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/2d8279b53ad878784de7318e561f347e.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Agriculture and Food Production"},
{"post_title":"<a href='https://www.sfa.co.kr' rel='nofollow noopener noreferrer' target='_blank'>SFA Engineering Corporation</a>","group_name":"<a href='/group/metaencryptor/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/metaencryptor · MetaEncryptor is a ransomware group first observed in mid-2023, targeting medium-to-large enterprises in legal, technology, logistics, manufacturing, and finance sectors primarily in the UK, Europe…'>metaencryptor</a>","discovered":"2026-09-15T11:59:46.342220+00:00","country":"KR","country_flag":"<a href='/country/kr/' title='Ransomware victims in South Korea'><span class='fi fi-kr fis'></span> <span>KR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/a560f5771485b92cd2d6182ff42efd05.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://www.nipponsteel.com' rel='nofollow noopener noreferrer' target='_blank'>Nippon Steel Corporation</a>","group_name":"<a href='/group/metaencryptor/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/metaencryptor · MetaEncryptor is a ransomware group first observed in mid-2023, targeting medium-to-large enterprises in legal, technology, logistics, manufacturing, and finance sectors primarily in the UK, Europe…'>metaencryptor</a>","discovered":"2026-09-15T11:59:12.189167+00:00","country":"JP","country_flag":"<a href='/country/jp/' title='Ransomware victims in Japan'><span class='fi fi-jp fis'></span> <span>JP</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/54ba2f5f9216afc5775282a5367f0107.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://asadasarapiqui.com' rel='nofollow noopener noreferrer' target='_blank'>Asada Sarapiqu</a>","group_name":"<a href='/group/arcusmedia/' title='DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/arcusmedia · Arcus Media is a ransomware-as-a-service group that emerged in May 2024, employing double extortion with ChaCha20 + RSA-2048 encryption and recruiting affiliates via a referral-based vetting proces…'>arcusmedia</a>","discovered":"2026-09-15T11:52:38.057981+00:00","country":"CR","country_flag":"<a href='/country/cr/' title='Ransomware victims in Costa Rica'><span class='fi fi-cr fis'></span> <span>CR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/69d638dcf8bd7073d3f763c5878d9e10.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Agriculture and Food Production"},
{"post_title":"<a href='https://www.incrys.com' rel='nofollow noopener noreferrer' target='_blank'>Incrys</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-15T11:03:33.113408+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/0b547ee691bc2849bbb25c00cab88428.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://www.bravotankers.com' rel='nofollow noopener noreferrer' target='_blank'>Bravo Group</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-15T11:02:55.769092+00:00","country":"IT","country_flag":"<a href='/country/it/' title='Ransomware victims in Italy'><span class='fi fi-it fis'></span> <span>IT</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/6e8545d334d7c2ac40e3e790e9c80b7b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://mccarthytire.com' rel='nofollow noopener noreferrer' target='_blank'>McCarthy Tire Service</a>","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-09-15T10:47:23.874476+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/9b428ee2b408e5538fc81e06b2c9bfc6.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://pantherxrare.com' rel='nofollow noopener noreferrer' target='_blank'>PANTHERx Rare</a>","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-09-15T10:46:52.785662+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/01c067fbb0bb718ab21af25251abc9a9.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://insightcreditunion.com' rel='nofollow noopener noreferrer' target='_blank'>Insight Credit Union</a>","group_name":"<a href='/group/storm/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Storm'>Storm</a>","discovered":"2026-09-15T10:46:21.469930+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/75f72234b5ee92203a192980ffd70eb7.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Financial Services"},
