Threat Watch · Jun 25, 2026
Source: RansomLook
api/posts?days=1(new leak-site posts over the past 24h). Watchlist hits are pinned and highlighted at the top.
Overview
- Total new posts: 28
- Groups involved: 7
- Watchlist hits: 6
Watchlist Hits (read these first)
| Group | Victim | Sector | Geo | Hit | Discovered (UTC) |
|---|---|---|---|---|---|
| anubis | Quest Health Solutions | healthcare | — | sector:health | 2026-06-25 00:22 |
| akira | Miami Machine | manufacturing | US | group:akira | 2026-06-24 14:51 |
| akira | Jit Ex | — | — | group:akira | 2026-06-24 15:53 |
| qilin | Cash Canada | financial | CA | group:qilin | 2026-06-24 13:51 |
| inc ransom | horizoneye.com | — | — | group:inc | 2026-06-24 15:53 |
| the gentlemen | CHIFENG GOLD SEPON | mining | CN | geo:china | 2026-06-24 13:48 |
All New Posts
| Group | Victim | Discovered (UTC) |
|---|---|---|
| nova | lpgroup.pt | 2026-06-24 11:50 |
| the gentlemen | Meccanica Gn | 2026-06-24 13:28 |
| the gentlemen | Gegenbauer Elektrotechnik | 2026-06-24 13:38 |
| the gentlemen | Stadttheater Giessen | 2026-06-24 13:38 |
| the gentlemen | BDS CZ | 2026-06-24 13:38 |
| the gentlemen | Beran Concrete | 2026-06-24 13:38 |
| the gentlemen | Al Dhow Group | 2026-06-24 13:38 |
| the gentlemen | Natren | 2026-06-24 13:48 |
| the gentlemen | CHIFENG GOLD SEPON | 2026-06-24 13:48 |
| the gentlemen | Bell Hardware | 2026-06-24 13:48 |
| the gentlemen | Plateau Excavation | 2026-06-24 13:48 |
| nova | alejandria.biz | 2026-06-24 13:51 |
| qilin | Cash Canada | 2026-06-24 13:51 |
| the gentlemen | Au Vieux Campeur | 2026-06-24 14:30 |
| akira | Miami Machine | 2026-06-24 14:51 |
| nova | transvill.com.pe | 2026-06-24 14:51 |
| akira | Jit Ex | 2026-06-24 15:53 |
| inc ransom | horizoneye.com | 2026-06-24 15:53 |
| nova | transvill | 2026-06-24 17:54 |
| nova | alejandria | 2026-06-24 17:54 |
| nova | lpgroup | 2026-06-24 17:54 |
| stormous | impulso-store.com | 2026-06-24 20:52 |
| stormous | montechiaro-store.com | 2026-06-24 20:52 |
| stormous | lorenzoni-store.com | 2026-06-24 20:52 |
| stormous | maglificioliliana.com | 2026-06-24 20:52 |
| stormous | jaggroup.com (FULL DATA DUMP) |
Anomalies / Trend Notes
- Single-group surge:
the gentlemenposted 11 victims in one day, spanning manufacturing (Meccanica Gn, Natren), construction (Beran Concrete, Plateau Excavation), retail (Au Vieux Campeur, Bell Hardware) and cultural institutions (Stadttheater Giessen), with geography stretching across Europe (Germany / Czechia / France), Kuwait (Al Dhow Group) and China (CHIFENG GOLD SEPON, Chifeng Gold's mining operation). - Healthcare hit:
anubisposted Quest Health Solutions— a healthcare victim; worth tracking whether it escalates to double extortion. - stormous e-commerce batch: all 6 posts are online retail sites (impulso / montechiaro / lorenzoni and others), including 2 "FULL DATA DUMP" updates (jaggroup, mlit.com.my at 10GB), suggesting the group has moved into the data-release pressure phase.
- nova duplicate postings: lpgroup / alejandria / transvill each appear twice (once with the domain suffix, once as a short name); after deduplication the real victim count is about 3.
- RansomLook
?days=1returns only group_name + post_title + discovered; sector/geo are manual inferences from victim names and are indicative only.
Archive: intel/ransomware/daily/ · watchlist: intel/ransomware/watchlist.yaml