Ransomware Intelligence
Active ransomware gang campaigns, victim disclosures from leak sites, RaaS affiliate recruitment, and SIGMA detection rules for every known ransomware family targeting enterprise environments.
Ransomware — Archive & Latest
N0N Ransomware Gang: 23 New Leak-Site Listings in 24 Hours — Sector Targeting Analysis, Verification Caveats & Detection Rules
N0N posted 23 alleged victims to its leak site in a single day, claiming manufacturing, healthcare, and technology targets across the US, EG, and NL. All claims remain unverified.
THEGENTLEMEN Ransomware Gang: 31 New Leak-Site Listings in 48 Hours — Sector Targeting Analysis, Detection Rules & Response Priorities
THEGENTLEMEN has listed 31 organizations on its dark web leak site, skewing toward healthcare and government. Unverified claims — but defenders in these sectors should hunt now.
N0N Ransomware Gang: 17 Leak-Site Listings in 4 Days — Cross-Sector Campaign Analysis & Detection Rules
N0N's dark web leak site shows 17 new victim claims in four days, spanning healthcare, technology, financial services and retail. Unverified claims — but defenders should hunt now.
CISA KEV Flash: 7 CVEs Added — Atlassian, Ivanti, PAN-OS & AhsayCBS Under Active Exploitation
CISA confirms 7 new actively exploited CVEs hitting Atlassian DC products, Ivanti Connect Secure, PAN-OS, AhsayCBS, Cisco SEG & Windows Shell. Patch now.
N0N Ransomware Gang: 14 Leak-Site Listings — Sector Targeting Analysis & Detection Rules
N0N lists 14 orgs across tech, healthcare, finance, retail and services; verify VPN/RDP/CI edge exposure and hunt pre-encryption staging.
N0N Ransomware Gang: 12 New Leak-Site Listings — Sector Exposure, Verification Limits & Detection Rules
N0N listed 12 organizations across technology, services, healthcare, retail and financial sectors in US/NL/BR; claims are unverified. Prioritize edge, virtualization and pre-encryption detection.
WALLSTREET Ransomware Gang: 13 New Leak-Site Listings in 48 Hours — Sweden-Heavy Campaign Analysis & Detection Engineering
WALLSTREET listed 13 organizations on its dark web leak site Oct 13–14, 2026, with heavy concentration in Sweden and healthcare/professional services. Claims remain unverified — defenders should hunt now.
N0N Ransomware Gang: 25 Leak-Site Listings Including Port & Shipping Concentration — Sector Analysis & Detection Rules
N0N has listed 25 organizations on its dark web leak site, including a cluster of port and shipping entities. Maritime, healthcare, and financial orgs should harden now.
N0N Ransomware Gang Claims 42 New Leak-Site Listings — Maritime & Logistics Cluster Emerges, Detection Rules Included
N0N lists 42 organizations on its leak site, with a heavy maritime/port-operations cluster spanning BR, KR, TR, SG, ID, JP and CN. All claims unverified.
N0N Ransomware Gang: 43 Listings in Latest Posting Wave — Maritime & Port Operations Campaign Analysis with Detection Rules
N0N's leak site lists 43 organizations, including an apparent coordinated wave against port, terminal, and shipping operators. Maritime, logistics, healthcare, and financial sectors should hunt now.
N0N Ransomware Gang: 50 Leak-Site Claims — Maritime & Port-Logistics Surge Analysis and Detection Engineering
N0N claims 50 new listings, 13+ of them maritime/port-logistics operators posted in a single day. Shipping, terminal, and logistics orgs should hunt pre-ransom staging now.
N0N Ransomware Gang: 50 Organizations Listed in Coordinated Maritime & Logistics Campaign — Sector Analysis & Detection Rules
N0N has listed 50 organizations — heavily concentrated in maritime shipping, ports, and logistics across Asia-Pacific and South America. Claims remain unverified; defenders in these sectors should hunt now.
