Threat Watch · Jul 21, 2026
Overview
- Total new posts: 5
- Groups involved: 4 (qilin, krybit, gunra, blackout)
- Watchlist hits: 2 (both qilin)
Data source: RansomLook
api/posts?days=1(the returned window covers the latest leak-site updates from 2026-07-18 to 07-19). This endpoint returns only group_name / post_title / discovered, so each victim's sector and geo are manual inferences.
Watchlist Hits (read first)
| Group | Victim | Sector | Geo | Hit | Link |
|---|---|---|---|---|---|
| qilin | Famesa | Manufacturing/Defense (munitions manufacturing, inferred) | PE (inferred) | group:qilin | RansomLook |
| qilin | City Ambulance Service | Healthcare / Medical (emergency services) | US (inferred) | group:qilin · sector:medical | RansomLook |
⚠️ Two qilin posts in a single day, one of them hitting emergency medical services (City Ambulance Service). Healthcare is already a watchlist priority, and a ransomware attack on an ambulance service has direct public-safety implications — worth tracking whether data is subsequently published.
All New Posts
| Group | Victim | Sector | Geo | Discovered | Link |
|---|---|---|---|---|---|
| krybit | euroins.bg | Insurance / Financial (insurance, inferred) | BG (Bulgaria, inferred) | 2026-07-18 | RansomLook |
| gunra | Dissinger and Dissinger Law Firm | Legal (law firm) | US (inferred) | 2026-07-18 | RansomLook |
| blackout | bluebellgroup.com | Business Services (inferred) | — | 2026-07-18 | RansomLook |
| qilin | Famesa | Manufacturing/Defense | PE | 2026-07-19 | RansomLook |
| qilin | City Ambulance Service | Healthcare | US | 2026-07-19 | RansomLook |
Anomalies / Trend Notes
- qilin remains highly active: two leaks in a single day, spanning manufacturing/defense and emergency medical services, continuing its high output through 2025–2026 and remaining one of the groups most worth watching.
- Financial/insurance hit: krybit posted euroins.bg (a Bulgarian insurer), landing on the watchlist's financial/banking area of interest.
- Small sample: only 5 posts in this
days=1window, within normal variation; no dormant group suddenly surging and no unusual concentration in a single sector.