{"post_title":"<a href='https://aca.pescara.it' rel='nofollow noopener noreferrer' target='_blank'>ACA Pescara</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:17:26.442151+00:00","country":"IT","country_flag":"<a href='/country/it/' title='Ransomware victims in Italy'><span class='fi fi-it fis'></span> <span>IT</span></a>","screenshot":"","activity":"Energy & Utilities"},
{"post_title":"<a href='https://hattiesburgeyeclinic.com' rel='nofollow noopener noreferrer' target='_blank'>Hattiesburg Eye Clinic</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:17:04.112705+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://indicelectronics.com' rel='nofollow noopener noreferrer' target='_blank'>Indic</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:16:43.518010+00:00","country":"IN","country_flag":"<a href='/country/in/' title='Ransomware victims in India'><span class='fi fi-in fis'></span> <span>IN</span></a>","screenshot":"","activity":"Technology"},
{"post_title":"<a href='https://ati-1.com' rel='nofollow noopener noreferrer' target='_blank'>Aurora Technologies</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:16:22.784543+00:00","country":"","country_flag":"","screenshot":"","activity":"Technology"},
{"post_title":"<a href='https://gtg.se' rel='nofollow noopener noreferrer' target='_blank'>Goteborgsregionens Tekniska Gymnasium</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:16:09.409208+00:00","country":"SE","country_flag":"<a href='/country/se/' title='Ransomware victims in Sweden'><span class='fi fi-se fis'></span> <span>SE</span></a>","screenshot":"","activity":"Education"},
{"post_title":"<a href='https://alchinlong.com' rel='nofollow noopener noreferrer' target='_blank'>Alchin Long Group</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:15:50.083155+00:00","country":"AU","country_flag":"<a href='/country/au/' title='Ransomware victims in Australia'><span class='fi fi-au fis'></span> <span>AU</span></a>","screenshot":"","activity":"Other"},
{"post_title":"<a href='https://gelarti.com.pe' rel='nofollow noopener noreferrer' target='_blank'>Gelarti</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:15:29.439412+00:00","country":"PE","country_flag":"<a href='/country/pe/' title='Ransomware victims in Peru'><span class='fi fi-pe fis'></span> <span>PE</span></a>","screenshot":"","activity":"Other"},
{"post_title":"<a href='https://balkanpolymers.com' rel='nofollow noopener noreferrer' target='_blank'>Balkan Polymers</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:15:09.026597+00:00","country":"BG","country_flag":"<a href='/country/bg/' title='Ransomware victims in Bulgaria'><span class='fi fi-bg fis'></span> <span>BG</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://cedarsfoods.com' rel='nofollow noopener noreferrer' target='_blank'>Cedars Foods</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:14:48.256579+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Agriculture and Food Production"},
{"post_title":"<a href='https://assicurazionilodi.it' rel='nofollow noopener noreferrer' target='_blank'>Agenzia Vittoria Assicurazioni</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:14:27.453596+00:00","country":"IT","country_flag":"<a href='/country/it/' title='Ransomware victims in Italy'><span class='fi fi-it fis'></span> <span>IT</span></a>","screenshot":"","activity":"Financial Services"},
{"post_title":"<a href='https://downrite.com' rel='nofollow noopener noreferrer' target='_blank'>Downrite Engineering</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:14:07.046832+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://neff-drexel.ch' rel='nofollow noopener noreferrer' target='_blank'>Neff Drexel</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:13:46.695706+00:00","country":"CH","country_flag":"<a href='/country/ch/' title='Ransomware victims in Switzerland'><span class='fi fi-ch fis'></span> <span>CH</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://iveta.hr' rel='nofollow noopener noreferrer' target='_blank'>Iveta</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:13:26.180506+00:00","country":"HR","country_flag":"<a href='/country/hr/' title='Ransomware victims in Croatia'><span class='fi fi-hr fis'></span> <span>HR</span></a>","screenshot":"","activity":"Not Found"},
{"post_title":"<a href='https://humboldt.com.br' rel='nofollow noopener noreferrer' target='_blank'>Humboldt</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:13:05.440016+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"","activity":"Other"},
