Threat Watch · Jul 28, 2026
Source: RansomLook
api/posts?days=1. ⚠️ The latest post timestamps returned by the API this run fall on 2026-07-23~24, suggesting source-side lag; coverage is not strictly the past 24 hours — for reference only.
Overview
- Total new posts: 25
- Groups involved: ~13 (anubis, killsec3, krybit, qilin, cmd organization, inc ransom, play, nova, eraleign(apt73), dragonforce, the gentlemen, akira, pear)
- Watchlist hits: 12
- Most active: Qilin(6), Play(3), INC Ransom(2)
Watchlist Hits (Read First)
| Group | Victim | Sector | Geo | Hit | Link |
|---|---|---|---|---|---|
| qilin | Stryker | medical device | US | group:qilin | https://www.ransomlook.io/recent |
| qilin | Kean University | education | US | group:qilin · sector:education | https://www.ransomlook.io/recent |
| qilin | Highline Community College | education | US | group:qilin · sector:education | https://www.ransomlook.io/recent |
| qilin | Ejército Argentino | government/military | AR | group:qilin | https://www.ransomlook.io/recent |
| qilin | ABM Enviro | manufacturing | — | group:qilin | https://www.ransomlook.io/recent |
| qilin | Machinerie P&W | manufacturing | — | group:qilin | https://www.ransomlook.io/recent |
| inc ransom | cabincreekhealth.com | healthcare | US | group:inc · sector:health | https://www.ransomlook.io/recent |
| inc ransom | autismuslink.ch | healthcare | CH | group:inc | https://www.ransomlook.io/recent |
| play | Restaurant Depot | retail/food | US | group:play | https://www.ransomlook.io/recent |
| play | The DeBruler | — | — | group:play | https://www.ransomlook.io/recent |
| play | Record Go Alquiler | car rental | ES | group:play | https://www.ransomlook.io/recent |
| akira | Emerge2 Digital | technology | — | group:akira | https://www.ransomlook.io/recent |
All New Posts
| Group | Victim | Discovered |
|---|---|---|
| anubis | Eagle Crest Communities | 2026-07-23 |
| killsec3 | origins ivf | 2026-07-23 |
| killsec3 | Bulwark Exterminating | 2026-07-23 |
| killsec3 | cashcowboy | 2026-07-23 |
| krybit | chkck.com | 2026-07-23 |
| krybit | laxai.com | 2026-07-23 |
| krybit | nilepet.com | 2026-07-23 |
| qilin | ABM Enviro | 2026-07-23 |
| qilin | Machinerie P&W | 2026-07-23 |
| cmd organization | T Simon Jewelers | 2026-07-23 |
| inc ransom | cabincreekhealth.com | 2026-07-23 |
| play | The DeBruler | 2026-07-23 |
| play | Restaurant Depot | 2026-07-23 |
| play | Record Go Alquiler | 2026-07-23 |
| nova | Digital Edge | 2026-07-24 |
| inc ransom | autismuslink.ch | 2026-07-24 |
| eraleign (apt73) | metrabyte.cloud | 2026-07-24 |
| dragonforce | ID engineering | 2026-07-24 |
| qilin | Stryker | 2026-07-24 |
| qilin | Highline Community College | 2026-07-24 |
| qilin | Kean University | 2026-07-24 |
| qilin | Ejército Argentino | 2026-07-24 |
| the gentlemen | Advanced Marketing | 2026-07-24 |
| akira | Emerge2 Digital | 2026-07-24 |
| pear | Metropolitan Construction Systems | 2026-07-24 |
Anomalies / Trend Notes
- Qilin posted 6 victims in a single batch, spanning medical devices (Stryker), education (Kean, Highline), government/military (Argentine Army), and manufacturing — an extremely broad attack surface, consistent with its race against "The Gentlemen" for the 2026 top spot.
- Education sector clustered in a single day: Kean University + Highline Community College appeared on the same day (both Qilin).
- New faces:
krybit,eraleign (apt73),pear,cmd organization,novaare rarely seen in this repository's history — worth watching to see whether they are rebrands or emerging groups. - Data lag: the
days=1API call returned 7/23–24 data; if the lag persists tomorrow, investigate the source side or fall back to RSS.
Watchlist: intel/ransomware/watchlist.yaml