Ransomware Group intelligence
Nightspire
ActiveTrack Nightspire with 387 published victims and 11 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Nightspire is tracked by Breach House as a ransomware group with 387 published victims.
United States is currently the most targeted country in this dataset.
11 known leak locations are currently associated with this group.
Leak Status Distribution
387
- Leaked 2 0.5%
- Pending 380 98.2%
- Deleted 5 1.3%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (11)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 11 | Onion service | Up checked 2h ago | nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion |
| Leak location 10 | Onion service | Down checked 2h ago | nspire7lugml7ybqyjaaxtsgrs4qn3fcon3lrjbih6wamttvdm5ke4qd.onion |
| Leak location 8 | Onion service | Down checked 2h ago | nspiremkiq44zcxjbgvab4mdedyh2pzj5kzbmvftcugq3mczx3dqogid.onion |
| Leak location 9 | Onion service | Down checked 2h ago | nspiremkiq44zcxjbgvab4mdedyh2pzj5kzbmvftcugq3mczx3dqogid.onion |
| Leak location 6 | Onion service | Down checked 2h ago | nspirebcv4sy3yydtaercuut34hwc4fsxqqv4b4ye4xmo6qp3vxhulqd.onion |
| Leak location 7 | Onion service | Down checked 2h ago | nspirebcv4sy3yydtaercuut34hwc4fsxqqv4b4ye4xmo6qp3vxhulqd.onion |
| Leak location 4 | Onion service | Down checked 2h ago | a2lyiiaq4n74tlgz4fk3ft4akolapfrzk772dk24iq32cznjsmzpanqd.onion |
| Leak location 5 | Onion service | Down checked 2h ago | a2lyiiaq4n74tlgz4fk3ft4akolapfrzk772dk24iq32cznjsmzpanqd.onion |
| Leak location 1 | Onion service | Down checked 2h ago | nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd.onion |
| Leak location 2 | Onion service | Down checked 2h ago | nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd.onion |
| Leak location 3 | Onion service | Down checked 2h ago | nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd.onion |
Top Activity Sectors (18)
- Not identified 118
- Services 41
- IT 28
- Manufacturing / Engineering 23
- Healthcare / Pharma 20
- Finance / Legal / Insurance 19
- Communication / Marketing 15
- Transportation / Travel / Logistics 14
- Construction / Real Estate 12
- Retail / E-commerce 9
- Hospitality / Food & Beverage / Tourism 9
- NGOs / Associations 8
- Education 8
- Energy 7
- Public Sector 7
- Agriculture / Food 4
- Telecommunications 3
- null 1
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Nightspire, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
What they do: nightspire exploits valid domain accounts harvested during initial access to authenticate against remote systems.
What that means: Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
-
T1059.001 PowerShell Execution
What they do: nightspire executes PowerShell scripts to automate reconnaissance, privilege checks, and payload deployment across compromised hosts.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: nightspire modifies Registry Run Keys and startup folders to maintain persistence across reboots.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: nightspire disables or modifies security tools such as EDR agents and monitoring services to hinder detection and response.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: nightspire deletes Volume Shadow Copies and backup directories via system commands to prevent recovery from snapshots.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1018 Remote System Discovery Discovery
What they do: nightspire performs remote system discovery to identify exposed services, hosts, and potential lateral movement paths.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1135 Network Share Discovery Discovery
What they do: nightspire uses SMB/Windows Admin Shares discovery to map network shares and identify high-value targets for encryption.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: nightspire uses SMB/Windows Admin Shares for lateral movement into additional machines within the victim network.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: nightspire encrypts victim files using custom ransomware routines targeting business documents, databases, and backups.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1491.001 Internal Defacement Impact
What they do: nightspire performs internal defacement by replacing victim files with ransom notes and altered content markers.
What that means: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.
Tools Observed (3)
▼Software Nightspire has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.
Discovery & enumeration
Everything.exe
Exfiltration
MEGA
WinSCP
Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.
Ransom Notes (4)
▼The note this group leaves on a compromised machine. Click a filename to read it.
[NSPIRE_MSG].txt
NightSpire Encryption Notice Your internal servers and backup & virtual infrastructure have been fully compromised. All your files encrypted by NIGHTSPIRE Ransomware. You have 72 hours to respond. The initial payment for decryption and file deletion is 30000 USD in Bitcoin. This amount is based on your annual revenue, and this is notably less amount than all of your past hard work and effort to develop all of your products. However, the amount can be renegotiated depending on the circumstances. Our Discount Service Includes: - If you respond within 48 hours, we will provide you 30% discount as service. - If you respond within 24 hours, we will provide you 50% discount as service. "The faster you pay, the lower the ransom." That's our motto. Failure to cooperate will result in public disclosure. We possess a complete list of files and document samples that serve as proof of the access. You can see the decryption demo video and the list of copied files on our website. ------------------- About NightSpire – Cooperate: The Win-Win Resolution ------------------- Full Decryption Tool + Instructions: Universal binary decrypts all affected systems in hours. Data Deletion Proof: Timestamped logs, blockchain-verified wipe certificates—your data erased forever. Secrecy Assurances: No traces online; we expunge all references post-deal. Bonus: Security Audit Report: Detailed breach vector analysis + fixes, valued at $50K+ from legit firms. Payment Flexibility: Crypto (BTC We Offer), staged if needed—processed by our financial team. NightSpire isn't a lone hacker in a basement. We're a structured syndicate with standard operating procedures, support desks, recruiters, and analysts—like a Fortune 500 but optimized for cyber efficiency. Our reputation demands we deliver: victims who pay get results, building trust for mutual long-term gains. Non-payment erodes that, but cooperation upholds it. Security researchers and reputation confirm, we're a fully fledged cyber group... built to monetize. We honor deals to ensure repeat business across the ecosystem. --------------------------- WHAT HAPPENS IF YOU DON'T PAY ------------------------------- - The hacked news about your company will be posted on our Onion site. - Source codes of your all software products will be open source. - Your clients and partners may be notified about the data breach. - The data may be shared or sold to third parties. - You will permanently lose access to your encrypted data. - We will not provide any decryption tools or support. ----------------------------------------- CAUTION --------------------------------------------- >>> Important – Do Not DO NOT modify files. DO NOT use third-party tools. Unncessary activities cause permanent loss of your data. AES-256/RSA-4096 = impossible without our key. >>> WARNING – NO INTERMEDIARIES Do NOT use recovery or negotiation companies. They are middlemen who profit from deception. For example: They charged victims $1M Secretly negotiated with us for $200K Kept $800K for themselves. Contacting us directly = 5× lower cost. Middlemen only steal from you. Deal direct. Pay less. Resolve faster. >>> IMPORTANT – INSURANCE NOTICE Do NOT involve your cyber insurance company directly. They will sabotage negotiations to avoid paying the full policy amount. If your coverage is $10M, they will offer us $100K. We will reject it. They will refuse to increase. Result: no payment, full data leak, total damage — for you. If you anonymously inform us of your insurance limits and terms, we will NOT exceed that amount in negotiations. This guarantees: • Fast resolution • Data deletion • Full decryption • No public leak Silence only benefits the insurer. Transparency benefits you. Choose wisely. >>> CONSEQUENCES OF DATA LEAK If your data is leaked: • Government fines (GDPR, compliance, tax authorities) • Lawsuits from clients and partners • Criminal abuse of employee and customer identities • Bank fraud, loan fraud, money laundering • FBI investigations and legal exposure • Competitor espionage and business sabotage • Employee poaching and loss of trade secrets • Permanent reputation destruction Your company will bleed money, clients, trust, and stability. Statistics: 2 out of 3 companies shut down within 6 months after a major data breach. The cost of recovery is hundreds of times higher than the ransom. Paying is faster. Cheaper. Safer. Your reputation took years to build. It takes minutes to destroy. Read more about the GDRP legislation:: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://gdpr.eu/what-is-gdpr/ https://gdpr-info.eu/ -------------------------------------------- How to Contact Us --------------------------------------------- >>> Using qTox Chat App Our qTox ID: 038F61A270B8094E713E4815C4FA5086E4AD3A021575C6F90EE65A0C123D3E3BF6926C3B59EA Our qTox ID: 8D663FD10BF662930F4C076CBF95FACFCC4ABD8F1A5E328DE75D0B0237A74E1AE1E0C5C37E7F >>> Using Tor Browser: 1. Download Tor Browser: https://www.torproject.org/ 2. Install Tor Browser: • Windows: Run the installer, launch Tor Browser, and click Connect. • macOS: Open the downloaded .dmg file, drag Tor Browser to Applications, launch it, and click Connect. • Linux: Extract the downloaded package, run ./start-tor-browser.desktop, and click Connect. • Android: Install from Google Play or torproject.org, open the app, and tap Connect. • iOS (iPhone): Install Onion Browser from the App Store, open it, and tap Connect. 3. Access the under link once connected. http://nspire7lugml7ybqyjaaxtsgrs4qn3fcon3lrjbih6wamttvdm5ke4qd.onion Login with UUID "[snip]" and password "[snip]". 4. Also introduce you to our blog site where you can learn more about us through the link below. http://nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion/ >>> On Mail Proton Mail: [email protected] Onion Mail: [email protected] Contact us and verify with UUID "[snip]". ----------------------------------------------------- FAQ ------------------------------------------------------ Proof? Preview + Free sample decrypts. Safe tool? Universal, tested. Data gone? Solid proof. Future attacks? Pay = gone forever + fixes. Team NightSpire.
readme.txt
Dear Management,
If you are reading this message, it means that:
- your network infrastructure has been compromised,
- sensetive data was leaked,
- files are encrypted
--------------------------------------------------------------------------
The best and only thing you can do is to contact us
to settle the matter before any losses occurs.
Onion Site:
http://nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd.onion
Proton Mail:
[email protected]
--------------------------------------------------------------------------
1. THE FOLLOWING IS STRICTLY FORBIDDEN
1.1 EDITING FILES.
Renaming files could DAMAGE the
cipher and decryption will be impossible.
1.2 USING THIRD-PARTY SOFTWARE.
Trying to recover with any software
can also break the cipher and
file recovery will become a problem.
--------------------------------------------------------------------------------------------------
2. EXPLANATION OF THE SITUATION
2.1 WHAT HAPPENED
We encrypted your workstations and servers to make the fact of the intrusion visible and to prevent you from hiding sensetive data leaks.
We have already downloaded a huge amount of sensetive data and analyzed it. Now its fate is up to you, it will either be deleted or sold, or shared with the media.
2.2 VALUABLE DATA WE USUALLY STEAL:
- Databases, legal documents, personal information.
- Audit reports.
- Audit SQL database
- Any financial documents (Statements, invoices, accounting, transfers etc.).
- Work files and corporate correspondence.
- Any backups.
- Confidential documents.
2.3 TO DO LIST (best practies)
- Contact us as soon as possible.
- Contact us only in our live chat, otherwise you can run into scammers.
- Purchase our decryption tool and decrypt your files. There is no other way to do this.
- Realize that dealing with us is the shortest way to success and secrecy.
- Give up the idea of using decryption help programs, otherwise you will destroy the system permanently.
- Avoid any third-party negotiators and recovery groups. They can become the source of leaks.
--------------------------------------------------------------------------------------------------
3. POSSIBLE DECISIONS
3.1 NOT MAKING THE DEAL
- After 5 days starting tomorrow your leaked data will be Disclosed or sold.
- We will also send the data to all interested supervisory organizations and the media.
- Decryption key will be deleted permanently and recovery will be impossible.
- Losses from the situation can be measured based on your annual budget.
3.2 MAKING THE WIN-WIN DEAL
- You will get the only working Decryption Tool and the how-to-use Manual.
- You will get our guarantees (with log provided) of non-recovarable deletion of all your leaked data.
- You will get our guarantees of secrecy and removal of all traces related to the deal in the Internet.
- You will get our security report on how to fix your security breaches.
