Threat Watch · Jun 11, 2026

Data source: RansomLook /api/posts?days=1 (window ending 2026-06-09 14:50 UTC, the most recent data this API call returned). This call returned only group_name and discovered, with no victim / sector / geo fields, so the victim table is based mainly on group activity and sector / geography matching is unavailable today.

Overview

• Total new posts: 32
• Groups involved: 7
• Watchlist hits (by group): 3 groups(lockbit5 → lockbit, qilin, akira)
• Standout observation: LockBit5 dumped 16 posts in a single-day burst, half of the day's total — an apparent bulk upload or comeback surge.

Watchlist hits (read first)

All new posts (aggregated by group)

ℹ️ This API call returned no victim names. A victim named on the news side (not from the API): BCD Travel (ShinyHunters, roughly 396,000 customer records already dumped publicly).

Anomalies / trend notes

• LockBit5 burst: 16 posts in one day, half the daily total, matching a "bulk upload" or post-rebrand clearing-out pattern; cross-checking whether the victim list and timestamps on its leak site represent a one-off backfill is recommended.
• Qilin stays elevated: consistent with the in-the-wild Check Point VPN 0-day campaign (CVE-2026-50751) — the VPN initial-access → Qilin deployment chain is worth tracking.
• Data gap: the API returned no victim/sector fields, so sector concentration and geographic analysis are not possible. For a complete victim table, scraping the RansomLook /recentpage or fixing RSS parsing is recommended.

---

Configuration is in the ransomware category of intel/sources.yaml · watchlist: intel/ransomware/watchlist.yaml