Threat Watch · Jun 13, 2026
Window: past 24 hours (2026-06-12 → 2026-06-13). Degraded data-source notice: RansomLook
/api/postsand RSS could not be pulled directly from the sandbox this cycle (provenance/egress restrictions). The victim data below was reconstructed via WebSearch from ransomware.live and leak-tracking sites; it is not a complete leak-site snapshot, covers only the named victims that could be retrieved, and the counts are lower bounds.
Overview
- New posts (visible sample): 8+(the actual leak-site total for the day is higher; restrictions prevented a full pull)
- Groups involved: 4+(DragonForce, Qilin, ShinyHunters, Lockbit5)
- Watchlist hits: 4(multiple hits across group and sector)
- Most active: DragonForce(several manufacturing/industrial victims in one day), followed by Qilin
Watchlist hits (read first)
| Group | Victim | Sector | Geo | Hit | Link |
|---|---|---|---|---|---|
| DragonForce | Areco Steel | steel / manufacturing | — | sector:manufacturing | ransomware.live |
| DragonForce | Astec Valves & Fittings Pvt Ltd | valves / manufacturing | India (IN) | sector:manufacturing | ransomware.live |
| Qilin | Bitek System Inc. | electronics / manufacturing | — | group:qilin · sector:manufacturing | ransomware.live |
| (unattributed) | Cheoy Lee Shipyards | shipbuilding / maritime | Hong Kong-linked (HK) | sector:shipping | ransomware.live |
All new posts (visible sample)
| Group | Victim | Sector | Geo | Discovered | Link |
|---|---|---|---|---|---|
| DragonForce | Areco Steel | steel / manufacturing | — | 2026-06-12 | ransomware.live |
| DragonForce | Astec Valves & Fittings | valves / manufacturing | IN | 2026-06-12 | ransomware.live |
| DragonForce | Çekok Gıda | agriculture / food | TR | 2026-06-12 | ransomware.live |
| DragonForce | Brian Cox (real estate) | real estate | — | 2026-06-12 | ransomware.live |
| Qilin | Bitek System Inc. | electronics / manufacturing | — | 2026-06-12 | ransomware.live |
| (unattributed) | Cheoy Lee Shipyards | shipbuilding / maritime | HK | 2026-06-12 | ransomware.live |
| (unattributed) | Al Ishrak Contracting | construction / contracting | — | 2026-06-12 | ransomware.live |
| (unattributed) | DISTINET MURCIA SL | business services | ES | 2026-06-12 | ransomware.live |
| ShinyHunters | Nexstar (>1M Salesforce records) | media / broadcasting | US | 2026-06-11 | resecurity |
| ShinyHunters | Ralph Lauren (>220GB PII) | retail / apparel | US | 2026-06-11 | resecurity |
Anomalies / trend notes
- DragonForce dumped an industrial/manufacturing cluster in one day: Areco Steel, Astec Valves, Çekok Gıda and other industrial/manufacturing/food companies were named the same day — manufacturing remains a high-frequency target, and DragonForce's "cartel/alliance" expansion posture warrants attention.
- Qilin stays on the board: continuing its Q1 2026 lead (top in May with 11 victims), it named Bitek System (electronics manufacturing) in this window.
- ShinyHunters / "Trinity of Chaos" leak site: built primarily around Salesforce-linked data exfiltration, naming Nexstar (>1 million Salesforce records) and Ralph Lauren (>220GB of PII) — an "extortion as data exfiltration" model, distinct from traditional encryption-based ransomware.
- Maritime / critical sectors: Cheoy Lee Shipyards (shipbuilding/maritime, Hong Kong-linked) was named; watch shipping and shipbuilding as a relatively low-frequency but high-value target set.
- Data gap: because of the RansomLook restriction, full sector/geography statistics are not possible today; the table above is a lower-bound sample of what could be retrieved, so do not read it as the day's total leak-site volume.
Watchlist configuration is in intel/ransomware/watchlist.yaml. Data sources: ransomware.live / Resecurity (reconstructed via WebSearch).