--------------------------------------------------------------------------------------------------
4. HOW TO CONTACT US
4.1 Download and install TOR Browser https://torproject.org
4.2 Go to our contact form website at http://nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd.onion/contact.php
4.3 You can request sample files chat to review leaked data samples.
4.4 In case TOR Browser is restricted in your area use VPN services.
4.5 All leaked Data samples will be Disclosed in 7 Days if you remain silent.
4.6 Your Decryption keys will be permanently destroyed at the moment the leaked Data is Disclosed.
--------------------------------------------------------------------------------------------------
5. RESPONSIBILITY
5.1 Breaking critical points of this offer will cause:
- Deletion of your decryption keys.
- Immediate sale or complete Disclosure of your leaked data.
- Notification of government supervision agencies, your competitors and clients.
--------------------------------------------------------------------------------------------------
readme_2.txt
Hi, Your hotel is hacked! Your servers and files are locked and copied. =================================== REMEMBER! We also locked files in OneDrive. And we did not change the extensions of files in OneDrive. =================================== You cannot decrypt yourself without our key, even you're using third party software or from help of security companies. Please do not waste your time. Your files will be easily decrypted with pay. Never worry. We're waiting here with UUID [snip] Method * : [email protected] Method 1 : Our qTox ID 3B61CFD6E12D789A439816E1DE08CFDA58D76EB0B26585AA34CDA617C41D5943CDD15DB0B7E6 Method 2 : Browse our Onion Site with Tor Browser http://nspiremkiq44zcxjbgvab4mdedyh2pzj5kzbmvftcugq3mczx3dqogid.onion http://a2lyiiaq4n74tlgz4fk3ft4akolapfrzk772dk24iq32cznjsmzpanqd.onion We're waiting here with UUID [snip]
nightspire_readme.txt
-Your sensetive data are stolen and encrypted! If you pay within 3 days, we will decrypt it and also, we will not public your data. After that we will public this situation and all data. -DO NOT MODIFY FILES YOURSELF. -DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. -YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS. -YOUR DATA IS STRONGLY ENCRYPTED, YOU CAN NOT DECRYPT IT WITHOUT OUR HELP. CONTACT US: Onion Mail : [email protected] qTox ID: 3B61CFD6E12D789A439816E1DE08CFDA58D76EB0B26585AA34CDA617C41D5943CDD15DB0B7E6 http://a2lyiiaq4n74tlgz4fk3ft4akolapfrzk772dk24iq32cznjsmzpanqd.onion http://nspiremkiq44zcxjbgvab4mdedyh2pzj5kzbmvftcugq3mczx3dqogid.onion Send this message first "NSPIRE[snip]" when contact with us, so to make sure it's you.
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (387)
Search, filter and paginate the victim timeline for Nightspire. Showing 1–100 of 387.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | U**IN* Group id35022 View details | United States | Services | pending | ||
|
U**IN* Group is an entity within the US IT sector identified in the threat-intelligence index as a ransomware victim. The group operates within information technology infrastructure and has been associated with the threat actor nightspire in the ransomware incident classification. This listing type denotes the entity's status as a victim of ransomware activity linked to nightspire, reflecting its exposure within the cybersecurity threat landscape. The description remains factual and neutral, focusing on the entity's categorization without disclosing unverified incident details. U**IN* Group was listed as a ransomware victim associated with nightspire. |
||||||
| Ransomware | U**IN* Group id35025 View details | India | Services | pending | ||
|
U**IN* Group is an entity operating within the IT sector and identified within the threat-intelligence index as a ransomware victim. Its classification reflects involvement in cyber incidents affecting information technology environments, with country context tied to India. The entity is associated with the threat actor nightspire, indicating a linkage between this organization and ransomware activity within the assessed dataset. This listing provides catalog context for monitoring entity exposure, sector vulnerability, and associated adversary attribution without disclosing unverified incident details. U**IN* Group was listed as a ransomware victim associated with nightspire. |
||||||
| Ransomware | U**IN* Group id35028 View details | India | Services | pending | ||
|
U**IN* Group is an entity operating within the IT sector, based in India, cataloged in a threat-intelligence index as a ransomware victim. The designation U**IN* Group reflects the organization's identifier within security intelligence databases, where its classification under ransomware incidents provides context for threat correlation and sector-specific risk assessment. As an IT-focused entity, its inclusion underscores vulnerabilities within technology infrastructure and highlights the importance of monitoring threat actor activity across digital service environments. This listing is associated with the threat actor nightspire, contributing to a broader understanding of ransomware exposure patterns in the Indian IT landscape. The entry remains a neutral record of the entity's status as a ransomware victim linked to nightspire. |
||||||
| Ransomware | U**IN* Group id35031 View details | India | Services | pending | ||
|
U**IN* Group is an entity operating within the IT sector, identified in the threat-intelligence index as a ransomware victim. The name suggests an organization or group identifier associated with information technology infrastructure, though specific operational details, capabilities, or service offerings are not publicly verifiable from the provided context. Its classification as a ransomware victim linked to the nightspire threat actor indicates an assessed cybersecurity relationship within the indexed intelligence dataset. This entry documents the association neutrally without confirming breach specifics, data exposure, or operational impact. U**IN* Group was listed as a ransomware victim associated with nightspire. |
||||||
| Ransomware | U**IN* Group id35037 View details | India | Services | pending | ||
|
U**IN* Group operates within the IT sector and is identified within the threat-intelligence index as a ransomware victim entity associated with the nightspire threat actor. The entity reflects an organization impacted by cyber activity targeting information technology infrastructure, with operational context tied to India. Publicly available details concerning its specific capabilities, services, or internal scope remain limited in this listing, so the description focuses on its indexed classification and verified association. This entry serves catalog and research purposes for monitoring ransomware incidents and threat-actor linkages across sectors and geographies. U**IN* Group was listed as a ransomware victim associated with nightspire. |
||||||
