Ransomware group
Spacebears ransomware: victims and leak site activity
The Spacebears ransomware group has listed 160 victims on its leak site since April 2024; its latest post is from 22 October 2026. Most affected countries: United States, Italy and Germany. Most targeted sector: Professional Services.
Total posts
160
First seen
2024-04-29
Latest post
2026-10-22
Countries hit
45
About Spacebears
Space Bears is a double-extortion ransomware group that emerged in April 2024, distinguished by a professional "corporate" aesthetic on its leak site, leveraging Phobos RaaS infrastructure and targeting small-to-medium organizations in manufacturing, technology, and healthcare across the US and Europe.
- Leak site (Tor)
- http://5butbkrljkaorg5maepuca25oma7eiwo6a2rlhvkblb4v6mf3ki2ovid.onion/#list
- Profile
- ransomware.live
Most targeted countries
- United States 46
- Italy 13
- Germany 9
- Spain 8
- Brazil 7
- Canada 5
- Australia 4
- Switzerland 4
- United Kingdom 4
- India 4
Most targeted sectors
- Professional Services 35
- Technology 28
- Manufacturing 27
- Healthcare 23
- Retail & E-Commerce 14
- Transportation 8
- Agriculture and Food Production 6
- Financial Services 6
- Hospitality 5
- Energy & Utilities 3