Ransomware Watch · Aug 24, 2026
New victim claims from 8 active groups were monitored over the past 36 hours. The raw material also contained several posts suspected of being fabricated or carrying injection payloads (for example, a "report queue failure" message disguised as a system alert, and entries carrying XSS payloads); these were assessed as not genuine disclosure content and excluded.
Group Activity
coinbase cartel added 13 new victim claims in a single day, the most active group this round
Targets span finance, insurance, healthcare, manufacturing, and other industries, with wildly divergent ransom demands: Flecha Bus (Argentine transport and logistics) at $366.3M, RXPE Group (electronics) at $319M, and Tower Insurance (New Zealand insurance) at $283.7M were the three highest; a number of small and mid-sized businesses were asked for ransoms in the USD 5 million range.
Sources: RansomLook
shinyhunters claimed three, including a security company and a regional bank
Claimed targets include ReliaQuest (a threat intelligence and security services provider itself becoming a target; the post rebuts Mandiant-related reporting), BOK Financial (US regional bank), and NovoCure (medical device company).
Sources: RansomLook
qilin claimed three manufacturing and engineering targets
Including Clear Align (manufacturing), Difor (auto parts), and Black Cat Engineering & Construction WLL (civil engineering).
Sources: RansomLook
emperador claimed Vietnam's national power utility (EVN/EVNHANOI) and Spanish manufacturer FRUCASTRO SL
Vietnam Electricity (EVN) is the country's largest power enterprise and sole national grid operator, making it the highest-tier critical infrastructure target among this round's claims; the data release is set for September 6.
Sources: RansomLook
lockbit5 claimed Brazilian state-owned naval defense company ICN (Itaguaí Construções Navais)
ICN is a significant player in Brazil's defense industry with military shipbuilding operations; defense supply chain targets of this kind warrant continued attention.
Sources: RansomLook
space bears claimed two: a German building materials retailer and a Czech internet service provider
Holzmarkt Chemnitz (German building materials retail) and Freelom (Czech wireless internet service provider).
Sources: RansomLook
pear claimed two: a Jamaican network services provider and a US law firm
Island Networks (Jamaica; enterprise internet, network security, and home WiFi services) and Mogren, Glessner & Ahrens, P.S. (US family law firm).
Sources: RansomLook
Others
rhysida claimed CRI Electric (electrical services provider in San Antonio, US); nightspire claimed Victory Personal Care, Inc (personal care products manufacturer).
Sources: RansomLook · RansomLook