| Ransomware | U**IN* Group id35039 View details | India | Services | pending | ||
|
U**IN* Group is an entity within the IT sector based in India, cataloged as a ransomware victim in this threat-intelligence index. The group operates within the technology sector, and its inclusion reflects observed threat activity or incident associations relevant to cybersecurity monitoring. This listing type identifies U**IN* Group specifically as a ransomware victim connected to the nightspire threat actor. The description remains neutral and factual, focusing on the entity's sector, geographic context, listing classification, and associated threat intelligence source without speculating on unconfirmed incident details. U**IN* Group was listed as a ransomware victim associated with nightspire. |
||||||
| Ransomware | U**IN* Group id35042 View details | India | Services | pending | ||
|
U**IN* Group is an entity operating within the IT sector based in India, cataloged as a ransomware victim within a threat-intelligence index. The designation reflects its association with a cybersecurity incident rather than confirmed operational details of the threat itself. As part of the index, U**IN* Group is linked to the threat actor nightspire, providing context for threat actor attribution and victim profiling in cyber threat intelligence workflows. This listing supports researchers and defenders in tracking ransomware-related entities across sectors and geographies. U**IN* Group was listed as a ransomware victim associated with nightspire. |
||||||
| Ransomware | U**IN* Group id35046 View details | India | Services | pending | ||
|
U**IN* Group is an entity identified within the threat-intelligence index as a ransomware victim operating within the IT sector and associated with the country India. The name suggests a corporate or organizational identifier, though specific internal capabilities, services, or operational scope cannot be definitively stated without verified source material. In the context of this listing, U**IN* Group is cataloged neutrally as a ransomware victim linked to the threat actor nightspire. This entry supports threat-intelligence analysis by documenting the association between an affected entity, its sector and geographic context, and the attributed threat actor. The description avoids inventing incident details such as stolen data, ransom terms, or confirmed breach specifics, maintaining factual and encyclopedic neutrality. It was listed as a ransomware victim associated with nightspire. |
||||||
| Ransomware | U**IN* Group id35069 View details | India | Services | pending | ||
|
U**IN* Group is an entity operating within the Services sector, based in India, and cataloged here as a ransomware victim within the threat-intelligence index. The designation reflects its role in a cybersecurity incident context, with the associated threat actor identified as nightspire. Publicly available records do not substantiate specific technical details regarding the attack vector, data handled, or operational impact, so the description remains factual and neutral. This listing consolidates the entity's profile alongside its verified association with nightspire for threat-intelligence indexing purposes. U**IN* Group was listed as a ransomware victim associated with nightspire. |
||||||
| Ransomware | U**IN* Group id35090 View details | India | Services | pending | ||
|
U**IN* Group is an entity identified within the IT sector located in India, cataloged as a ransomware victim in the threat-intelligence index. The designation reflects its classification in relation to a cyber incident attributed to the nightspire threat actor. Publicly available details concerning its specific operational profile, infrastructure, or incident specifics remain limited in the provided context, so the description emphasizes its indexed classification rather than speculative claims. This entry serves threat-intelligence professionals seeking structured context on ransomware victim entities linked to identified actors. U**IN* Group was listed as a ransomware victim associated with nightspire. |
||||||
| Ransomware | U**IN* Group id35091 View details | India | Services | pending | ||
|
U**IN* Group is an entity operating within the IT sector located in India. The name suggests a technology-focused organization, though specific operational details, services, or internal structure are not publicly verifiable from available threat-intelligence context. In the threat-intelligence index, U**IN* Group is cataloged as a ransomware victim associated with the nightspire threat actor. This listing reflects the entity's observed relationship within the indexed incident landscape without disclosing confirmed breach specifics. The entry serves to document the association for analysts tracking ransomware activity across IT sectors and regional threat actor campaigns. |
||||||
| Ransomware | U**IN* Group id35095 View details | United States | Services | pending | ||
|
U**IN* Group operates within the US IT sector and is cataloged as a ransomware victim within this threat-intelligence index. The entity name suggests a specific organizational or service identifier relevant to incident tracking and analysis. Its classification reflects the impact of cyber threats on information technology infrastructure. This listing is directly associated with the threat actor nightspire, linking the entity to a documented ransomware incident context. The description remains neutral and factual, focusing on sector, location, listing type, and associated actor without extrapolating unconfirmed details. |
||||||
| Ransomware | U**IN* Group id35098 View details | India | Services | pending | ||
|
U**IN* Group is a services-sector organization based in India operating within the professional and service industries. The entity is cataloged as a ransomware victim within the threat-intelligence index, associated with the threat actor nightspire. Its classification reflects the impact observed in service-oriented environments targeted by cyber threats. This listing documents the relationship between the organization and the identified threat actor without disclosing unverified incident details, preserving factual neutrality for threat-intelligence analysis. |
||||||
| Ransomware | 🎊 More than 4,000 User Data is Leaked. 🎊 id34286 View details | — | leaked | |||
|
🎊 More than 4,000 User Data is Leaked. 🎊 We are providing information regarding 4,000 personal records leaked from ArtisticSmiles. You can view sample images below. |
||||||
| Ransomware | 🎊 New Official Channel is opened. 🎊 id34287 View details | — | pending | |||
|
🎊 New Official Channel is opened. 🎊 In response to the blocking of our official channel, NightSpire has decided to reopen a channel for material sales and free services. Previously posted items will be reposted on the new channel, and new items will also be uploaded soon. Please click the link below to check out the channel. [Telegram link: professional/enterprise only] |