{"post_title":"<a href='https://highoakham.co.uk' rel='nofollow noopener noreferrer' target='_blank'>High Oakham Primary School</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:12:45.069957+00:00","country":"GB","country_flag":"<a href='/country/gb/' title='Ransomware victims in United Kingdom'><span class='fi fi-gb fis'></span> <span>GB</span></a>","screenshot":"","activity":"Education"},
{"post_title":"<a href='https://tentac.co.jp' rel='nofollow noopener noreferrer' target='_blank'>Tentac</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:12:24.467713+00:00","country":"JP","country_flag":"<a href='/country/jp/' title='Ransomware victims in Japan'><span class='fi fi-jp fis'></span> <span>JP</span></a>","screenshot":"","activity":"Technology"},
{"post_title":"Dome Gold Mines","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:12:00.891497+00:00","country":"","country_flag":"","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://danginvestgroup.com' rel='nofollow noopener noreferrer' target='_blank'>Dang Invest Group</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:11:41.476806+00:00","country":"VN","country_flag":"<a href='/country/vn/' title='Ransomware victims in Vietnam'><span class='fi fi-vn fis'></span> <span>VN</span></a>","screenshot":"","activity":"Financial Services"},
{"post_title":"<a href='https://bgrcorp.com' rel='nofollow noopener noreferrer' target='_blank'>BGR Energy Systems</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:11:20.946749+00:00","country":"IN","country_flag":"<a href='/country/in/' title='Ransomware victims in India'><span class='fi fi-in fis'></span> <span>IN</span></a>","screenshot":"","activity":"Energy & Utilities"},
{"post_title":"<a href='https://ardomeilot.com' rel='nofollow noopener noreferrer' target='_blank'>Ardom Eilot</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:11:00.550595+00:00","country":"IL","country_flag":"<a href='/country/il/' title='Ransomware victims in Israel'><span class='fi fi-il fis'></span> <span>IL</span></a>","screenshot":"","activity":"Not Found"},
{"post_title":"<a href='https://technicalasia.com' rel='nofollow noopener noreferrer' target='_blank'>Technical Asia</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:10:39.849207+00:00","country":"TH","country_flag":"<a href='/country/th/' title='Ransomware victims in Thailand'><span class='fi fi-th fis'></span> <span>TH</span></a>","screenshot":"","activity":"Technology"},
{"post_title":"<a href='https://contabilmultipla.com.br' rel='nofollow noopener noreferrer' target='_blank'>Multipla Contabilidade Empresarial</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:10:19.507694+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"","activity":"Professional Services"},
{"post_title":"<a href='https://somit.com' rel='nofollow noopener noreferrer' target='_blank'>Somit</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:09:59.104343+00:00","country":"FI","country_flag":"<a href='/country/fi/' title='Ransomware victims in Finland'><span class='fi fi-fi fis'></span> <span>FI</span></a>","screenshot":"","activity":"Technology"},
{"post_title":"<a href='https://wadafarms.com' rel='nofollow noopener noreferrer' target='_blank'>Wada Farms</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:09:38.760538+00:00","country":"JP","country_flag":"<a href='/country/jp/' title='Ransomware victims in Japan'><span class='fi fi-jp fis'></span> <span>JP</span></a>","screenshot":"","activity":"Agriculture and Food Production"},
{"post_title":"<a href='https://aforpa.fr' rel='nofollow noopener noreferrer' target='_blank'>Aforpa</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:09:18.349218+00:00","country":"FR","country_flag":"<a href='/country/fr/' title='Ransomware victims in France'><span class='fi fi-fr fis'></span> <span>FR</span></a>","screenshot":"","activity":"Not Found"},
