Threat Watch · Sep 6, 2026

Qilin alone accounts for half of today's new claims, and its seven victims fall under six unrelated sector labels on the trackers — port authority, law firm, construction, energy and utilities, business services, automotive parts, hospitality. There is no sign of vertical concentration.

Everything below is a claim made by the group, not a confirmed intrusion. Both trackers mirror the groups' own leak sites; where the two independently record the same claim it is noted, which is the only cross-check available here.

Group activity

Qilin — 7 new claims

The victims are the Philippine Ports Authority, Bauman Law Group (legal services), Jouvet SAS (construction), G&S Technologies (energy, utilities and waste), Nolan Consulting Group (business services), Colonial Hyundai (automotive parts) and The Big Table (hospitality). All seven appear on both trackers.

Sources: RansomLook · ransomware.live

Seven other groups — one new claim each

The Gentlemen listed Lider Aviacao, Vexy listed Mega Velocity (a New Delhi software publishing and consultancy firm), Dysphor1a listed CitizensPay, Aurora listed Metrea LLC and its subsidiary Commuter Air Technology, and Space Bears listed D-MAX Engineering (a San Diego environmental consultancy working largely for government agencies). Those five appear on both trackers. Direwolf's claim against Mission Pet Health and Kazu's against Spirit Cultural Exchange - US currently appear on ransomware.live only.

Sources: RansomLook · ransomware.live

Notable targets

Philippine Ports Authority — claimed by Qilin

The government agency that runs the country's ports. Recorded on both trackers, neither of which carries any figure for data volume or any sample description.

Sources: RansomLook · ransomware.live

Metrea LLC / Commuter Air Technology, Inc. — claimed by Aurora

Two US defence contractors, formerly Meta Special Aerospace, providing contractor-owned and operated services. The tracker's own sector tag on this claim is defence. Recorded on both trackers.

Sources: RansomLook · ransomware.live

Lider Aviacao — claimed by The Gentlemen

Latin America's largest business aviation company, founded in 1958 in Belo Horizonte. Recorded on both trackers.

Sources: RansomLook · ransomware.live

CitizensPay — claimed by Dysphor1a, with a countdown

A Myanmar mobile digital wallet and payment platform, also known as CTZPay, backed by Myanmar Citizens Bank and Capital Connect Limited. The claim states 30 GB of data and runs a countdown of two days and twelve hours. Recorded on both trackers.

Sources: RansomLook · ransomware.live

Mission Pet Health — claimed by Direwolf

A healthcare services target. Only ransomware.live has recorded this one so far; RansomLook has not mirrored it, so there is no cross-check.

Sources: ransomware.live