N0N Ransomware Gang Claims 50 Victims in Coordinated Maritime & Logistics Leak-Site Campaign — Sector Analysis & Detection Rules
N0N has listed 50 organizations — heavily concentrated in ports, container shipping, and logistics — on its dark web leak site. Maritime and transportation security teams should hunt now.
N0N Ransomware Gang: 12 New Leak-Site Listings — Sector Targeting Analysis & Detection Rules
N0N listed 12 organizations across CA/US/AU, spanning healthcare, technology and professional services. All listings are unverified actor claims; defenders should hunt pre-encryption staging now.
N0N Leak-Site Claims: 13 Organizations Listed Across CA/US/AU — Sector Targeting Analysis & Detection Rules
N0N listed 13 organizations across Technology, Healthcare, Professional Services and undisclosed sectors in CA/US/AU; claims are unverified. Regulated-data sectors should hunt staging and edge exposure now.
SILENTRANSOMGROUP: 5 New Leak-Site Listings in 6 Days — Professional Services Sector in the Crosshairs
SILENTRANSOMGROUP has listed 5 organizations on its dark web leak site since 2026-10-06, concentrated in US professional services. All claims are single-source and unverified.
N0N Ransomware Gang: 12 Leak-Site Listings in One Week — Healthcare & Tech Targeting Analysis with Detection Rules
N0N listed 12 organizations on its leak site in five days, with healthcare, technology, and professional services firms in the US, CA, and AU named. Claims unverified; defenders should hunt now.
DRAGONFORCE Ransomware Gang: 4 New Leak-Site Listings Across Manufacturing, Energy & Technology — Claims Analysis & Detection Rules
DRAGONFORCE has listed 4 organizations in PE, TW, BR, and FR on its leak site this week. Manufacturing, Energy, and Technology teams should review detections now.
CISA KEV Flash: 6 CVEs Added — BIND, Struts, ProFTPD & Citrix NetScaler Under Active Attack
CISA confirms active exploitation of 6 CVEs across ISC BIND, Apache Struts, Strapi, ONLYOFFICE, ProFTPD, and Citrix NetScaler. Federal remediation deadlines are binding — patch now.
RHYSIDA Ransomware Gang: 3 New Leak-Site Claims — US Professional Services & Government Targeting Analysis and Detection Rules
RHYSIDA has listed three US organizations — two professional services firms and one county government — on its dark web leak site. Claims are unverified; affected sectors should review detection content.
BLACK X Ransomware Gang: 3 New Leak-Site Claims Spanning Finance, Tech, and Healthcare — Targeting Analysis & Detection Rules
BLACK X has listed three organizations across GB, JP, and DE on its leak site — claims remain unverified. Financial services, technology, and healthcare teams should hunt now.
THEGENTLEMEN Ransomware Gang: 33 New Leak-Site Listings — Sector Targeting Analysis & Detection Rules
THEGENTLEMEN has listed 33 organizations on its dark web leak site, with healthcare and professional services firms in the US heavily represented. All listings are unverified single-source claims.
ARCUSMEDIA Ransomware Gang: 3 New Leak-Site Listings — Sector Targeting Analysis & Detection Rules
ARCUSMEDIA listed 3 organizations across MX, CA, and BR on its dark web leak site on 2026-10-09. Manufacturing and LATAM-facing enterprises should review detection posture now.
N0N Ransomware Gang: 4 New Leak-Site Claims — Sector Targeting Analysis & Detection Rules
N0N posted 4 new leak-site claims across US/CA tech, finance, healthcare. Only one is multi-source; treat as unverified and harden now.
N0N Ransomware Gang: 4 Leak-Site Listings Across Tech, Finance & Healthcare — Sector Analysis & Detection Rules
N0N has listed 4 organizations on its dark web leak site spanning US/CA technology, financial services, and healthcare. Unverified claims — detection rules inside.
ECLIPSE Ransomware Gang: 5 New Leak-Site Listings Across Manufacturing, Professional Services & Transportation — Campaign Analysis & Detection Rules
ECLIPSE listed 5 organizations on its dark web leak site Oct 5-8 across IN, US, BR, SG. Manufacturing, professional services, transportation and technology security teams should review detection and hardening guidance now.
