Threat Watch · Jul 5, 2026
Data source: RansomLook
/api/posts?days=1(new posts in the past 24h)
Overview
- Total new posts: 9
- Groups involved: 4 (qilin, play, the gentlemen, titan)
- Watchlist hits: 7 (Qilin ×5, Play ×2)
Watchlist Hits (Priority)
| Group | Victim | Sector | Geo | Hit | Discovered |
|---|---|---|---|---|---|
| qilin | TQ Financial Services | Financial | — | group:qilin · sector:financial | 2026-07-03 |
| qilin | Sisint | — | — | group:qilin | 2026-07-03 |
| qilin | Sitmatic | — | — | group:qilin | 2026-07-03 |
| qilin | Goodwill Manasota | Non-profit | US | group:qilin | 2026-07-03 |
| qilin | Md Lewis | — | — | group:qilin | 2026-07-03 |
| play | Silvestri & Associates Insurance | Insurance | — | group:play | 2026-07-04 |
| play | Locati Architects | Architecture | — | group:play | 2026-07-04 |
All New Posts
| Group | Victim | Sector | Geo | Discovered |
|---|---|---|---|---|
| qilin | TQ Financial Services | Financial | — | 2026-07-03 |
| qilin | Sisint | — | — | 2026-07-03 |
| qilin | Sitmatic | — | — | 2026-07-03 |
| qilin | Goodwill Manasota | Non-profit | US | 2026-07-03 |
| qilin | Md Lewis | — | — | 2026-07-03 |
| play | Silvestri & Associates Insurance | Insurance | — | 2026-07-04 |
| play | Locati Architects | Architecture | — | 2026-07-04 |
| the gentlemen | Medic Rescue | Medical/EMS | — | 2026-07-04 |
| titan | Eureka Construction INC | Construction | — | 2026-07-04 |
Anomalies / Trend Notes
- Qilin keeps leading: 5 leak posts in a single day, consistent with the industry statistic that it is "the most active ransomware group of 2026, accounting for roughly 15% of this year's attacks."
- The Gentlemen / Titan are newer / niche groups: 1 post each this round; worth watching whether their posting pace accelerates.
- "Medic Rescue" (EMS/medical) did not match watchlist keywords (the list has "medical" but not "medic"), yet it sits in a sensitive public-welfare sector; recommend adding
medic,ems,ambulanceto the watchlist keywords. - No notable single-sector concentration; victims are mostly SMBs / professional-services firms.
Upstream data may land in the database late; for next-day review, treat the RansomLook website as authoritative.