Data source: RansomLook /api/posts?days=1. The API returned a window of Jul 10 → Jul 11 (roughly one day behind the current date; recorded as actually returned).
Overview
- Total new posts: 16
- Groups involved: 7 (akira, blackwater, gunra, interlock, payload, qilin, cmd organization)
- Watchlist hits: 9 (qilin ×8, akira ×1)
Watchlist Hits (read first)
| Group | Victim | Sector | Geo | Hit | Discovered |
|---|
| akira | Vandalia Rental | equipment rental | US | group:akira | 2026-07-10 |
| qilin | Navana Real Estate | real estate | APAC | group:qilin | 2026-07-10 |
| qilin | Promotora Zacapu | real estate/dev | LATAM (MX) | group:qilin | 2026-07-10 |
| qilin | Hilo | — | — | group:qilin | 2026-07-10 |
| qilin | Red Planet Hotels | hospitality | APAC | group:qilin | 2026-07-10 |
| qilin | CRZ Construcciones | construction | LATAM | group:qilin | 2026-07-10 |
| qilin | Global Strategic Business Process Solutions | BPO | — | group:qilin | 2026-07-10 |
| qilin | SPACElogic | tech/systems | SG | group:qilin | 2026-07-10 |
| qilin | Eurodefi | finance | EU | group:qilin | 2026-07-10 |
All New Posts
| Group | Victim | Sector | Geo | Discovered |
|---|
| akira | Vandalia Rental | equipment rental | US | 2026-07-10 |
| blackwater | txdkj.com | — | — | 2026-07-10 |
| gunra | Yuditec S.A. | — | LATAM | 2026-07-10 |
| gunra | on-us | — | — | 2026-07-10 |
| gunra | Pirámide Seguros | insurance | LATAM | 2026-07-10 |
| interlock | Borger ISD | education (K-12) | US (TX) | 2026-07-10 |
| payload | Roofinox | manufacturing | EU | 2026-07-10 |
| qilin | Navana Real Estate | real estate | APAC | 2026-07-10 |
| qilin | Promotora Zacapu | real estate/dev | LATAM (MX) | 2026-07-10 |
| qilin | Hilo | — | — | 2026-07-10 |
| qilin | Red Planet Hotels | hospitality | APAC | 2026-07-10 |
| qilin | CRZ Construcciones | construction | LATAM | 2026-07-10 |
| qilin | Global Strategic Business Process Solutions | BPO | — | 2026-07-10 |
| qilin | SPACElogic | tech/systems | SG | 2026-07-10 |
| qilin | Eurodefi | finance | EU | 2026-07-10 |
| cmd organization | Golden Star Resources | mining | — | 2026-07-11 |
Anomalies / Trend Notes
- Qilin floods the feed: 8 of 16 posts are Qilin (half the total), spanning real estate, hospitality, construction, BPO, finance and systems integration, with geographic coverage across LATAM, APAC and Europe — a clear wide-net, sector-agnostic opportunistic pattern.
- Education critical infrastructure hit: Interlock posted Borger ISD(a K-12 school district in Texas, US), continuing ransomware operators' preference for public education institutions with relatively weak funding and defenses.
- New faces:
blackwater, payload, cmd organizationand gunraappear infrequently in this workbench's data; worth watching whether they are new groups or rebrands.
- Data lag note: the
days=1API window stops at Jul 11 and overlaps with yesterday's brief; consider verifying whether days=2should be used to capture the increment going forward.