Ransomware Watch · Aug 31, 2026

146 victim disclosures from 2 cross-verifying trackers (RansomLook, ransomware.live) over the last 36 hours, merged into 111 distinct claims from 16 groups.

Group activity

Orova and Zawoo led volume with small, low-profile targets. Orova claimed 17 victims — mostly small firms (CPA practices, veterinary clinics, a church, a property association) with no single high-profile name among them. Zawoo claimed around 20, mostly small manufacturers and service firms in Germany and Czechia (BOTEC-CZ, Hörburger, Montronix, Kdynium, Winterdienst Berlin), plus several victims RansomLook logged only as unresolved company IDs.

Thegentlemen posted 16 new victims, the most notable being Glassdoor, alongside a spread of small manufacturing, logistics, and services firms across multiple countries (G R Infraprojects, Thai Film Industries PCL, Servicios Aereos Estrella). Both trackers logged the same 16 claims independently — a clean cross-source match.

Qilin claimed 12 victims, concentrated in construction and industrial firms (Bandit Industries, Black Cat Engineering Construction, Neumaticos Corral), plus healthcare group AFSARD and pharma supplier Crystalpharmatech.

Notable targets

Direwolf hit two hospitals and a game publisher. Erdem Hospital and Hospital Clínico Universidad de Chile were both claimed, alongside THQ Nordic, a publicly listed video game publisher.

Falcon claimed two publicly traded targets: Globus Medical (NYSE-listed medical device maker) and DistributionNOW / DNOW Inc. (NYSE-listed industrial distributor).

Shinyhunters claimed Neogen Corporation, a Nasdaq-listed food and animal safety science company — a single claim from a group better known for large-scale data-extortion campaigns rather than encryption-style ransomware posts.

Dysphor1a's claims skewed toward institutions: The University of Delhi and an "Indonesian Police Database" were both listed, alongside Ayudhya Thailand Insurance and Yoma Fleet.

Sources: RansomLook — Global Posts RSS · ransomware.live