Threat Watch · Jun 27, 2026

Data source: RansomLook /api/posts?days=1 (24h window, latest entry 2026-06-26T15:57)

Overview

• Total new posts: 20
• Groups involved: 15
• Watchlist hits: 3(akira ×1, inc ransom ×2)
• Most active: payload(3), chaos / inc ransom / nova (2 each)

Watchlist Hits (read these first)

Also Noteworthy (no automatic hit, but sensitive sector/target)

• leaknet — MagMutual: a cyber insurance carrier, with a claimed leak of 7.3M records("The Cyber Insurer Who Couldn't Cyber"). Financial / insurance, large volume.
• interlock — Clearview Eye Centre: an ophthalmology provider (healthcare).
• payload — Clínica La Sabana: a clinic (healthcare), one of payload's 3 victims that day.
• the gentlemen — Atlas Elektronik: German naval defence electronics (defence / manufacturing).
• nova — NSW Rural Fire Service: the New South Wales Rural Fire Service, Australia (government / emergency services).
• krybit — politur.gob.do: the Dominican national police (government).

All New Posts

Anomalies / Trend Notes

• payloadposted 3 entries back to back (Software Arge / Clínica La Sabana / Mosaic Partners), all within the same minute at 12:59 — likely a bulk release of a backlog of victims; worth continuing to watch its activity level.
• inc ransomlisted 2 new victims at once (agrochemical + services), maintaining steady output.
• Government / emergency targets rising: this window brought two government / public-safety targets — NSW Rural Fire Service (Australia) and politur.gob.do (the Dominican national police).
• Healthcare hit again: interlock (ophthalmology) plus payload (clinic); healthcare remains a high-frequency target.
• No new posts from the priority watchlist groups lockbit / qilin / play / cl0p / medusa / ransomhub in this window.