Threat Watch · Jun 18, 2026
Data source: RansomLook
?days=1. Note: the real-time clock lags the 06-18 report date, so this API call still returned the 06-16 08:39 → 06-17 03:46 UTC window (overlapping the 2026-06-17 report). Some victim titles are redacted server-side; sector/geo must be inferred manually.
Overview
- Total new posts: 23
- Groups involved: 15(payload, deadlock, icarus, nightspire, cloak, nova, qilin, akira, aurora, dragonforce, fulcrumsec, shadowbyt3$, inc ransom, shinyhunters, ransomhouse)
- Most active: aurora / nightspire / cloak with 3 posts each
- Watchlist hits: 4(group hits: qilin, akira, inc ransom×2); plus several high-value victims (Novo Nordisk, Nintendo, Ralph Lauren, Sumitomo)
Watchlist Hits (read first)
| Group | Victim | Sector | Geo | Hit | Discovered (UTC) |
|---|---|---|---|---|---|
| qilin | Golfview Developmental Center | Healthcare (rehabilitation/special-education facility) | US? | group:qilin, sector:medical | 06-16 14:48 |
| akira | Insite Architects | Architecture / professional services | — | group:akira | 06-16 15:45 |
| inc ransom | framesiprofessional.com | Consumer goods / manufacturing | — | group:inc | 06-16 17:47 |
| inc ransom | jasperplastics.info | Manufacturing (plastics) | US? | group:inc, sector:manufacturing | 06-16 19:48 |
Notable High-Value Victims (non-watchlist groups)
| Group | Victim | Note |
|---|---|---|
| fulcrumsec | Novo Nordisk | Danish pharmaceutical giant (GLP-1 class drugs), healthcare/pharma sector; high impact if confirmed |
| shadowbyt3$ | NINTENDO BREACH (nintendo.com) | Claims to have breached Nintendo (title mentions "TINYpulse"), continuing the earlier Nintendo extortion narrative |
| shinyhunters | Ralph Lauren | Fashion retail; ShinyHunters is one of the most active gangs of 2026 |
| aurora | Sumitomo Electric Bordnetze | Sumitomo Electric's automotive wiring-harness subsidiary; automotive manufacturing supply chain |
| nova | Sunass | Peru's national water and sanitation services regulator; critical-infrastructure (water) related |
All New Posts
| Group | Victim | Discovered (UTC) |
|---|---|---|
| payload | SPORTON International Inc. | 06-16 08:39 |
| deadlock | Notice | 06-16 11:07 |
| icarus | thecreditpros.com | 06-16 12:45 |
| nightspire | Guy E*** & F***, P.A | 06-16 12:45 |
| cloak | W***S***D | 06-16 13:09 |
| cloak | d***e | 06-16 13:09 |
| cloak | ra-***e | 06-16 13:09 |
| nightspire | Ri*** Co*** Europe S.r.l. | 06-16 13:46 |
| nightspire | Central Texas ***** | 06-16 13:46 |
| nova | Sunass | 06-16 13:46 |
| qilin ⭐ | Golfview Developmental Center | 06-16 14:48 |
| akira ⭐ | Insite Architects | 06-16 15:45 |
| aurora | Sumitomo Electric Bordnetze | 06-16 15:45 |
| aurora | Diamond Truck Centres | 06-16 15:45 |
| aurora | Allan Brothers Fruit | 06-16 15:45 |
| dragonforce | Tecfi SpA | 06-16 15:46 |
| fulcrumsec | Novo Nordisk | 06-16 15:46 |
| shadowbyt3$ | NINTENDO BREACH (nintendo.com) | 06-16 16:48 |
| inc ransom ⭐ | framesiprofessional.com | 06-16 17:47 |
| shinyhunters | Ralph Lauren | 06-16 17:48 |
| inc ransom ⭐ | jasperplastics.info | 06-16 19:48 |
| ransomhouse | Promepla | 06-16 20:48 |
| shinyhunters | Service Notice: Scheduled Maintenance and Infrastructure Upgrades | 06-17 03:46 |
Anomalies / Trend Notes
- Data window did not advance: this issue's API returned the same 06-16→06-17 window as yesterday (real-time clock lag), so there are no genuinely "new" victims; incremental coverage should resume once the clock realigns on the next run.
- Big-name victims clustered: Novo Nordisk (pharma), Nintendo (gaming), Ralph Lauren (retail), and Sumitomo (automotive manufacturing) appearing on the same day; any one of them, if confirmed, would be a high-impact event; keep tracking subsequent leak/extortion moves.
- aurora bulk listing: aurora published 3 posts within the same minute at 06-16 15:45 — likely backlogged data going live all at once.
- Critical-infrastructure signal: nova listed Sunass (Peru's water regulator); watch the water/utilities direction.
- Watch new/lesser-known groups: fulcrumsec, shadowbyt3$, aurora, payload, icarus, nova and other relatively new names — keep them under observation to determine whether any are rebrands.