Threat Watch · Sep 1, 2026

Krybit alone accounts for nearly a third of this window's new claims (14), almost all against low-profile small and mid-size targets — a volume play, not a targeted campaign against one sector.

Group Activity

Krybit — 14 new claims

Targets span Bhutan, Mexico, Thailand, India, and Sint Maarten, across construction (hccd-construction.com), law (jswlaw.bt), education (vedantaainstitute.in), and healthcare (seashellhospital.com) — all low-profile small and mid-size organizations. RansomLook and ransomware.live both recorded the full set of claims.

Sources: RansomLook · ransomware.live

Brain Cipher — 8 new claims

Targets cluster among small and mid-size companies in the US, Spain, and the Netherlands (sago.com, icot.es, Adviesbureau De Beuckelaer BV), with no clear sector pattern.

Sources: RansomLook · ransomware.live

Settra — 8 new claims

Targets include telecom infrastructure provider zayo.com and building-materials firm howardlumber.com, recorded only on ransomware.live.

Sources: ransomware.live

The Gentlemen — 6 new claims

New victims include healthcare operator Nutex Health, Malaysia-listed EP Manufacturing Bhd, and Saudi consultancy Saudi Consulting Services — a broad sector spread.

Sources: RansomLook · ransomware.live

LockBit5 — 6 new claims

Targets are mostly small and mid-size companies in the Netherlands and the US, plus a credit union (svfcu.org).

Sources: ransomware.live

Inc Ransom — 6 new claims

New victims include architecture firm FFKR Architects and eye-care provider New Century Ophthalmology Group, mostly professional-services and healthcare small businesses.

Sources: ransomware.live

Smaller but worth noting: Play (4, including winery Figgins Family Wine Estates), Qilin (3, including Commission de la construction du Quebec), Akira (3), Everest (3, including camera maker VIVOTEK), Nightspire (3).

Notable Targets

Cedar County Memorial Hospital — claimed by Wallstreet

A hospital named as a target; healthcare remains a frequent target for ransomware crews.

Sources: RansomLook · ransomware.live

EP Manufacturing Bhd — claimed by The Gentlemen

An auto-parts manufacturer listed on Bursa Malaysia — the only publicly listed company named this period.

Sources: RansomLook

svfcu.org (credit union) — claimed by LockBit5

The only financial institution named this period.

Sources: ransomware.live

These remain unilateral claims by the groups themselves, not independently confirmed by the victims; both trackers mirror the groups' own leak sites, and cross-tracking the same claim on both is the only corroboration available here.