Threat Watch · Jun 6, 2026
Window: past 24 hours (2026-06-05 → 2026-06-06)
⚠️ Data basis: the RansomLook API / RSS is blocked under the current sandbox egress allowlist (host not on the allow list). This edition instead cross-checks aggregated second-hand sources via WebSearch (breachsense / ransomware.live / hendryadrian and others); per-victim accuracy cannot be guaranteed at 100%.
Overview
- Total new posts (aggregate estimate): ~30–40, across ~90 active leak sites
- Most active groups: Qilin, Akira, Play, INC Ransom, Nightspire; DragonForce / Worldleaks / LockBit also posted new entries
- Watchlist hits: roughly 12+ (see the table below)
- Quarterly picture unchanged: Qilin still #1 (>1,700 victims tracked), Akira #2; Qilin/Akira/Gentlemen/LockBit together account for ~41% of all 2026 victims
Watchlist hits (read first)
| Group | Victim | Sector | Geo | Hit | Link |
|---|---|---|---|---|---|
| Qilin | Trican Well Service | oilfield services / energy | CA | group:qilin · sector:oil/energy | ransomware.live |
| Play | Urschel Laboratories | manufacturing | US | group:play · sector:manufacturing · geo:us | hendryadrian |
| Play | Corley Manufacturing | manufacturing | US | group:play · sector:manufacturing · geo:us | breachsense |
| Akira | Kennon Worldwide | manufacturing | US | group:akira · sector:manufacturing · geo:us | breachsense |
| Akira | Oaks Park | mixed | US | group:akira · geo:us | breachsense |
| INC Ransom | (manufacturing victim) | manufacturing | — | group:inc · sector:manufacturing | breachsense |
| LockBit | (new victim) | mixed | — | group:lockbit | breachsense |
| Nightspire | First Mutual Holdings | financial | US | sector:financial · geo:us | breachsense |
| Worldleaks | Access Dental | healthcare / dental | US | sector:healthcare/medical · geo:us | breachsense |
| (claim) | Sierra Vista Hospital | hospital | US | sector:hospital/healthcare · geo:us | breachsense |
| (claim) |
All new posts (24h aggregate, selection)
| Group | Victim | Sector | Geo | Discovered | Link |
|---|---|---|---|---|---|
| Qilin | Trican Well Service | oilfield services | CA | 2026-06-05 | link |
| Play | Urschel Laboratories | manufacturing | US | 2026-06-05 | link |
| Play | Corley Manufacturing | manufacturing | US | 2026-06-05 | link |
| Akira | Kennon Worldwide | manufacturing | US | 2026-06-05 | link |
| Akira | Oaks Park | mixed | US | 2026-06-05 | link |
| Nightspire | First Mutual Holdings | financial | US | 2026-06-05 | link |
| Nightspire | Krum Public Library | public / education | US | 2026-06-05 | link |
| Worldleaks | Access Dental | healthcare | US | 2026-06-05 | link |
| AiLock | Don Don | food manufacturing | SI | 2026-06-05 | link |
| Genesis | Avcon Jet | aviation | AT | 2026-06-05 | link |
| INC Ransom | National Standard Parts |
Anomalies / trend notes
- Healthcare and manufacturing both elevated: today's watchlist hits cluster clearly in US healthcare (Sierra Vista Hospital, Family Medical Associates, Access Dental) and manufacturing (Urschel, Corley, Kennon, National Standard Parts, Stuga). Qilin continues to hit energy/oilfield services (Trican Well Service), matching its year-long preference for OT and critical infrastructure.
- Play posted two manufacturing victims in one day(Urschel, Corley), continuing its steady output cadence against mid-sized industrial firms.
- Geography is still overwhelmingly US-dominated, but today brought non-US targets including Austria (Avcon Jet / Genesis), Slovenia (Don Don / AiLock), and Canada (Trican, Groupe Sécurité), suggesting smaller groups are broadening across Europe and North America.
- The ransom payment rate remains at a historic low(~28% in recent statistics), forming a "more attacks, fewer payments" pattern alongside rising victim counts.