||||||
| Ransomware | 💀 Penalty For Violating Negotiation Principles 💀 id34288 View details | — | pending | |||
|
💀 Penalty For Violating Negotiation Principles 💀 Advanced Vehicle Assembles, one of our 💀 victim, aimed to negotiate with us, but wasted our time by ignoring even the most basic aspects of negotiation and adopting an uncooperative attitude. As a proper measure in response, we are fully disclosing their name and file list. Two days from now, we will share the links with everyone through all available channels, including our website and Telegram channel, so that all their files can be downloaded for free. |
||||||
| Ransomware | ☠ Our Last Warning to GMP Group ☠ id34289 View details | — | pending | |||
|
☠ Our Last Warning to GMP Group ☠ Last Warning to the GMP Group ( Premier Singapore Recruitment Firm with Global Reach ) We're certain once again that if you let you ignore your data leak, it will lead to terrible damage to your company, and you will have to answer to all your clients and partners. Your data (like PII documents, Corporate Agreements, Candidates' Personal Information, etc.) is already ready to be used for voice phishing, scamming, and phishing and all these operations will begin from next Monday. Also comments about your hacking will be made on every posts of your social accounts. ( Instagram, Facebook, X, Youtube...) We will wait with strong patience until Saturday evening, but if you still ignore our kind messages and long wait, your company will be collapsed gracefully. |
||||||
| Ransomware | 🎊 Selling Initial Access & PoC to Encrypt the 🌏Plant 🎊 id34290 View details | — | deleted | |||
|
🎊 Selling Initial Access & PoC to Encrypt the 🌏Plant 🎊 NightSpire is going to sell initial access to anyone who wants to buy. Also PoC code to help you gain acces to targets. We 🎉 welcome anyone who wants to encrypt the 🌍 world. If you make your mind to buy, please contact us. |
||||||
| Ransomware | 🎊 NightSpire Official Telegram Channel Opened. 🎊 id34291 View details | — | pending | |||
|
🎊 NightSpire Official Telegram Channel Opened. 🎊 Recently we opened our official telegram channel. We will post our announcements and data selling news on the channel. You can find more details of victim on our telegram channel in details with images. [Telegram link: professional/enterprise only] Join and subscribe to the channel to receive new news and benefits. |
||||||
| Ransomware | 🎭 NightSpire Leaks Data - Big Brothers Big Sisters & GD-France 🎭 id34292 View details | United States | NGOs / Associations | leaked | ||
|
🎭 NightSpire Leaks Data - Big Brothers Big Sisters & GD-France 🎭 We are so happy to our friends to share the database download link with you. https://gofile.io/d/8D58iY - GD France https://gofile.io/d/2n43ZH - Big Brothes and Big Sisters |
||||||
| Ransomware | CONTACT or NOT with Third-Party. To All of you victims. id34293 View details | — | pending | |||
|
CONTACT or NOT with Third-Party. To All of you victims. Don't go to the police or the FBI for help and don't tell anyone that we attacked you. They won't help and will only make things worse for you. In 3 years not a single member of our group has been caught by the police, we are top notch hackers and we never leave a trail of crime. The police will try to prohibit you from paying the ransom in any way. The first thing they will tell you is that there is no guarantee to decrypt your files and remove stolen files, this is not true, we can do a test decryption before paying and your data will be guaranteed to be removed because it is a matter of our reputation, we make hundreds of millions of dollars and are not going to lose our revenue because of your files. It is very beneficial for the police and FBI to let everyone on the planet know about your data leak because then your state will get the fines budgeted for you due to GDPR and other similar laws. The fines will be used to fund the police and the FBI, they will eat more sweet coffee donuts and get fatter and fatter. The police and the FBI don't care what losses you suffer as a result of our attack, and we will help you get rid of all your problems for a modest sum of money. Along with this you should know that it is not necessarily your company that has to pay the ransom and not necessarily from your bank account, it can be done by an unidentified person, such as any philanthropist who loves your company, for example, Elon Musk, so the police will not do anything to you if someone pays the ransom for you. If you're worried that someone will trace your bank transfers, you can easily buy cryptocurrency for cash, thus leaving no digital trail that someone from your company paid our ransom. The police and FBI will not be able to stop lawsuits from your customers for leaking personal and private information. The police and FBI will not protect you from repeated attacks. Paying the ransom to us is much cheaper and more profitable than paying fines and legal fees. What are the dangers of leaking your company's data. First of all, you will receive fines from the government such as the GDRP and many others, you can be sued by customers of your firm for leaking information that was confidential. Your leaked data will be used by all the hackers on the planet for various unpleasant things. For example, social engineering, your employees' personal data can be used to re-infiltrate your company. Bank details and passports can be used to create bank accounts and online wallets through which criminal money will be laundered. On another vacation trip, you will have to explain to the FBI where you got millions of dollars worth of stolen cryptocurrency transferred through your accounts on cryptocurrency exchanges. Your personal information could be used to make loans or buy appliances. You would later have to prove in court that it wasn't you who took out the loan and pay off someone else's loan. Your competitors may use the stolen information to steal technology or to improve their processes, your working methods, suppliers, investors, sponsors, employees, it will all be in the public domain. You won't be happy if your competitors lure your employees to other firms offering better wages, will you? Your competitors will use your information against you. For example, look for tax violations in the financial documents or any other violations, so you have to close your firm. According to statistics, two thirds of small and medium-sized companies close within half a year after a data breach. You will have to find and fix the vulnerabilities in your network, work with the customers affected by data leaks. All of these are very costly procedures that can exceed the cost of a ransomware buyout by a factor of hundreds. It's much easier, cheaper and faster to pay us the ransom. Well and most importantly, you will suffer a reputational loss, you have been building your company for many years, and now your reputation will be destroyed. Don't go to recovery companies, they are essentially just middlemen who will make