{"post_title":"<a href='https://mareshki.com' rel='nofollow noopener noreferrer' target='_blank'>Apteki Mareshki</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:08:57.549988+00:00","country":"BG","country_flag":"<a href='/country/bg/' title='Ransomware victims in Bulgaria'><span class='fi fi-bg fis'></span> <span>BG</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://santafelibros.com.ar' rel='nofollow noopener noreferrer' target='_blank'>Librería Santa Fe</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:08:36.697858+00:00","country":"AR","country_flag":"<a href='/country/ar/' title='Ransomware victims in Argentina'><span class='fi fi-ar fis'></span> <span>AR</span></a>","screenshot":"","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://sarkujapan.com' rel='nofollow noopener noreferrer' target='_blank'>Sarku Japan</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:08:16.159987+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Retail & E-Commerce"},
{"post_title":"<a href='https://tmipal.com' rel='nofollow noopener noreferrer' target='_blank'>TMI Tecnicas Mecanicas Ilerdenses</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:07:55.531446+00:00","country":"ES","country_flag":"<a href='/country/es/' title='Ransomware victims in Spain'><span class='fi fi-es fis'></span> <span>ES</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://medskin-suwelack.com' rel='nofollow noopener noreferrer' target='_blank'>MedSkin Solutions Dr. Suwelack AG</a>","group_name":"<a href='/group/thegentlemen/' title='aka Storm-2697 · DLS (offline) — needs Tor · Profile: https://www.ransomware.live/group/thegentlemen · The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker agains…'>thegentlemen</a>","discovered":"2026-09-15T07:07:34.682327+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"","activity":"Healthcare"},
{"post_title":"<a href='https://www.geieg.cat' rel='nofollow noopener noreferrer' target='_blank'>Geieg</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-15T05:02:27.852757+00:00","country":"ES","country_flag":"<a href='/country/es/' title='Ransomware victims in Spain'><span class='fi fi-es fis'></span> <span>ES</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/253e41370d0ecf030b6d451938ab7ffd.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"Honda (Peru)","group_name":"<a href='/group/panzer/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Panzer'>Panzer</a>","discovered":"2026-09-15T01:51:14.892970+00:00","country":"PE","country_flag":"<a href='/country/pe/' title='Ransomware victims in Peru'><span class='fi fi-pe fis'></span> <span>PE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/abdfeea3d6b53f40f21858f751dcf984.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"veritiv","group_name":"<a href='http://iah6477wcvisc45wl54u524fbrh4dnmtcctpg2fpe5epf3jbpkiwu4qd.onion' rel='nofollow noopener noreferrer' target='_blank' title='aka Cinder · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/iah6477'>iah6477</a>","discovered":"2026-09-15T00:55:32.119892+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/8c01dae98c3f27133bd96a4cc9c549eb.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://new.handytrac.com' rel='nofollow noopener noreferrer' target='_blank'>HandyTrac (Greystar Litchfield Park, AZ)</a>","group_name":"<a href='/group/shadowbyt3/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/ShadowByt3%24 · ShadowByt3$ is a ransomware-as-a-service group first observed in October 2025, using multi-method extortion and communicating via Telegram and Tox, with a very small confirmed victim list suggestin…'>ShadowByt3$</a>","discovered":"2026-09-15T00:23:37.508635+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/b430ef0623520814170e46436903aed7.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"Better Accounting Solutions","group_name":"<a href='/group/anubis/' title='Chat (online) — needs Tor · Profile: https://www.ransomware.live/group/anubis · Anubis is a ransomware-as-a-service group active since December 2024 that targets healthcare, engineering, construction, and professional services sectors, offering affiliates a flexible revenue sp…'>anubis</a>","discovered":"2026-09-14T23:24:09.918201+00:00","country":"","country_flag":"","screenshot":"","activity":"Professional Services"},
