Threat Watch · Jul 25, 2026
Data source: RansomLook
api/posts?days=1(window approx. 2026-07-23 17:00 → 07-24 15:00 UTC)
Overview
- Total new posts: 25
- Groups involved: ~13
- Watchlist hits: 13
Watchlist Hits (read first)
| Group | Victim | Sector | Geo | Hit | Link |
|---|---|---|---|---|---|
| qilin | Stryker | Medical devices / healthcare | US | group:qilin + sector:medical | RansomLook |
| qilin | Highline Community College | Education | US | group:qilin + sector:education | RansomLook |
| qilin | Kean University | Education | US | group:qilin + sector:education | RansomLook |
| qilin | Ejército Argentino | Government / military | AR | group:qilin + sector:government | RansomLook |
| qilin | ABM Enviro | — | — | group:qilin | RansomLook |
| qilin | Machinerie P&W | Manufacturing | CA | group:qilin + sector:manufacturing | RansomLook |
| play | Restaurant Depot | Wholesale / foodservice | US | group:play | RansomLook |
| play | The DeBruler | — | — | group:play | RansomLook |
| play | Record Go Alquiler | Car rental | ES | group:play | RansomLook |
| inc ransom | cabincreekhealth.com | Healthcare | US | group:inc + sector:health | RansomLook |
| inc ransom | autismuslink.ch | Healthcare / health services | CH | group:inc | RansomLook |
| akira | Emerge2 Digital | — | — | group:akira | RansomLook |
| killsec3 | origins ivf | Medical | — | sector:medical | RansomLook |
All New Posts
| Group | Victim | Sector | Geo | Discovered (UTC) | Link |
|---|---|---|---|---|---|
| anubis | Eagle Crest Communities | — | — | 2026-07-23 16:50 | RansomLook |
| killsec3 | origins ivf | medical | — | 2026-07-23 16:51 | RansomLook |
| killsec3 | Bulwark Exterminating | — | US | 2026-07-23 16:51 | RansomLook |
| killsec3 | cashcowboy | — | — | 2026-07-23 16:51 | RansomLook |
| krybit | chkck.com | — | — | 2026-07-23 16:51 | RansomLook |
| krybit | laxai.com | — | — | 2026-07-23 16:51 | RansomLook |
| krybit | nilepet.com | Energy / oil & gas | SD | 2026-07-23 17:51 | RansomLook |
| qilin | ABM Enviro | — | — | 2026-07-23 17:51 | RansomLook |
| qilin | Machinerie P&W | manufacturing | CA | 2026-07-23 17:51 | RansomLook |
| cmd organization | T Simon Jewelers | Retail | US | 2026-07-23 19:50 | RansomLook |
| inc ransom | cabincreekhealth.com | healthcare | US | 2026-07-23 22:54 | RansomLook |
Anomalies / Trend Notes
- Qilin single-day burst: six victims in one day, spanning healthcare (Stryker, a Fortune 500 medical device maker), education (Kean University, Highline Community College), government/military (the Argentine Army) and manufacturing — the group most deserving of attention this round. If the Stryker claim holds, that is a high-value target.
- Healthcare concentration: Stryker, origins ivf, cabincreekhealth and autismuslink.ch make several healthcare/health-related victims, matching watchlist priorities.
- Many new faces: krybit, eraleign (apt73), cmd organization, the gentlemen, pear and nova are names rarely seen recently; watch whether they are rebrands or emerging groups and track their activity going forward.
- Data reflects leak-site postings as recorded by RansomLook; each "victim" is the attacker's unilateral claim and has not been individually verified.