money off you and cheat you. We are well aware of cases where recovery companies tell you that the ransom price is 5 million dollars, but in fact they secretly negotiate with us for 1 million dollars, so they earn 4 million dollars from you. If you approached us directly without intermediaries you would pay 5 times less, that is 1 million dollars. Very IMPORTANT!!! For those who have cyber insurance against ransomware attacks. Insurance companies require you to keep your insurance information secret, this is to never pay the maximum amount specified in the contract or to pay nothing at all, disrupting negotiations. The insurance company will try to derail negotiations in any way they can so that they can later argue that you will be denied coverage because your insurance does not cover the ransom amount. For example your company is insured for 10 million dollars, while negotiating with your insurance agent about the ransom he will offer us the lowest possible amount, for example 100 thousand dollars, we will refuse the paltry amount and ask for example the amount of 15 million dollars, the insurance agent will never offer us the top threshold of your insurance of 10 million dollars. He will do anything to derail negotiations and refuse to pay us out completely and leave you alone with your problem. If you told us anonymously that your company was insured for $10 million and other important details regarding insurance coverage, we would not demand more than $10 million in correspondence with the insurance agent. That way you would have avoided a leak and decrypted your information. But since the sneaky insurance agent purposely negotiates so as not to pay for the insurance claim, only the insurance company wins in this situation. To avoid all this and get the money on the insurance, be sure to inform us anonymously about the availability and terms of insurance coverage, it benefits both you and us, but it does not benefit the insurance company. Poor multimillionaire insurers will not starve and will not become poorer from the payment of the maximum amount specified in the contract, because everyone knows that the contract is more expensive than money, so let them fulfill the conditions prescribed in your insurance contract, thanks to our interaction. |
||||||
| Ransomware | 🎉 Great News for 2026! 🎉 NIGHTSPIRE team has started RaaS(Ransom-as-a-Service) 🎭 id34294 View details | — | pending | |||
|
🎉 Great News for 2026! 🎉 NIGHTSPIRE team has started RaaS(Ransom-as-a-Service) 🎭. We are so glad to inform you that we have started RaaS. We invite all of you guys who wants to work with us. We are open-minded, we are welcoming whoever you are. Come and chat with us and ful-fill your expectation. We are always waiting for you at this address... http://nspire7lugml7ybqyjaaxtsgrs4qn3fcon3lrjbih6wamttvdm5ke4qd.onion #### Send message using qTox, telegram or session. #### |
||||||
| Ransomware | 🎭 First Free Data link Published in 2026 - NightSpire 🎭 id34295 View details | United States | IT | pending | ||
|
🎭 First Free Data link Published in 2026 - NightSpire 🎭 We are so happy to our friends to share the first free data download link with you. We will share the source code of MD Charts. Projects which are used in hospitals... Horray for Bug Hunters. https://github.com/elijah1998dev/MDCharts_EMR.git |
||||||
| Ransomware | S*o**n* Public Schools id33879 View details | — | — | pending | ||
|
Data is not available now. |
||||||
| Ransomware | Colorado Texas id33849 View details | United States | — | — | pending | |
|
Data is not available now. |
||||||
| Ransomware | ***o* **s**e** Solutions id33850 View details | — | — | pending | ||
|
Data is not available now. |
||||||
| Ransomware | Cognosis Limited id33739 View details | United Kingdom | — | — | pending | |
|
Data is not available now. |
||||||
| Ransomware | G** Re******* Ltd id33740 View details | — | — | pending | ||
|
Data is not available now. |
||||||
| Ransomware | Spo****** Public Schools id33741 View details | — | — | pending | ||
|
Data is not available now. |
||||||
| Ransomware | MGT Lojistik AŞ id33718 View details | Türkiye | — | — | pending | |
|
[AI generated] N/A I don't have verified, reliable information about a company called "MGT Lojistik AŞ" in my knowledge base. While "Lojistik" suggests a Turkish logistics company (AŞ being a common Turkish corporate suffix for "Anonim Şirketi," or joint-stock company), I cannot confirm specific details about this entity's operations, services, founding, or business activities with confidence. Providing fabricated details would be inappropriate for threat intelligence purposes, where accuracy is critical. If you have additional context, source documents, or details about this company, I'd be glad to help analyze that information instead. |
||||||
| Ransomware | KP Industries id33719 View details | United Kingdom | — | — | pending | |
|
[AI generated] N/A I don't have verified, reliable information about a specific company named "KP Industries." This is a generic-sounding business name that could refer to multiple unrelated companies across different industries and countries, and I cannot confirm details for any specific entity without risking inaccurate or fabricated information. |
||||||
| Ransomware | Fondy Food Pantry id33594 View details | United States | — | — | pending | |
|
Data is not available now. |
||||||
| Ransomware | The Bernard Osher Foundation id33595 View details | United States | — | — | pending | |
|
Data is not available now. |
||||||
| Ransomware | PMG Project Management Group id33596 View details | United Arab Emirates | — | — | pending | |
|
Data is not available now. |
||||||
| Ransomware | Mäntelhaus Kaiser GmbH & Co. KG id33592 View details | Germany | — | — | pending | |
|
[AI generated] N/A I don't have reliable, verifiable information about a company called "Mäntelhaus Kaiser GmbH & Co. KG" in my knowledge base. Rather than provide fabricated details about its operations, industry specifics, or founding history, I'm flagging this as unverifiable. If you have source material or context about this company, please share it and I can help analyze or summarize that information instead. |
||||||
| Ransomware | INAPI id33586 View details | Algeria | — | — | pending | |
|
[AI generated] N/A INAPI commonly refers to Chile's Instituto Nacional de Propiedad Industrial (National Institute of Industrial Property), a Chilean government agency responsible for registering trademarks, patents, and other industrial property rights. However, I cannot confirm with certainty that this is the specific entity you are referencing, as there may be other organizations using this name, and I lack sufficient verified detail to provide a confident, accurate profile without risking inaccuracy. |
||||||
| Ransomware | Medcom Tech Information id33587 View details | Spain | — | — | pending | |
|
