Ransomware Intelligence
Active ransomware gang campaigns, victim disclosures from leak sites, RaaS affiliate recruitment, and SIGMA detection rules for every known ransomware family targeting enterprise environments.
Ransomware — Archive & Latest
N0N Ransomware Gang: 15 New Leak-Site Postings Claim Retail, Healthcare, and Technology Victims — Detection Rules and Hunt Queries
N0N has listed 15 organizations across retail, healthcare, and technology sectors in 3 days. Multi-source corroboration on 10 claims. Includes Sigma rules, KQL hunts, and response checklists.
N0N Ransomware Gang: 12 New Leak-Site Postings — Sector Targeting Analysis & Detection Rules
N0N has listed 12 organizations on its dark web leak site since 2026-11-03, including named US healthcare and retail entities. Sectors should validate exposure and hunt pre-encryption staging now.
MEDUSALOCKER Leak-Site Surge: 18 New Claimed Victims Posted in One Day — Sector Analysis & Detection Rules
MEDUSALOCKER listed 18 claimed victims on its leak site on 2026-11-04, spanning tech, manufacturing, education and legal services. Detection content inside.
N0N Ransomware Gang: 20 New Leak-Site Claims in 72 Hours — Unverified Victim Postings, Detection Rules & Pre-Encryption Hunt Queries
N0N's leak site added 20 claimed victims across the US, Germany, Saudi Arabia and the UAE in ~48 hours. Here's what defenders should hunt for before encryption fires.
N0N Ransomware Gang: 15 Leak-Site Claims in 48 Hours — Victimology Analysis, Detection Rules & Pre-Encryption Hunt Content
N0N listed 15 organizations on its dark web leak site across Nov 3-4, concentrated in the US, Germany, Saudi Arabia, and the UAE. Sectors undisclosed; claims unverified. Detection content inside.
N0N Ransomware Gang: 16 Organizations Listed in 48-Hour Posting Surge — Targeting Analysis & Detection Rules
N0N's leak site added 16 organizations in 48 hours, concentrated in the US and Gulf states. All claims are unverified. Technology and unclassified-sector orgs in SA, US, AE, and MY should review the detection content inside.
N0N Ransomware Gang: 16 New Claims Posted on Dark Web Leak Site — Targeting Analysis & Detection Guidance
N0N ransomware gang has posted 16 new claims on its dark web leak site, primarily targeting organizations in Technology and undisclosed sectors across SA, US, AE, and MY.
N0N Ransomware Gang: 16 Organizations Named in Two-Day Posting Surge — Targeting Analysis & Detection Rules
N0N's leak site listed 16 organizations across the US, Saudi Arabia, UAE, and Malaysia in a 48-hour surge — mostly unverifiable claims. Technology and undisclosed-sector orgs should review edge-device and backup exposure now.
N0N Ransomware Gang: 12 New Leak-Site Claims Posted — US/UAE/Malaysia Targeting Analysis & Detection Engineering
N0N has listed 12 organizations on its dark web leak site across US, UAE, and Malaysia (claims unverified). Technology and professional services teams: review detections and IR priorities now.
N0N Ransomware Gang: 7 Leak-Site Listings in 4 Days — US-Heavy Campaign Analysis, Hypothesized Initial Access Paths & Detection Engineering
N0N posted 7 victim claims in four days — 6 multi-source confirmed, 5 US organizations listed on 2026-11-02 alone. Technology and professional services firms should review the detection content now.
N0N Ransomware Gang: 7 New Leak-Site Claims — Sector Targeting Analysis & Detection Rules
N0N posted 7 new claims (6 multi-source) across US, MY, and AE, targeting Technology and Professional Services. Includes Sigma, KQL, and hardening scripts for detection.
WHITEARMOR Ransomware Gang: 3 New Leak-Site Claims — Sector Targeting Analysis & Detection Rules
WHITEARMOR listed 3 organizations on its dark web leak site in 72 hours, spanning Technology, Transportation, and Other sectors in the US and PH. Unverified claims — defenders should hunt now.
