Ransomware Watch · Jun 20, 2026
Data source: RansomLook
/api/posts?days=1(public endpoint). Window covers the past ~24h (discovered 2026-06-18 → 2026-06-19).
Overview
- Total new posts: 13
- Groups involved: 9 (qilin ×3, aurora ×2, nightspire ×2, all others ×1)
- Watchlist hits: 3 (all from the qilingroup; watchlist-group hits)
- Top 3 most active groups: qilin(3), aurora(2), nightspire(2)
Watchlist Hits (read first)
| Group | Victim | Sector | Geo | Hit | Discovered |
|---|---|---|---|---|---|
| qilin | Homes By J Anthony | Construction/home building | — | group:qilin | 2026-06-18 |
| qilin | ATCOM Outsourcing | IT/outsourcing | — | group:qilin | 2026-06-18 |
| qilin | THL Project Management Sdn. Bhd. | Engineering/project management | MY | group:qilin | 2026-06-18 |
qilin remains the most active high-threat group on the watchlist: 3 victims in a single day across construction, IT outsourcing, and engineering management, with no clear sector preference (opportunistic).
All New Posts
| Group | Victim | Sector | Geo | Discovered |
|---|---|---|---|---|
| qilin | Homes By J Anthony | Construction/home building | — | 2026-06-18 |
| qilin | ATCOM Outsourcing | IT/outsourcing | — | 2026-06-18 |
| qilin | THL Project Management Sdn. Bhd. | Engineering/project management | MY | 2026-06-18 |
| cloak | ra-vogeler.de | General business | DE | 2026-06-18 |
| nightspire | dean cosmetic dentistry | Healthcare/dental 🩺 | — | 2026-06-18 |
| nightspire | legendsmn (Blue Ox / Paul Bunyan / Lumberjack Electric) | Electric power/utilities ⚡ | US | 2026-06-18 |
| shinyhunters | icsecurity.com | Security services | — | 2026-06-19 |
| aurora | ALS Global | Testing/certification | — | 2026-06-19 |
| icarus | Klue.com | SaaS/competitive intelligence | — | 2026-06-19 |
| anubis | KTR Real Estate Advisors | Real estate | — | 2026-06-19 |
| pear | Optimum First Mortgage | Finance/mortgage 💰 | US | 2026-06-19 |
| aurora | Hagerman & Company | IT services | — | 2026-06-19 |
| nova | Desert Micro | IT/electronics | US | 2026-06-19 |
🩺/⚡/💰 = sector-sensitive (healthcare / utilities / finance); not a literal watchlist keyword hit, but high-attention sectors, flagged manually.
Anomalies / Trend Notes
- Cluster of new / low-frequency groups: cloak, nightspire, shinyhunters, aurora, icarus, anubis, pear, and nova were all active on the same day — a high share of small/emerging ransomware brands, with fragmented sector distribution (opportunistic attacks rather than a targeted sector campaign).
- Sector-sensitive hits: a dental clinic (dean cosmetic dentistry), an electric utility (Lumberjack Electric), and a mortgage lender (Optimum First Mortgage), 1 each — healthcare, utilities, and finance, three highly sensitive sectors, were all named on the same day; worth watching, but isolated cases, not yet a cluster.
- Geography: identifiable geography is mostly US, plus DE and MY with 1 each; no CN/HK/TW/SG hits.
- qilin remains prolific: the only watchlist group on the board, continuing its high-activity streak of 2025–2026.