Ransomware Watch · Aug 27, 2026
Cross-validated across RansomLook and ransomware.live (dual-source, per the sources config): 109 raw victim-claim posts collapse to 64 distinct victim claims from roughly 20 active groups in the last 36 hours.
Most Active Groups
Krybit — 12 victims claimed
The heaviest single-group day in this window: 12 organizations named in rapid succession, spanning Thailand (sysconth.com), Brazil (neooftalmo.com.br), Vietnam (sankovn.com), and Guatemala (ferretornillos.gt), among others.
Sources: ransomware.live · RansomLook
Qilin — 11 victims claimed
Targets include Brazosport College (Texas) and a spread of manufacturing and financial-services firms: Metal Conversions, California Truck Equipment, Northern Leasing Systems, WireCo, Air International Thermal Systems, and Structured Settlement Capital LLC.
Sources: ransomware.live · RansomLook
Akira — 5 victims claimed
Includes Gill Rock Drill, an Oral and Maxillofacial Surgery practice, and German engineering firm WINTER Ingenieure.
Sources: RansomLook
The Gentlemen — 5 victims claimed
All five posted within an 8-minute window: Party Rental, TEC Container, Verbux, Espinos, and Incolur.
Sources: RansomLook
Notable Targets
National Kidney Registry claimed by Direwolf — a nonprofit healthcare-adjacent organization coordinating living-donor kidney exchanges.
Sources: ransomware.live
Knottingham Trent University claimed by ShadowByt3$, alongside Sinar Mas Agribusiness and Food (Golden Agri-Resources) and A-Plus Software Limited — the group's only three posts in this window span higher education, agribusiness, and software.
Sources: ransomware.live
Also Claimed This Window
Single- or double-victim claims from AuditTeam (Demidov Steel Group), Orova (Central Florida Civil, Arich Enterprise, Bai-chi CPA Firm), Chaos (parkderochie.com, mswalker.com, copcp.com), Global Secret Group (Johnson City Honda, Lockheed Architectural Solutions, Tiseo Paving), AiLock (Morgan Services, Hamilton), Deadlock (FBC, Global Terminal Services), Dark Project (a New Britain, CT dental practice; Pump Engineering Company), Eclipse (Simplex Engineering), Aurora (ERPIS LLC), Abyss-Data (MEMSIC), SafePay (an Air Liquide Korea industrial subdomain), Genesis, Majinahanashi (PCA Group Sdn. Bhd.), and Beast (Cosmon).
Sources: RansomLook — Global Posts · ransomware.live