N0N Ransomware Gang: 7 New Organizations Named on Dark Web Leak Site — Sector Targeting Analysis & Detection Rules
N0N ransomware has listed 7 organizations on its leak site in the past week, spanning Technology and Professional Services across the US, Malaysia, and UAE. Unverified claims — defenders should prepare for VPN exploitation, lateral movement, and pre-encryption staging.
CISA KEV Flash: 10 CVEs Added — Ivanti Connect Secure & PHP Under Active Exploitation
CISA confirms active exploitation of 10 new CVEs targeting Ivanti Connect Secure, PHP, GitLab, Cisco ASA/FTD, VMware ESX, Adobe Commerce, Linux Kernel, and Google Brotli. Federal remediation deadlines in effect. Patch now.
GENESIS Ransomware Gang: 9 New Listings Posted — Sector Targeting Analysis & Detection Rules
GENESIS listed nine US and Canadian organizations across financial, professional services, healthcare, and manufacturing sectors on 2026-10-30. Claims are unverified.
QILIN Ransomware Gang: 14 New Leak-Site Listings — Sector Targeting Analysis, Detection Rules & Response Playbook
QILIN has listed 14 organizations on its dark web leak site spanning manufacturing, transportation, energy, healthcare, and government across 8 countries. These remain unverified threat-actor claims — here is the detection and response guidance to act on.
AUDITTEAM Ransomware Gang: 4 New Listings Posted in 24 Hours — Dark Web Monitoring Brief
AUDITTEAM has listed four organizations on its dark web leak site, with suspected targets in the Netherlands and Singapore. Security teams should audit exposed remote access infrastructure and review backup isolation immediately.
THEGENTLEMEN Ransomware Gang: 4 New Claims Posted on Dark Web Leak Site — Sector Targeting Analysis & Detection Engineering Guidance
Security Arsenal observed THEGENTLEMEN list 4 new organizations on its dark web leak site between 2026-10-30 and 2026-10-31, spanning Technology and Government & Defense sectors across the US, Argentina, and France. All listings are single-source and unverified. Security teams in these sectors should review detection content immediately.
EMPERADOR Ransomware Gang: 4 New Leak-Site Listings — Sector Targeting Analysis & Detection Content
EMPERADOR has listed 4 organizations on its leak site across manufacturing, professional services, and retail (CH/IT). Claims unverified; defenders in-scope should hunt now.
SAFEPAY Ransomware Gang: 9 New Leak-Site Listings in a Single Day — Sector Targeting Analysis & Detection Rules
SAFEPAY posted 9 alleged victims to its leak site on 2026-10-31 spanning manufacturing, education, transportation, and agriculture. All listings are single-source, unverified claims — defenders in these sectors should hunt now.
EVERSTAKE Ransomware Gang: 5 New Listings Claimed — Sector Targeting Analysis, Hypothesized Exposure Paths & Detection Rules
EVERSTAKE listed five organizations on its leak site Oct 29–30. All claims are unverified threat-actor assertions; technology and undisclosed-sector orgs should review exposure and hunt now.
AKIRA Ransomware Gang: 6 New Listings Claimed — US Sector Targeting Analysis & Detection Rules
AKIRA has listed 6 new alleged victims on its leak site, spanning Energy, Manufacturing, Transportation, Healthcare, Professional Services, and Financial Services—all US-based. Organizations in these sectors should verify exposure to AKIRA's known TTPs and review detection posture.
SHIBA Ransomware Gang: 4 New Dark Web Listings — Agriculture, Healthcare, and Professional Services Targeting Analysis
SHIBA ransomware group posted 4 new victim claims on its dark web leak site, targeting Agriculture, Healthcare, and Professional Services organizations across the UK.
N0N Ransomware Gang: 3 New Leak-Site Listings in 72 Hours — Energy Sector Exposure, CVE Hypotheses & Detection Rules
N0N listed 3 organizations on its dark web leak site in 72 hours, including a Spanish energy firm. Energy, utilities, and Gulf-region enterprises should review detection posture now.
RHYSIDA Ransomware Gang: 4 New Leak-Site Listings — Financial, Professional Services & Energy Targeting Analysis with Detection Rules
RHYSIDA posted 4 new organizations to its dark web leak site spanning financial services, professional services, and energy sectors across US, BE, and MY. Detection rules and hunting queries included.