[AI generated] N/A I don't have verified, reliable information about a specific company named "Medcom Tech Information." Providing fabricated details about its operations, industry, or country would risk being inaccurate for threat intelligence purposes. If you have additional context—such as a website, registration details, or region of operation—I can help verify or research further. |
||||||
| Ransomware | WAGA Enterprises Architects LLC id33588 View details | United States | — | — | pending | |
|
[AI generated] N/A I don't have reliable, verifiable information about a company specifically named "WAGA Enterprises Architects LLC." To avoid providing inaccurate or fabricated details, I'm unable to generate a factual description. If you have additional context (location, industry sector, registration details, or a website), I can try to help further or you may want to verify through business registries such as state Secretary of State databases, Dun & Bradstreet, or OpenCorporates. |
||||||
| Ransomware | Heidi's Events & Catering, Inc. id33589 View details | United States | — | — | pending | |
|
[AI generated] N/A I don't have reliable, verifiable information about a specific company named "Heidi's Events & Catering, Inc." in my training data. This appears to be either a small/local business not well-documented in public sources, or a name that could correspond to multiple unrelated entities. To provide an accurate threat intelligence profile, I'd need you to supply additional identifying details, such as: a business registration number, headquarters location or address, website domain, known executives, or industry sector specifics. With that information, I could help structure an assessment or guide you on how to verify the company through business registries, sanctions lists, or corporate databases. |
||||||
| Ransomware | Sangre de Cristo Arts and Conference Center id33590 View details | United States | — | — | pending | |
|
[AI generated] Sangre de Cristo Arts and Conference Center is a nonprofit cultural organization located in Pueblo, Colorado, United States. It operates as a multidisciplinary arts facility featuring art galleries, a children's museum, performing arts theaters, and conference and event spaces. The center hosts exhibitions, live performances, educational programs, and community events, serving the arts, culture, and entertainment industry in the southern Colorado region. |
||||||
| Ransomware | Vietnam SuperPort id33591 View details | Viet Nam | — | — | pending | |
|
[AI generated] N/A I don't have verified, reliable information about a specific company called "Vietnam SuperPort." There is a known logistics project called "Vietnam SuperPort" associated with YCH Group (a Singapore-based logistics company) and intended to be a smart logistics hub in Vinh Phuc province, Vietnam, but I cannot confirm sufficient reliable details to provide an accurate factual description without risking inaccuracy. |
||||||
| Ransomware | Valvorobica Industirale S.p.A id33584 View details | Italy | — | — | pending | |
|
[AI generated] N/A I don't have reliable, verifiable information about a company by this name ("Valvorobica Industriale S.p.A"). Rather than fabricate details about its operations, industry specifics, or location, I'm flagging this as unknown. If you have source documents or additional context about this company, please share them and I can help analyze that material. |
||||||
| Ransomware | KC Pharmaceuticals, Inc id33585 View details | United States | — | — | pending | |
|
[AI generated] N/A I don't have verified, reliable information about a specific company called "KC Pharmaceuticals, Inc" in my knowledge base. There may be multiple companies with similar names, or this could be a smaller/private entity without significant public records. To avoid providing inaccurate or fabricated details in a threat intelligence context, I'm declining to speculate. If you have additional context (location, products, executives, ticker symbol, or source document mentioning this company), I can help verify or research further. |
||||||
| Ransomware | Asociación de Escribanos del Uruguay id33551 View details | Uruguay | — | — | pending | |
|
[AI generated] The Asociación de Escribanos del Uruguay is a professional association representing notaries (escribanos) in Uruguay. It operates within the legal services industry, providing support, regulation guidance, continuing education, and professional representation for notarial practitioners. The organization promotes standards of notarial practice, ethics, and legal certainty in document authentication and property transactions. It is based in Montevideo, Uruguay, and serves the national notarial community. |
||||||
| Ransomware | Sociedad Portuaria Mardique S.A. id33552 View details | Colombia | — | — | pending | |
|
[AI generated] N/A |
||||||
| Ransomware | Sinae Phuket Luxury Hotel id33553 View details | Thailand | — | — | pending | |
|
[AI generated] N/A |
||||||
| Ransomware | INI Fiocruz id33554 View details | Brazil | — | — | pending | |
|
[AI generated] INI Fiocruz refers to the Instituto Nacional de Infectologia Evandro Chagas, a research and hospital unit of the Oswaldo Cruz Foundation (Fiocruz) in Brazil. It operates in the healthcare and biomedical research industry, specializing in infectious disease treatment, clinical research, and public health initiatives. Based in Rio de Janeiro, Brazil, it is a government-affiliated institution under the Ministry of Health, contributing to disease surveillance, vaccine studies, and medical training programs. |
||||||
| Ransomware | Lumabuilt id33555 View details | United States | — | — | pending | |
|
[AI generated] N/A I don't have reliable, verified information about a company called "Lumabuilt." Rather than provide potentially fabricated details about its industry, operations, or country, I'm flagging this as unknown. If you have additional context (website, location, sector) or if this is a fictional/test entity, please share details and I can help frame a description accordingly. |
||||||
| Ransomware | Royal EGT id33556 View details | Egypt | — | — | pending | |
|
[AI generated] N/A |
||||||
| Ransomware | Deese and Locklear Chiropractic Center id33557 View details | United States | — | — | pending | |
|
[AI generated] N/A I don't have reliable, verifiable information about a specific company called "Deese and Locklear Chiropractic Center." While this sounds like it could plausibly be a small, local chiropractic practice (based on the naming convention, likely in the United States, possibly the Carolinas given the surname "Locklear"), I cannot confirm its existence, operations, or details with confidence, and providing fabricated information would not be appropriate for threat intelligence purposes. |
||||||
| Ransomware | KSL Dirtworks id33558 View details | United States | — | — | pending | |
|
[AI generated] N/A I do not have reliable, verified information about a specific company called "KSL Dirtworks." Rather than provide potentially inaccurate details about its operations, industry classification, or country of operation, I'm flagging this as unknown. If you have additional context (location, industry sector, or related business names), I can help refine the search or you can verify through official business registries. |
