Threat Watch · Jul 14, 2026
⚠️ Data source note: today both RansomLook
/api/posts?days=1and its RSS feed were unreachable from the runtime environment (sandbox network restrictions; curl returned empty). What follows is a roundup based on public reporting, not RansomLook structured per-item data; the per-victim table will be backfilled once the API recovers.
Overview
- Structured per-item posts: unavailable (source unreachable)
- Most active groups at the trend level: Qilin(still leading), Akira, SafePay
- Watchlist hits (trend level): qilin, akira, healthcare, manufacturing, us
Watchlist Hits (trend notes)
| Group | Observation | Sector | Geo | Hit | Link |
|---|---|---|---|---|---|
| Qilin | ~141 victim organizations in the past 30 days across 25+ countries; highest leak-site posting volume worldwide | legal / manufacturing / construction / tech / healthcare | Multiple countries (mostly US) | group:qilin, sector:manufacturing | ransomware.live/group/qilin |
| Akira | ~64 organizations in the same window, second most active | Mixed | Multiple countries | group:akira | ransomware.live |
| SafePay | 3 healthcare victims posted in the past 24h | healthcare | Multiple regions | sector:healthcare | ransomware.live |
| LockBit5 | Post-Operation Cronos revival build; far less active than Qilin/Akira | Mixed | Multiple countries | group:lockbit | ransomware.live |
All New Posts
Unavailable today — the RansomLook source was unreachable. The structured victim table will be backfilled on the next run once the API recovers.
Anomalies / Trend Notes
- Qilin continues to dominate the leak-site ecosystem: in any given week of 2026 its new-victim count exceeded that of every other group; ~141 organizations across 25+ countries in the 30-day window, more than double Akira's (~64). Watch its "cartelization" moves with LockBit/DragonForce (DragonForce publicly proposed such an alliance in September 2025).
- Healthcare remains a high-frequency target: SafePay posted 3 healthcare victims in a single day; US organizations account for roughly 65% of all victim listings, with legal services, manufacturing, construction, tech and healthcare the most concentrated sectors.
- Source reliability note: relying continuously on RansomLook as a single point is fragile; consider adding ransomware.live as cross-validation in the next phase (already listed as a disabled alternative in sources.yaml).
Source: RansomLook (unreachable today) · cross-referenced against ransomware.live / Check Point / public reporting