SILENTRANSOMGROUP: 6 New Leak-Site Listings Concentrated on US Professional Services — Verification Caveats, Detection Rules & Response Priorities
SILENTRANSOMGROUP listed 6 new victims — all single-source, unverified claims — heavily concentrated in US professional services. Legal and consulting firms should review exposure now.
EVEREST Ransomware Gang: 8 New Organizations Listed on Leak Site — Sector Targeting Analysis & Detection Engineering
EVEREST listed 8 new alleged victims spanning Technology, Professional Services, Energy & Utilities, Manufacturing, and Healthcare across Singapore and Italy. Defensive intelligence and detection rules inside.
BOOBA PROJECT Ransomware: 10 New Leak-Site Claims — Healthcare, Education & Municipal Targeting Analysis with Detection Rules
BOOBA PROJECT listed 10 organizations across healthcare, education, and government on its dark web leak site. All claims are single-source and unverified — here's what defenders need to do now.
WHITEARMOR Ransomware Gang: 12 Leak-Site Listings in 5 Days — Cross-Sector Claims Spanning US, DE, AR, and CN
WHITEARMOR listed 12 organizations on its dark web leak site between 2026-10-24 and 2026-10-28, claiming victims across technology, transportation, retail, and government sectors in four countries.
N0N Ransomware Gang: 12 New Leak-Site Listings Across Energy, Manufacturing & Professional Services — Targeting Analysis & Detection Rules
N0N's leak site added 12 claimed victims in 4 days spanning energy, manufacturing, technology, professional services and healthcare across AE, ES, BG, US, PT and AR. Detections and hunt queries inside.
N0N Ransomware Gang: 14 New Leak-Site Listings in 5 Days — Sector Targeting Analysis & Detection Rules
N0N posted 14 alleged victims to its dark web leak site between 2026-10-23 and 2026-10-27, spanning energy, manufacturing, healthcare, technology and professional services across six countries. Unverified claims — defensive guidance inside.
QILIN Ransomware Gang: 34 New Leak-Site Claims Posted — Sector Targeting Analysis & Detection Rules
QILIN's leak site shows 34 new claimed victims across energy, healthcare, and manufacturing. Unverified threat-actor claims — defenders in US/GB/DE sectors should hunt now.
N0N Ransomware Gang: 15 New Victims Claimed on Dark Web — Sector Analysis, Detection Rules & Response Playbook
N0N listed 15 alleged victims on its leak site in 72 hours, spanning energy, healthcare, manufacturing, and tech. Analysis, Sigma rules, KQL hunts, and IR priorities inside.
N0N Ransomware Gang: 15 New Leak-Site Postings in 4 Days — Sector Targeting Analysis, Detection Rules & IR Playbook
N0N ransomware gang listed 15 organizations across 8 countries in 96 hours, with energy, manufacturing, and healthcare in the crosshairs. Unverified threat-actor claims — detection content inside.
N0N Ransomware Gang Claims 20 New Victims — Sector Targeting Analysis & Detection Rules
N0N listed 20 organizations across energy, manufacturing, healthcare, and tech on its leak site in 3 days. Multi-sector enterprises should hunt for pre-encryption TTPs now.
EMPERADOR Ransomware Gang: 6 New Leak-Site Listings Across Technology, Energy, Manufacturing & Food Production — Claims Analysis & Detection Rules
EMPERADOR's leak site listed 6 new alleged victims in 72 hours spanning technology, energy, manufacturing, and food production across BE, DE, and the US. Unverified claims — detection rules included.
N0N Ransomware Gang: 22 Leak-Site Listings in Current Campaign — Sector Targeting Analysis & Detection Rules
Leak-site monitoring shows N0N listing 22 organizations across energy, manufacturing, healthcare and professional services. Security teams should hunt for VPN/RDP brute force, PsExec/WMI lateral movement, and shadow-copy tampering now.
