Threat Watch · Jul 18, 2026
Data source: RansomLook
/api/posts?days=1(this batch returned items discovered 2026-07-15; upstream runs 2–3 days behind)
Overview
- Total new posts: 19
- Groups involved: 10
- Watchlist hits: 4 (strict group-name match: qilin ×3, akira ×1); plus 2 healthcare victims (Pear, analyst-flagged)
Watchlist Hits (read first)
| Group | Victim | Sector | Geo | Hit | Link |
|---|---|---|---|---|---|
| qilin | Levin Furniture | Retail / furniture | US | group:qilin | RansomLook |
| qilin | Feliubadaló | Jewelry retail | ES | group:qilin | RansomLook |
| qilin | Danone (International Delights) | Food manufacturing | FR/US | group:qilin | RansomLook |
| akira | Pioneer Construction | Construction | US | group:akira | RansomLook |
| pear | South Plains Rural Health Services, Inc. | Healthcare (rural health) | US | sector:healthcare* | RansomLook |
| pear | Carient Heart & Vascular | Healthcare (cardiovascular) | US | sector:medical* | RansomLook |
* Semantic match (the title contains no strict keyword; sector assigned by analyst judgment).
All New Posts
| Group | Victim | Sector | Geo | Discovered | Link |
|---|---|---|---|---|---|
| black x | sanaa.center | Think tank / research | YE | 2026-07-15 | RansomLook |
| qilin | Levin Furniture | Retail / furniture | US | 2026-07-15 | RansomLook |
| qilin | Feliubadaló | Jewelry retail | ES | 2026-07-15 | RansomLook |
| ailock | Ferrovial | Infrastructure / engineering | ES | 2026-07-15 | RansomLook |
| ailock | Solid Advance Inc. | Unknown | — | 2026-07-15 | RansomLook |
| ailock | Nihon Kotsu Co., Ltd. | Transport / taxi | JP | 2026-07-15 | RansomLook |
| coinbase cartel | PanasonicAero | Avionics / manufacturing | JP/US | 2026-07-15 | RansomLook |
| pear | South Plains Rural Health Services, Inc. | Healthcare | US | 2026-07-15 | RansomLook |
| pear | Carient Heart & Vascular | Healthcare | US | 2026-07-15 | RansomLook |
| akira | Pioneer Construction | Construction | US | 2026-07-15 | RansomLook |
| dragonforce | Stephens Precision | Precision manufacturing |
Anomalies / Trend Notes
- New-face groups:
black x,ailock,pear,leaknetandcoinbase cartelhave only recently come into view — AiLock posted 3 in one batch and Pear targets healthcare exclusively; both warrant a profile. - Highly sensitive claim: LeakNet claims to have taken 6TB from Anglo Belgian Corp (a manufacturer of marine and submarine diesel engines), including submarine and nuclear plant blueprints. If accurate this would be a defense-supply-chain-level event; pending cross-validation.
- DragonForce posted 5 in one day(2 law firms + 3 manufacturers), sustaining high output.
- Healthcare concentration: Pear ×2 plus ShinyHunters (Exact Sciences, Abbott-owned) makes 3 US healthcare-related posts.
- Q2 market view(GuidePoint/ReliaQuest/ZeroFox): "The Gentlemen" overtook Qilin for the top victim count; together Qilin and The Gentlemen accounted for 583 incidents in Q2, more than the next five groups combined.