Overview
- Total new posts (RansomLook API, days=1): 6 (stalled, identical to 06-28 → 06-30)
- Groups involved: 5 (redact, play, safepay, cmd organization)
- Watchlist hits: 2 (both from the play group, carried over)
- Data status: the latest
discoveredon RansomLook days=1is frozen at 2026-06-28T12:52Z, a third consecutive day without movement. The tables below are a carried-over snapshot; the API returned nothing new today.
Watchlist Hits (read these first)
| Group | Victim | Sector | Geo | Hit | Link |
|---|
| play | Kuhnline | manufacturing (inferred) | US (inferred) | group:play | RansomLook |
| play | J&J Gaming | gaming | US (inferred) | group:play | RansomLook |
All New Posts (RansomLook API snapshot, carried over)
| Group | Victim | Sector | Geo | Discovered | Link |
|---|
| redact | FCCI Insurance Group | insurance | US | 2026-06-27T20:20Z | RansomLook |
| redact | Hologic | medical/diagnostics | US | 2026-06-27T20:22Z | RansomLook |
| play | Kuhnline | manufacturing | US | 2026-06-27T20:59Z | RansomLook |
| play | J&J Gaming | gaming | US | 2026-06-27T20:59Z | RansomLook |
| safepay | hellmold-plank.de | manufacturing | DE | 2026-06-27T20:59Z | RansomLook |
| cmd organization | Fidelity Security Group | security services | — | 2026-06-28T12:52Z | RansomLook |
Open-Source Reporting Supplement (beyond the API; today's WebSearch)
- The Gentlemen (RaaS)— by publicly claimed victim count the group has risen to second most active(182 distinct victims), and is building a full EDR-killer toolset around the GentleKillerframework. Worth continued cross-source tracking.
- Qilin → KUNERT Fashion— a textile/fashion sector victim reported on 6/30, attributed to Qilin.
Anomalies / Trend Notes
- RansomLook API stalled for 3 consecutive days(06-28 → 07-01 return the same payload) — apparently a feed/collection-side issue. Today's ransomware picture should be based on open-source reporting (The Gentlemen, Qilin); do not misread "no new posts" as a decline in activity.
- Industrialized EDR killers: The Gentlemen's GentleKiller continues the 2025-2026 RaaS trend of shipping driver-level defence evasion tooling. Verify EDR tamper-protection configuration.
- Dormant/surging groups: this snapshot carries no reliable "sudden surge" signal, owing to the stalled data.
Data sources: RansomLook API/RSS plus open-source reporting; watchlist: see intel/ransomware/watchlist.yaml