{"post_title":"<a href='https://.' rel='nofollow noopener noreferrer' target='_blank'>Bernath &amp; Rosenberg</a>","group_name":"<a href='/group/genesis/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/genesis · Genesis is an emerging ransomware group first observed in late 2025, targeting small to mid-sized US organizations across healthcare, retail, financial services, legal, and manufacturing using doub…'>genesis</a>","discovered":"2026-09-14T20:57:27.761424+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/7b71f1660b49fdb14c4783c2299ff868.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://.' rel='nofollow noopener noreferrer' target='_blank'>Dorfman Abrams Music, P.C</a>","group_name":"<a href='/group/genesis/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/genesis · Genesis is an emerging ransomware group first observed in late 2025, targeting small to mid-sized US organizations across healthcare, retail, financial services, legal, and manufacturing using doub…'>genesis</a>","discovered":"2026-09-14T20:56:49.866513+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/c1abb78f806186937c33c93b8f892c16.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://geekybunch.com' rel='nofollow noopener noreferrer' target='_blank'>geekybunch.com</a>","group_name":"<a href='/group/unsafe/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/unsafe · A group which seems to recycle leak from other ransomware groups'>unsafe</a>","discovered":"2026-09-14T20:04:08.734944+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/58483f5085447cea684cb3bca91bc77a.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://www.foremost-mfg.com' rel='nofollow noopener noreferrer' target='_blank'>Foremost Mfg</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-14T18:59:34.570288+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/19c20805fb26674b9dd2ecb909e9693c.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://winstoncontracting.com' rel='nofollow noopener noreferrer' target='_blank'>Winston Contracting, LLC</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-14T18:06:09.568099+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/279fccb0f89b99f526e3d03da2fa0163.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://www.roadexamerica.com' rel='nofollow noopener noreferrer' target='_blank'>RoadEx America</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-14T18:05:26.484399+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/65d7b9c4c46aa81c0627a66c22fc21f5.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Transportation"},
{"post_title":"<a href='https://www.minmerglobal.com' rel='nofollow noopener noreferrer' target='_blank'>Minmer Global</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-14T18:04:41.007152+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/ea0249c83703cd9a4017d1368dc278f9.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://dublincityschools.us' rel='nofollow noopener noreferrer' target='_blank'>Dublin City Schools GA</a>","group_name":"<a href='/group/eclipse/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Eclipse'>Eclipse</a>","discovered":"2026-09-14T16:21:11.794338+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/1806732c29f9bb420d2f30914972f485.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Education"},
{"post_title":"<a href='https://rosello-fils.fr' rel='nofollow noopener noreferrer' target='_blank'>Rosello et Fils</a>","group_name":"<a href='/group/eclipse/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Eclipse'>Eclipse</a>","discovered":"2026-09-14T15:21:22.030421+00:00","country":"FR","country_flag":"<a href='/country/fr/' title='Ransomware victims in France'><span class='fi fi-fr fis'></span> <span>FR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/c8070642aba3fd7eb6426a77a906422b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Agriculture and Food Production"},
{"post_title":"<a href='https://tpi.tw' rel='nofollow noopener noreferrer' target='_blank'>tpi.tw</a>","group_name":"<a href='/group/lockbit5/' title='Files (online) — needs Tor · Profile: https://www.ransomware.live/group/lockbit5 · LockBit 5.0 (&quot;ChuongDong&quot;) emerged in September 2025 as the group&#x27;s resurgence following the February 2024 law enforcement takedown, introducing cross-platform payloads targeting Windows, Linux, an…'>lockbit5</a>","discovered":"2026-09-14T14:06:32.523101+00:00","country":"TW","country_flag":"<a href='/country/tw/' title='Ransomware victims in Taiwan'><span class='fi fi-tw fis'></span> <span>TW</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/b1358a656f2161cf20f44c58ac8cdaad.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://comune.robeccosulnaviglio.mi.it' rel='nofollow noopener noreferrer' target='_blank'>comune.robeccosulnaviglio.mi.it</a>","group_name":"<a href='/group/lockbit5/' title='Files (online) — needs Tor · Profile: https://www.ransomware.live/group/lockbit5 · LockBit 5.0 (&quot;ChuongDong&quot;) emerged in September 2025 as the group&#x27;s resurgence following the February 2024 law enforcement takedown, introducing cross-platform payloads targeting Windows, Linux, an…'>lockbit5</a>","discovered":"2026-09-14T14:05:52.982749+00:00","country":"IT","country_flag":"<a href='/country/it/' title='Ransomware victims in Italy'><span class='fi fi-it fis'></span> <span>IT</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/58f6dee68761257b3396ad8c8f74b1f5.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Government & Defense"},