QILIN Ransomware Gang: 14 New Leak-Site Claims Posted — Sector Targeting Analysis & Detection Rules
QILIN posted 14 new victim claims to its leak site this week across manufacturing, financial services, and technology. Unverified claims — defensive guidance inside.
INCRANSOM Ransomware Gang: 5 New Leak-Site Listings Across Education, Manufacturing & Transportation — Unverified Claims, Detection Rules & Hunting Queries
INCRANSOM has listed 5 organizations in the US and Germany on its dark web leak site spanning education, manufacturing, transportation, and professional services. All listings are single-source, unverified criminal claims — defenders in these sectors should hunt now.
PANZER Ransomware Gang: 4 New Leak-Site Listings Across Education, Manufacturing & Professional Services — Sector Analysis & Detection Rules
PANZER's leak site added 4 new listings spanning education, manufacturing, and professional services in DE, US, and BR. Unverified claims — but the TTPs demand action now.
UMBRA Ransomware Gang: 5 New Leak-Site Listings Across Technology, Manufacturing & Education — Campaign Analysis & Detection Rules
UMBRA listed 5 organizations on its dark web leak site Oct 6–7, spanning technology, manufacturing, education, and other sectors across ZA, EG, and US. Unverified claims; defenders in these sectors should review exposure now.
EVEREST Ransomware Gang: 5 New Leak-Site Listings — Sector Targeting Analysis & Detection Rules
EVEREST has listed five new organizations on its leak site across manufacturing, transportation, professional services, and agriculture in the US, UAE, and Netherlands.
SILENTRANSOMGROUP Leak-Site Activity: 3 New Listings — Legal & Professional Services Targeting Analysis and Detection Guidance
SILENTRANSOMGROUP has listed 3 organizations on its leak site, two of them US professional services firms. All listings are single-source, unverified claims.
LAMASHTU Ransomware Gang: 4 New Leak-Site Listings Across ES, DE, MX — Sector Targeting Analysis & Detection Rules
LAMASHTU listed 4 organizations in manufacturing, transportation, and services across Spain, Germany, and Mexico. Claims are unverified; defenders in these sectors should act now.
SAFEPAY Ransomware: 10 New Leak-Site Listings — Sector Targeting Analysis & Detection Engineering Brief
SAFEPAY has listed 10 organizations across Technology, Retail, and Professional Services in 8 countries. Unverified claims — detection rules, hunt queries, and IR priorities inside.
EMPERADOR Ransomware Gang: 4 New Leak-Site Listings — Sector Targeting Analysis & Detection Rules
EMPERADOR has listed 4 organizations across transportation, manufacturing, and agriculture in TT, TR, and MX on its leak site. Claims remain unverified; affected sectors should hunt now.
NETRUNNER Ransomware Gang: 3 New Leak-Site Listings — Transportation & Retail Targeting Analysis with Detection Rules
NETRUNNER has listed 3 organizations on its dark web leak site, spanning transportation and retail. Transportation and retail/e-commerce security teams should review detection guidance now.
WALLSTREET Ransomware Gang: 4 New Leak-Site Claims Posted — Healthcare & Manufacturing Targeting Analysis with Detection Rules
WALLSTREET's leak site shows 4 new claimed victims spanning healthcare, manufacturing, and other sectors across US, SA, and DK. Healthcare and industrial orgs should review exposure now.
QILIN Ransomware Gang: 4 New Leak-Site Listings Spanning Transportation, Manufacturing, Hospitality & Professional Services — Detection Rules & IR Playbook
QILIN's leak site shows 4 new victim claims across TH, DE, and GB in 48 hours. Transportation, manufacturing, hospitality, and professional services firms should hunt now.