N0N Ransomware Gang: 17 New Leak-Site Listings — Sector Targeting Analysis & Detection Rules
N0N has listed 17 organizations on its dark web leak site since 2026-10-22, spanning manufacturing, healthcare, tech, and energy. Unverified claims — defenders in those sectors should hunt now.
LAMASHTU Ransomware Gang: 7 Organizations Listed on Leak Site — FR/DE Sector Targeting Analysis & Detection Rules
LAMASHTU lists 7 FR/DE organizations across retail, manufacturing, food production and energy on its leak site — claims unverified; hunt guidance inside.
N0N Ransomware Gang: 17 New Leak-Site Claims in 4 Days — Sector Targeting Analysis, Detection Rules & IR Playbook
N0N's leak site added 17 victim claims in 96 hours across manufacturing, healthcare, technology, and energy sectors spanning 8 countries. Unverified claims — but defenders should act.
N0N Ransomware Gang Claims 18 New Victims in 48 Hours — Manufacturing, Healthcare & Tech Targeted
Leak-site monitoring shows N0N has claimed 18 organizations across eight countries in two days. Manufacturing and healthcare defenders should assume heightened exposure and hunt now.
N0N Ransomware Gang Lists 20 New Organizations on Dark Web Leak Site — Sector Targeting Analysis & Detection Rules
N0N posted 20 new claims on its leak site spanning Manufacturing, Healthcare, Energy, Tech & Retail across 8 countries. 12 listings are multi-source corroborated. Analysis and detection content inside.
N0N Ransomware Gang: 20 Leak-Site Listings in 72 Hours — Sector Targeting Analysis, Detection Rules & IR Priorities
N0N has listed 20 organizations on its dark web leak site since 2026-10-21, spanning healthcare, energy, manufacturing, and technology. Unverified claims — defenders in ES, US, CH, KR, TN should hunt now.
N0N Ransomware Gang: 21 New Leak-Site Listings in 72 Hours — Sector Targeting Analysis, Claim-Verification Caveats & Detection Rules
N0N's leak site added 21 claimed victims across manufacturing, energy, healthcare, retail and tech. Detection rules and hunting queries for security teams in scope.
N0N Ransomware Gang: 23 New Leak-Site Listings in 48 Hours — Sector Targeting Analysis & Detection Rules
N0N has listed 23 organizations on its dark web leak site since 2026-10-21, spanning retail, healthcare, and technology. Claims are unverified; defenders should hunt now.
N0N Ransomware: 23 Leak-Site Listings — Sector Targeting Analysis & Detection Rules
N0N leak-site monitoring shows 23 claimed listings across retail, healthcare and technology in the US, BG, KR, PT and elsewhere; hunt VPN/RDP access, staging and exfil.
N0N Ransomware Gang: 27 New Leak-Site Listings in 48 Hours — Sector Targeting Analysis & Detection Rules
N0N has listed 27 organizations on its dark web leak site in two days, spanning retail, healthcare, and technology sectors. US, European, and Asian orgs should review exposure now.
N0N Ransomware Gang: 24 Leak-Site Listings in One Week — Healthcare & Technology Sector Targeting Analysis with Detection Rules
N0N listed 24 organizations on its dark web leak site in recent days, heavily weighted toward US healthcare and technology. All listings are unverified threat-actor claims — see verification guidance inside.
CISA KEV Flash: 9 CVEs Added — Plex Media Server, BeyondTrust & Fortinet Under Active Attack
CISA added 9 actively exploited CVEs to the KEV catalog: Plex Media Server (4 CVEs), BeyondTrust auth bypass, Fortinet path traversal, and more. Patch immediately.
BOOBA PROJECT Ransomware Gang: 6 New Leak-Site Listings Targeting US Government, Healthcare & Education — Detection Rules & IR Playbook
BOOBA PROJECT has listed six US organizations across government, healthcare, and education on its dark web leak site. Unverified claims — defenders in these sectors should hunt now.
Showing 50 of 613 reports. Archive expands automatically as new intel is generated.
Every Ransomware Report Includes SIGMA & KQL Detection Rules
Every intelligence briefing on this page includes at least one Sigma rule, a Microsoft Sentinel KQL hunt query, and an IOC check script — ready to drop into your SIEM. No paywall. No registration.