Data source: RansomLook Recent Posts API (?days=1). Window: the past 24h.
Overview
- Total new posts: 20
- Groups involved: 11 (brain cipher, worldleaks, inc ransom, safepay, stormous, anubis, payload, space bears, money message, qilin, + )
- Watchlist hits: 7 (groups: qilin / inc ransom; sectors: medical / healthcare)
Watchlist Hits (read these first)
| Group | Victim | Sector | Geo | Hit | Link |
|---|
| qilin | Pennant Hills Golf Club | leisure | AU | group:qilin | RansomLook |
| inc ransom | RoundShield (roundshield.com) | financial | UK | group:inc | RansomLook |
| inc ransom | Colorado Rehabilitation and Occupational Medicine | healthcare | US | group:inc · sector:medical | RansomLook |
| anubis | Northeast Pediatrics & Adolescent Medicine | healthcare | US | sector:medical | RansomLook |
| anubis | Quest Healthcare Solutions | healthcare | US | sector:healthcare | RansomLook |
| brain cipher | goldenstateortho.com | healthcare | US | sector:medical | RansomLook |
| safepay | eaglecrestlife.org | healthcare/senior-care | US | sector:medical | RansomLook |
All New Posts
| Group | Victim | Discovered (UTC) | Link |
|---|
| brain cipher | printronix.com | 2026-07-01 18:01 | RansomLook |
| brain cipher | goldenstateortho.com | 2026-07-01 18:01 | RansomLook |
| brain cipher | digitaldynamics.com | 2026-07-01 18:01 | RansomLook |
| worldleaks | COMHAR | 2026-07-01 18:01 | RansomLook |
| worldleaks | Starpool | 2026-07-01 18:01 | RansomLook |
| inc ransom | roundshield.com | 2026-07-02 00:53 | RansomLook |
| safepay | eaglecrestlife.org | 2026-07-02 00:54 | RansomLook |
| safepay | dia179.com | 2026-07-02 00:54 | RansomLook |
| safepay | awo-suedost.de | 2026-07-02 00:54 | RansomLook |
| stormous | Notice | 2026-07-02 00:54 | RansomLook |
| stormous | higuchi-inc (BN report) | 2026-07-02 00:54 | RansomLook |
| inc ransom | Colorado Rehabilitation and Occupational Medicine | 2026-07-02 02:55 | RansomLook |
| anubis | Northeast Pediatrics & Adolescent Medicine | 2026-07-02 05:22 | RansomLook |
Anomalies / Trend Notes
- Healthcare concentration: at least 5 victims in a single day are in healthcare or elder care (two paediatric/medical practices from Anubis, one rehabilitation medicine provider from inc ransom, one orthopaedics practice from brain cipher, one senior-care provider from safepay), continuing the pattern of ransomware crews targeting healthcare through 2026.
- worldleaks is the most active(4 posts): the data-extortion group keeps up a high posting rate.
- qilin still on the board: consistent with Q1 2026 intelligence (Qilin has led victim counts for several consecutive quarters).
- brain cipher posts in a batch: 3 entries appeared together in a single batch, suggesting either bulk publication of old inventory or a new round of dumps.