CISA KEV Flash: 7 CVEs Added — Zammad, FortiMail, Cisco SD-WAN, Apple, Citrix NetScaler Under Active Attack
CISA KEV adds 7 actively exploited CVEs spanning Citrix NetScaler, Apple CoreGraphics, Cisco SD-WAN Manager, FortiMail and Zammad. Patch immediately — exploitation confirmed in the wild.
RHYSIDA Ransomware Gang: 3 New Leak-Site Claims Spanning Energy, Technology & Legal Sectors — Targeting Analysis & Detection Rules
RHYSIDA has listed 3 new alleged victims on its dark web leak site across SE, DE, and US. Energy, technology, and professional services organizations should review the detection content inside.
KRYBIT Ransomware Gang: 6 New Leak-Site Claims Posted — Sector Targeting Analysis & Detection Rules
KRYBIT listed 6 organizations across retail, education, technology, and manufacturing (CZ, IN, FR, US) on its leak site. Unverified claims — defenders in these sectors should review detection posture now.
BOOBA PROJECT Ransomware Gang: 6 New Leak-Site Listings Targeting Healthcare, Education & Government — Sector Analysis & Detection Rules
BOOBA PROJECT listed 6 organizations on its dark web leak site Oct 1–2, 2026, spanning healthcare, education, and government in US, CA, and BR. All listings are single-source, unverified threat-actor claims.
AKIRA Ransomware Gang: 3 New Leak-Site Listings Across Manufacturing & Professional Services — Targeting Analysis & Detection Rules
AKIRA lists 3 new alleged victims on its dark web leak site, spanning manufacturing and professional services. Unverified claims — but defenders should hunt for AKIRA TTPs now.
THEGENTLEMEN Ransomware Gang: 24 New Leak-Site Claims — Sector Targeting Analysis & Detection Engineering
THEGENTLEMEN claims 24 new victims on its dark web leak site, spanning healthcare, manufacturing, professional services and education across 12 countries. Detection content inside.
INCRANSOM Leak-Site Claims: 6 New Listings — Sector Targeting Analysis & Detection Rules
INCRANSOM listed 6 organizations on its leak site; healthcare, manufacturing and technology teams should validate exposure and hunt pre-encryption staging.
STORM Ransomware Gang: 7 US Organizations Listed on Leak Site — Sector Targeting Analysis and Detection Rules
STORM listed 7 US orgs across healthcare, finance, agriculture and services; claims are unverified. Patch edge CVEs and hunt pre-encryption staging.
INTERLOCK Ransomware Gang: 2 New Leak-Site Claims — US Professional Services Targeting Analysis & Detection Rules
INTERLOCK listed 2 US organizations on its leak site in late September 2026. Both claims are multi-source verified as postings; breaches remain unconfirmed. Detection content inside.
LAMASHTU Ransomware Gang: 10 New Leak-Site Listings — Sector Targeting Analysis & Detection Rules
LAMASHTU posted 10 new leak-site claims spanning healthcare, manufacturing, energy, transport, finance and tech; defenders should validate exposure and hunt pre-encryption staging now.
CHAOS Ransomware Gang: 2 New Leak-Site Listings — Manufacturing & Healthcare Targeting Analysis with Detection Rules
CHAOS listed advantech.com (TW, Manufacturing) and carolinaasthma.com (US, Healthcare) on its leak site on 2026-09-29. Claims are unverified — defenders in both sectors should hunt now.
BRAINCIPHER Ransomware Gang: 8 New Leak-Site Claims in 24 Hours — Sector Targeting Analysis, Detection Rules & Pre-Detonation Hunt Queries
BRAINCIPHER listed 8 organizations on its leak site in a single-day burst spanning Manufacturing, Transportation, Financial Services and Healthcare. All claims are single-source and unverified — defenders should hunt now.
Showing 50 of 547 reports. Archive expands automatically as new intel is generated.
Every Ransomware Report Includes SIGMA & KQL Detection Rules
Every intelligence briefing on this page includes at least one Sigma rule, a Microsoft Sentinel KQL hunt query, and an IOC check script — ready to drop into your SIEM. No paywall. No registration.