Threat Watch · Jun 24, 2026
Source: RansomLook
api/posts?days=1(new leak-site posts over the past 24h). Watchlist hits are pinned and highlighted at the top.
Overview
- Total new posts: 30
- Groups involved: 15
- Watchlist hits: 7
Watchlist Hits (read these first)
| Group | Victim | Sector | Geo | Hit | Discovered (UTC) |
|---|---|---|---|---|---|
| akira | Ntd Apparel | apparel | — | group:akira | 2026-06-22 18:52 |
| akira | IH Engineers | engineering | — | group:akira | 2026-06-23 14:50 |
| akira | Leo International | — | — | group:akira | 2026-06-23 14:50 |
| qilin | Schumacher Homes | construction | US | group:qilin | 2026-06-22 23:52 |
| inc ransom | belpointeasset.com \ belpointe.com | financial | US | group:inc · sector:financial | 2026-06-23 01:49 |
| cmd organization | EON Meditech Pvt | medical | IN | sector:medical | 2026-06-22 23:51 |
| interlock | Reynella East College | education | AU | sector:education | 2026-06-23 16:50 |
All New Posts
| Group | Victim | Discovered (UTC) |
|---|---|---|
| aurora | Aerospace & Advanced Composites GmbH | 2026-06-22 17:51 |
| prinz eugen | NEW PRINZ EUGEN SITE [NOT A CASE FILE] | 2026-06-22 17:51 |
| akira | Ntd Apparel | 2026-06-22 18:52 |
| brain cipher | eggetttax.ca | 2026-06-22 21:50 |
| brain cipher | sterlinggloballtd.com | 2026-06-22 21:50 |
| chaos | graymont.com | 2026-06-22 22:55 |
| cmd organization | EON Meditech Pvt | 2026-06-22 23:51 |
| icarus | Cbassociations | 2026-06-22 23:51 |
| icarus | Cqcrm | 2026-06-22 23:51 |
| icarus | Gms-net | 2026-06-22 23:51 |
| icarus | HDS (Hdscorp) | 2026-06-22 23:51 |
| icarus | Huntress | 2026-06-22 23:51 |
| payoutsking | ****** | 2026-06-22 23:52 |
| qilin | Schumacher Homes | 2026-06-22 23:52 |
| safepay | ehg.bayern | 2026-06-22 23:52 |
| ransomhouse | [DISCLOSED] Karl Chevrolet | 2026-06-23 00:47 |
| inc ransom | belpointeasset.com \ belpointe.com | 2026-06-23 01:49 |
| chaos | randa.net | 2026-06-23 08:48 |
| aurora | Corporación Primax S.A. | 2026-06-23 09:48 |
| nova | FTL - Fast Transit Line | 2026-06-23 11:51 |
| eraleign (apt73) | viennaairport.com | 2026-06-23 12:50 |
| icarus | C* | 2026-06-23 13:48 |
| icarus | G* | 2026-06-23 13:48 |
| icarus | H** | 2026-06-23 13:48 |
| icarus | H* | 2026-06-23 13:48 |
| akira | IH Engineers | 2026-06-23 14:50 |
Anomalies / Trend Notes
- New group online:
prinz eugenposted "NEW PRINZ EUGEN SITE" — apparently the first appearance of a new leak site. Worth opening a file on it and tracking whether it converts into a formal case. - Most active:
icarus(9 posts, including 4 masked placeholder titles, suggesting staged data release),akira(3),eraleign (apt73)(3). - High-value targets:
eraleign (apt73)posted bothgov.br(Brazilian government domain) andviennaairport.com(Vienna Airport) in a single day — government plus critical transport infrastructure, an elevated threat profile. - Sector concentration: hits across finance (belpointe / INC), education (Reynella East College / interlock) and healthcare (EON Meditech / cmd organization).
- RansomLook
?days=1returns only group_name + post_title + discovered, with no victim sector/geo fields; the sector/geo values above are manual inferences from victim names and are indicative only.
Archive: intel/ransomware/daily/ · watchlist: intel/ransomware/watchlist.yaml