{"post_title":"<a href='https://httoy.fi' rel='nofollow noopener noreferrer' target='_blank'>httoy.fi</a>","group_name":"<a href='/group/lockbit5/' title='Files (online) — needs Tor · Profile: https://www.ransomware.live/group/lockbit5 · LockBit 5.0 (&quot;ChuongDong&quot;) emerged in September 2025 as the group&#x27;s resurgence following the February 2024 law enforcement takedown, introducing cross-platform payloads targeting Windows, Linux, an…'>lockbit5</a>","discovered":"2026-09-14T14:03:28.657934+00:00","country":"FI","country_flag":"<a href='/country/fi/' title='Ransomware victims in Finland'><span class='fi fi-fi fis'></span> <span>FI</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/86d9ee2c7e65c3724ff0d8e5d8b4d08f.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://www.agapechc.org' rel='nofollow noopener noreferrer' target='_blank'>Metropolitan Community Health Services</a>","group_name":"<a href='/group/insomnia/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/insomnia · Insomnia is a data-theft and extortion group that emerged in October 2025, targeting primarily US-based healthcare organizations — stealing patient files and threatening public exposure rather than…'>insomnia</a>","discovered":"2026-09-14T14:01:14.074342+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/e0f9f947834c21aaac53ec135ca36226.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Healthcare"},
{"post_title":"<a href='https://www.msnattorneys.com' rel='nofollow noopener noreferrer' target='_blank'>Massey, Stotser &amp; Nichols</a>","group_name":"<a href='/group/insomnia/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/insomnia · Insomnia is a data-theft and extortion group that emerged in October 2025, targeting primarily US-based healthcare organizations — stealing patient files and threatening public exposure rather than…'>insomnia</a>","discovered":"2026-09-14T14:00:21.097991+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/898e5d3e5208a60fe0963f19d5f7d07e.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Professional Services"},
{"post_title":"<a href='https://glasfloss.com' rel='nofollow noopener noreferrer' target='_blank'>glasfloss.com</a>","group_name":"<a href='/group/chaos/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/chaos · Chaos is a ransomware-as-a-service operation that emerged in early 2025, likely formed by former BlackSuit/Royal members, offering cross-platform ransomware for Windows, Linux, ESXi, and NAS to aff…'>chaos</a>","discovered":"2026-09-14T13:56:16.318150+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/993b7fd5f31cfa3b9827b6f5e8fa0ff2.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://steelhausinc.com' rel='nofollow noopener noreferrer' target='_blank'>steelhausinc.com</a>","group_name":"<a href='/group/chaos/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/chaos · Chaos is a ransomware-as-a-service operation that emerged in early 2025, likely formed by former BlackSuit/Royal members, offering cross-platform ransomware for Windows, Linux, ESXi, and NAS to aff…'>chaos</a>","discovered":"2026-09-14T13:55:41.227308+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/dc936996f91016e190c37c411dc9e03b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://www.vitargroup.com' rel='nofollow noopener noreferrer' target='_blank'>Vitar Group</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-14T13:09:19.372046+00:00","country":"AR","country_flag":"<a href='/country/ar/' title='Ransomware victims in Argentina'><span class='fi fi-ar fis'></span> <span>AR</span></a>","screenshot":"","activity":"Other"},
