Threat Watch · Jul 20, 2026
Overview
- Total new posts: 5 (RansomLook API, past 24h)
- Groups involved: 4 (krybit / gunra / blackout / qilin)
- Watchlist hits: 2 (both qilin, matched on group)
Watchlist Hits (read first)
| Group | Victim | Sector | Geo | Hit | Link |
|---|---|---|---|---|---|
| qilin | Famesa | Manufacturing (inferred) | Peru (inferred) | group:qilin | RansomLook |
| qilin | City Ambulance Service | Emergency medical (healthcare-adjacent) | US (inferred) | group:qilin | RansomLook |
⚠️ qilin hitting City Ambulance Service deserves attention: emergency medical services is an extremely availability-sensitive sector, and qilin has long been on the watchlist (~1,496 cumulative leak-site victims over the past 12 months, roughly 16% market share — see Infosecurity).
All New Posts
| Group | Victim | Sector | Geo | Discovered | Link |
|---|---|---|---|---|---|
| krybit | euroins.bg | Insurance / finance (inferred) | Bulgaria | 2026-07-18 18:55 UTC | RansomLook |
| gunra | Dissinger and Dissinger Law Firm | Legal services | US (inferred) | 2026-07-18 21:56 UTC | RansomLook |
| blackout | bluebellgroup.com | Distribution / retail (inferred) | — | 2026-07-18 22:56 UTC | RansomLook |
| qilin | Famesa | Manufacturing (inferred) | Peru (inferred) | 2026-07-19 15:58 UTC | RansomLook |
| qilin | City Ambulance Service | Emergency medical | US (inferred) | 2026-07-19 15:58 UTC | RansomLook |
The API returns only group_name / post_title / discovered; Sector and Geo are inferred from the victim name, and "—" means no determination could be made.
Anomalies / Trend Notes
- qilin doubles up in one day: 2 new victims within 24 hours, consistent with its current ~16% market share; earlier in the week it also posted Peligro Sports, Global Strategic BPS and others (DeXpose).
- krybit / gunra / blackoutare all small-to-midsize emerging groups; krybit reached Bulgarian insurer euroins.bg (a financial-sector target of some size) — watch whether this group keeps ramping up volume.
- Overall volume is low for the weekend (5 posts), consistent with ransomware groups' weekend posting cadence.