Threat Watch · Aug 27, 2026

Cross-validated across RansomLook and ransomware.live (dual-source, per the sources config): 109 raw victim-claim posts collapse to 64 distinct victim claims from roughly 20 active groups in the last 36 hours.

Most Active Groups

Krybit — 12 victims claimed

The heaviest single-group day in this window: 12 organizations named in rapid succession, spanning Thailand (sysconth.com), Brazil (neooftalmo.com.br), Vietnam (sankovn.com), and Guatemala (ferretornillos.gt), among others.

Sources: ransomware.live · RansomLook

Qilin — 11 victims claimed

Targets include Brazosport College (Texas) and a spread of manufacturing and financial-services firms: Metal Conversions, California Truck Equipment, Northern Leasing Systems, WireCo, Air International Thermal Systems, and Structured Settlement Capital LLC.

Sources: ransomware.live · RansomLook

Akira — 5 victims claimed

Includes Gill Rock Drill, an Oral and Maxillofacial Surgery practice, and German engineering firm WINTER Ingenieure.

Sources: RansomLook

The Gentlemen — 5 victims claimed

All five posted within an 8-minute window: Party Rental, TEC Container, Verbux, Espinos, and Incolur.

Sources: RansomLook

Notable Targets

National Kidney Registry claimed by Direwolf — a nonprofit healthcare-adjacent organization coordinating living-donor kidney exchanges.

Sources: ransomware.live

Knottingham Trent University claimed by ShadowByt3$, alongside Sinar Mas Agribusiness and Food (Golden Agri-Resources) and A-Plus Software Limited — the group's only three posts in this window span higher education, agribusiness, and software.

Sources: ransomware.live

Also Claimed This Window

Single- or double-victim claims from AuditTeam (Demidov Steel Group), Orova (Central Florida Civil, Arich Enterprise, Bai-chi CPA Firm), Chaos (parkderochie.com, mswalker.com, copcp.com), Global Secret Group (Johnson City Honda, Lockheed Architectural Solutions, Tiseo Paving), AiLock (Morgan Services, Hamilton), Deadlock (FBC, Global Terminal Services), Dark Project (a New Britain, CT dental practice; Pump Engineering Company), Eclipse (Simplex Engineering), Aurora (ERPIS LLC), Abyss-Data (MEMSIC), SafePay (an Air Liquide Korea industrial subdomain), Genesis, Majinahanashi (PCA Group Sdn. Bhd.), and Beast (Cosmon).

Sources: RansomLook — Global Posts · ransomware.live