{"post_title":"<a href='https://www.lawmlg.com' rel='nofollow noopener noreferrer' target='_blank'>Mestechkin Law Group P.C.</a>","group_name":"<a href='/group/booba-project/' title='aka Booba Team · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Booba%20Project · Booba'>Booba Project</a>","discovered":"2026-09-14T12:51:44.322676+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Professional Services"},
{"post_title":"<a href='https://www.atlasoceanvoyages.com' rel='nofollow noopener noreferrer' target='_blank'>Atlas Ocean Voyages</a>","group_name":"<a href='/group/booba-project/' title='aka Booba Team · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Booba%20Project · Booba'>Booba Project</a>","discovered":"2026-09-14T12:20:35.222012+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Hospitality"},
{"post_title":"Ne***ox","group_name":"<a href='/group/auditteam/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/AuditTeam · AuditTeam is a small ransomware group with approximately 5 known victims, primarily targeting organizations in East and Southeast Asia across technology and manufacturing sectors, operating a data …'>AuditTeam</a>","discovered":"2026-09-14T11:50:24.454084+00:00","country":"RU","country_flag":"<a href='/country/ru/' title='Ransomware victims in Russia'><span class='fi fi-ru fis'></span> <span>RU</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/36bee1856fdf96af07b7be1482ffff84.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://www.alicotrans.com' rel='nofollow noopener noreferrer' target='_blank'>Alicotrans</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-14T07:59:50.254687+00:00","country":"BR","country_flag":"<a href='/country/br/' title='Ransomware victims in Brazil'><span class='fi fi-br fis'></span> <span>BR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/03863c8c13ce21cfe99bcdfdd97bbaa7.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Transportation"},
{"post_title":"Cerámicas Kantu","group_name":"<a href='/group/panzer/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Panzer'>Panzer</a>","discovered":"2026-09-13T23:23:34.307597+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/94a0aa15e69fe6735ea18355357d8e25.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"<a href='https://www.gilcoscaffolding.com' rel='nofollow noopener noreferrer' target='_blank'>Gilco Scaffolding</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-13T16:59:37.146504+00:00","country":"GB","country_flag":"<a href='/country/gb/' title='Ransomware victims in United Kingdom'><span class='fi fi-gb fis'></span> <span>GB</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/0c5adcfa548d8d1b4fbbf2c0c55f7885.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Manufacturing"},
{"post_title":"Navitrans","group_name":"<a href='/group/emperador/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/emperador'>emperador</a>","discovered":"2026-09-13T13:51:22.518452+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/86408e9ac0a9d30d8048e264be8d8a06.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Transportation"},
{"post_title":"<a href='https://www.kashkha.com' rel='nofollow noopener noreferrer' target='_blank'>www.kashkha.com</a>","group_name":"<a href='/group/krybit/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/krybit · Krybit is an emerging RaaS group that launched in late March 2026, offering affiliates an 80/20 revenue split with support for Windows, Linux, ESXi, and NAS device encryption, and became notable fo…'>krybit</a>","discovered":"2026-09-13T12:29:33.395462+00:00","country":"","country_flag":"","screenshot":"<a href='https://images.ransomware.live/victims/720d85f11ccabb63333968dee8c7ae98.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"<a href='https://caridrovaldeloire.fr' rel='nofollow noopener noreferrer' target='_blank'>CARIDRO VAL DE LOIRE</a>","group_name":"<a href='/group/qilin/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/qilin · Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice…'>qilin</a>","discovered":"2026-09-13T11:03:46.354166+00:00","country":"FR","country_flag":"<a href='/country/fr/' title='Ransomware victims in France'><span class='fi fi-fr fis'></span> <span>FR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/04929040d6bc2dde85f051529d725e09.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Agriculture and Food Production"},
