Ransomware group
Lamashtu ransomware: victims and leak site activity
The Lamashtu ransomware group has listed 54 victims on its leak site since April 2026; its latest post is from 24 October 2026. Most affected countries: Germany, France and Malaysia. Most targeted sector: Manufacturing.
Total posts
54
First seen
2026-04-13
Latest post
2026-10-24
Countries hit
18
About Lamashtu
Lamashtu is an extortion group that first appeared in April 2026, claiming attacks against organizations in France, Romania, and Thailand across energy, pharmaceutical, and film sectors; it has not yet been confirmed as operating actual file-encrypting ransomware rather than pure data-theft extortion.
- Leak site (Tor)
- http://lamashtux5j74mcm7lwwgn5yrvuwtrpxjoyendif3v3hrztjesfoyayd.onion
- Profile
- ransomware.live
Most targeted countries
All countries →Most targeted sectors
- Manufacturing 16
- Agriculture and Food Production 5
- Professional Services 5
- Retail & E-Commerce 5
- Energy & Utilities 4
- Transportation 4
- Healthcare 3
- Hospitality 3
- Technology 3