Threat Watch · Jul 19, 2026

Data source: RansomLook API (/api/posts?days=1, fetched 2026-07-19 00:06 UTC+8). The API returns only three fields — group / victim / discovered — so sector and geo are analyst inferences.

Overview

• Total new posts: 27
• Groups involved: 6(qilin, inc ransom, the gentlemen, interlock, dragonforce, nova)
• Watchlist hits: 19(group:qilin ×12, group:inc ×7)

Watchlist Hits (read first)

All New Posts

Anomalies / Trend Notes

• qilin burst of 12 in a single day, far above its recent average, with victims mostly US small and midsize organizations (schools, churches, food, industrial supply) — consistent with its wide-net approach.
• the gentlemen hit two highly sensitive targets: the US Navy's Military Sealift Command(military logistics; if accurate this is a major event and needs independent verification) and Colombia's national oil company Ecopetrol(critical infrastructure / oil & gas). The veracity of these claims awaits cross-validation — marquee victims are sometimes overstated for publicity.
• inc ransom posted 7 at once, concentrated in APAC(Taiwan ×2, the Philippines, a Singapore-linked and a Vietnam-linked entity); Taiwanese manufacturers D.MAG and vedan hit the geopolitical-interest flag.
• New-group watch: novaand the gentlemenare relatively new faces; keep tracking their cadence.