Threat Watch · Aug 24, 2026

New victim claims from 8 active groups were monitored over the past 36 hours. The raw material also contained several posts suspected of being fabricated or carrying injection payloads (for example, a "report queue failure" message disguised as a system alert, and entries carrying XSS payloads); these were assessed as not genuine disclosure content and excluded.

Group Activity

coinbase cartel added 13 new victim claims in a single day, the most active group this round

Targets span finance, insurance, healthcare, manufacturing, and other industries, with wildly divergent ransom demands: Flecha Bus (Argentine transport and logistics) at $366.3M, RXPE Group (electronics) at $319M, and Tower Insurance (New Zealand insurance) at $283.7M were the three highest; a number of small and mid-sized businesses were asked for ransoms in the USD 5 million range.

Sources: RansomLook

shinyhunters claimed three, including a security company and a regional bank

Claimed targets include ReliaQuest (a threat intelligence and security services provider itself becoming a target; the post rebuts Mandiant-related reporting), BOK Financial (US regional bank), and NovoCure (medical device company).

Sources: RansomLook

qilin claimed three manufacturing and engineering targets

Including Clear Align (manufacturing), Difor (auto parts), and Black Cat Engineering & Construction WLL (civil engineering).

Sources: RansomLook

emperador claimed Vietnam's national power utility (EVN/EVNHANOI) and Spanish manufacturer FRUCASTRO SL

Vietnam Electricity (EVN) is the country's largest power enterprise and sole national grid operator, making it the highest-tier critical infrastructure target among this round's claims; the data release is set for September 6.

Sources: RansomLook

lockbit5 claimed Brazilian state-owned naval defense company ICN (Itaguaí Construções Navais)

ICN is a significant player in Brazil's defense industry with military shipbuilding operations; defense supply chain targets of this kind warrant continued attention.

Sources: RansomLook

space bears claimed two: a German building materials retailer and a Czech internet service provider

Holzmarkt Chemnitz (German building materials retail) and Freelom (Czech wireless internet service provider).

Sources: RansomLook

pear claimed two: a Jamaican network services provider and a US law firm

Island Networks (Jamaica; enterprise internet, network security, and home WiFi services) and Mogren, Glessner & Ahrens, P.S. (US family law firm).

Sources: RansomLook

Others

rhysida claimed CRI Electric (electrical services provider in San Antonio, US); nightspire claimed Victory Personal Care, Inc (personal care products manufacturer).

Sources: RansomLook · RansomLook