{"post_title":"Paid Victim F9CF4B639CAC1B18","group_name":"<a href='/group/auditteam/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/AuditTeam · AuditTeam is a small ransomware group with approximately 5 known victims, primarily targeting organizations in East and Southeast Asia across technology and manufacturing sectors, operating a data …'>AuditTeam</a>","discovered":"2026-09-13T09:51:41.156898+00:00","country":"RU","country_flag":"<a href='/country/ru/' title='Ransomware victims in Russia'><span class='fi fi-ru fis'></span> <span>RU</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/3f2069ce1f505b5163eb8b23dc629d7e.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"Paid Victim FDC699DE3A112669","group_name":"<a href='/group/auditteam/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/AuditTeam · AuditTeam is a small ransomware group with approximately 5 known victims, primarily targeting organizations in East and Southeast Asia across technology and manufacturing sectors, operating a data …'>AuditTeam</a>","discovered":"2026-09-13T09:51:07.947269+00:00","country":"DE","country_flag":"<a href='/country/de/' title='Ransomware victims in Germany'><span class='fi fi-de fis'></span> <span>DE</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/21eb228c3b96ee6cf6bb2fe2c5853c1b.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Not Found"},
{"post_title":"vi***in","group_name":"<a href='/group/auditteam/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/AuditTeam · AuditTeam is a small ransomware group with approximately 5 known victims, primarily targeting organizations in East and Southeast Asia across technology and manufacturing sectors, operating a data …'>AuditTeam</a>","discovered":"2026-09-13T09:50:31.693860+00:00","country":"IN","country_flag":"<a href='/country/in/' title='Ransomware victims in India'><span class='fi fi-in fis'></span> <span>IN</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/5ff5184d3b0906a6d4dab759b37ae6e6.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Transportation"},
{"post_title":"<a href='https://i2i-systems.com' rel='nofollow noopener noreferrer' target='_blank'>i2i-systems</a>","group_name":"<a href='/group/barracuda/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Barracuda'>Barracuda</a>","discovered":"2026-09-13T09:20:21.439464+00:00","country":"TR","country_flag":"<a href='/country/tr/' title='Ransomware victims in Turkey'><span class='fi fi-tr fis'></span> <span>TR</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/cd6bb15fdcf005c06167f69b27e438ff.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Technology"},
{"post_title":"<a href='https://kimberly-clark.com' rel='nofollow noopener noreferrer' target='_blank'>Kimberly-Clark</a>","group_name":"<a href='/group/shinyhunters/' title='DLS (online) · Profile: https://www.ransomware.live/group/shinyhunters · ShinyHunters is a financially motivated data-theft and extortion group active since 2020, responsible for high-profile breaches including Ticketmaster (via Snowflake) and PowerSchool; by 2025 they …'>shinyhunters</a>","discovered":"2026-09-13T08:48:41.160130+00:00","country":"US","country_flag":"<a href='/country/us/' title='Ransomware victims in United States'><span class='fi fi-us fis'></span> <span>US</span></a>","screenshot":"","activity":"Manufacturing"},
{"post_title":"<a href='https://incor.in' rel='nofollow noopener noreferrer' target='_blank'>INCOR Group</a>","group_name":"<a href='/group/doommageddon/' title='DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Doommageddon · Direct Extortion'>Doommageddon</a>","discovered":"2026-09-13T00:53:02.200383+00:00","country":"IN","country_flag":"<a href='/country/in/' title='Ransomware victims in India'><span class='fi fi-in fis'></span> <span>IN</span></a>","screenshot":"<a href='https://images.ransomware.live/victims/ea98bbfbcedde938bc23cf03249a61d1.png' rel='nofollow noopener noreferrer' target='_blank'>🖵</a>","activity":"Other"},
{"post_title":"<a href='https://stradsolutions.com' rel='nofollow noopener noreferrer' target='_blank'>Strad Solutions</a>","group_name":"<a href='/group/vexy-ransomware/' title='aka vexy · DLS (online) — needs Tor · Profile: https://www.ransomware.live/group/Vexy%20Ransomware'>Vexy Ransomware</a>","discovered":"2026-09-12T23:58:29.052830+00:00","country":"GB","country_flag":"<a href='/country/gb/' title='Ransomware victims in United Kingdom'><span class='fi fi-gb fis'></span> <span>GB</span></a>","screenshot":"","activity":"Technology"}
]