||||||
| Ransomware | Nantou Shiuhkuang Senior High School. id33559 View details | Taiwan, Province of China | — | — | pending | |
|
Data is not available now. |
||||||
| Ransomware | R***e Pa****** id33491 View details | — | — | pending | ||
|
Data is not available now. |
||||||
| Ransomware | Forma Therapeutics Holdings, Inc. id33420 View details | United States | Services | — | pending | |
|
- Clinical Trial & Statistical Data- Electronic Lab Notebooks & Research IP- Drug Discovery & Pipeline Data- Biological Research & Genomic Data |
||||||
| Ransomware | C*ro *nty *es id33375 View details | null | — | pending | ||
|
Data is not available now. |
||||||
| Ransomware | 360 Consulenza S.r.l. id33039 View details | Italy | Services | — | pending | |
|
- Clients' Private Documents- Projects- Software Source Codes |
||||||
| Ransomware | Spo**** Schools id33040 View details | United States | Education | — | pending | |
|
Data is not available now. |
||||||
| Ransomware | Great Bay Bio id33004 View details | Hong Kong | Healthcare / Pharma | — | pending | |
|
Data is not available now. |
||||||
| Ransomware | DiamondLease id32762 View details | United Arab Emirates | Finance / Legal / Insurance | — | pending | |
|
[AI generated] N/A |
||||||
| Ransomware | Perimetral Oriental de Bogotá S.A.S. id32759 View details | Colombia | Services | — | pending | |
|
- Customers' Interior Designs- Many Departments Internal Documents |
||||||
| Ransomware | Ozel & Ozel Laws Office id32760 View details | Türkiye | Retail / E-commerce | — | pending | |
|
Data is not available now. |
||||||
| Ransomware | Tuboaços da Amazônia Ltda. id32761 View details | Brazil | Retail / E-commerce | — | pending | |
|
- Drawings- Clients' Customized Projects |
||||||
| Ransomware | Transportes Montejo S.A.S. id32399 View details | Colombia | Transportation / Travel / Logistics | — | pending | |
|
Data is not available now. |
||||||
| Ransomware | Easyoga id32367 View details | Taiwan, Province of China | Retail / E-commerce | — | pending | |
|
Data is not available now. |
||||||
| Ransomware | Truckworx id32368 View details | United States | Transportation / Travel / Logistics | — | pending | |
|
- Financial records- Accounting records- Tax records- Business operations documents- Legal/corporate records |
||||||
| Ransomware | Victory Personal Care, Inc id31959 View details | United States | — | — | pending | |
|
Data is not available now. |
||||||
| Ransomware | Vi***** Pe****** C***, Inc id31908 View details | — | — | pending | ||
|
Data is not available now. |
||||||
| Ransomware | T****w**x id31809 View details | — | — | deleted | ||
|
Data is not available now. |
||||||
| Ransomware | eas**** id31656 View details | United Kingdom | IT | — | deleted | |
|
Data is not available now. |
||||||
| Ransomware | Tianji Auto Care Service Company id31650 View details | Türkiye | Transportation / Travel / Logistics | — | pending | |
|
Data is not available now. |
||||||
| Ransomware | T***w**x id31459 View details | United States | IT | — | deleted | |
|
Data is not available now. |
||||||
| Ransomware | The Mountain id30988 View details | United Kingdom | Transportation / Travel / Logistics | — | pending | |
|
- HR & Payroll Data- Financial & Accounting Records- Payment & Credit Card Data- Customer & CRM Data- Orders & Supply Chain Data- SharePoint & Business Application Data |
||||||
| Ransomware | Kates Nussman Ellis Earle & Landolfi LLP id30989 View details | United States | Services | — | pending | |
|
Data is not available now. |
||||||
| Ransomware | Akribis Systems Pte Ltd id30975 View details | Singapore | Manufacturing / Engineering | — | pending | |
|
- All Motor Designs- CAD Files- Employee & HR Sensitive Data- Legal & Compliance- Machine Details |
||||||
| Ransomware | Thai Seng International Co. Ltd id30976 View details | Thailand | Manufacturing / Engineering | — | pending | |
|
- Administration documents from Thaiseng International Co, Ltd- Marketing data which includes client information. |
||||||
| Ransomware | MKS Transformator id30977 View details | Türkiye | Manufacturing / Engineering | — | pending | |
|
- Accounting / Finance Documents- Projects Data, Purchasing / Procurement Documents- Quality / Document Control- Maintenance, and HR documents- Production / Manufacturing Data |
||||||
| Ransomware | OPTIDEA GmbH id30978 View details | Switzerland | IT | — | pending | |
|
- Internal Document- Financial & HR Documents- Design Data |
||||||
| Ransomware | Furama Bukit Bintang id30979 View details | Malaysia | Hospitality / Food & Beverage / Tourism | — | pending | |
|
- Executive Data- HR Data and Documents- Data for IT Department |
||||||
| Ransomware | K. Venkatesh, Co id30980 View details | India | IT | — | pending | |
|
- Internal Documents |
||||||
| Ransomware | Wings Argo Private Limited id30981 View details | India | Agriculture / Food | — | pending | |
|
Wings Production DB |
||||||
| Ransomware | KSL Dirtworks LLC id30982 View details | United States | Construction / Real Estate | — | pending | |
|
- HR Documents- Financial Documents- Contracts- Bids & Proposals- Project Documents- Office Documents- Construction Standards- Insurance Documents |
||||||
| Ransomware | Diffusion de Produits Inoxydables id30983 View details | France | IT | — | pending | |
|
- Bank account details- Digital certificate- Financial records- Employee/HR records- Customer and supplier data- Contracts and quotations |
||||||
| Ransomware | TFG Benefits, Inc. id30984 View details | United States | Finance / Legal / Insurance | — | pending | |
|
- Employee PII- Payroll- Benefits- Financials- Client HR- Identity Docs |
||||||
| Ransomware | Auto Royal Company id30774 View details | Italy | Transportation / Travel / Logistics | — | pending | |
|
More than 100GB of SQLInfinity Database |
||||||
| Ransomware | Cedar Crest College id30557 View details | United States | Education | — | pending | |
|
Data is not available now. |
||||||
| Ransomware | Webosphere id30524 View details | India | IT | — | pending | |
|
-SQL Database- Source Code |
||||||
| Ransomware | PCCC Realty LLC id30357 View details | United States | Construction / Real Estate | — | pending | |
|
Data is not available now. |
||||||
| Ransomware | Grupo Riquelme id30026 View details | Paraguay | Transportation / Travel / Logistics | — | pending | |
|
- Full Database Backup- Banking & Financial Data- Accounting & Ledger Records- Customer Databases- HR / Workforce Data- User, Role & Permission data- ERP & Critical Business Application Data |
||||||
| Ransomware | Artistic Smiles id30072 View details | United States | NGOs / Associations | — | pending | |
|
Data is not available now. |
||||||
| Ransomware | legendsmn(Blue Ox, Paul Bunyan, Lumberjack Electric) id29988 View details | United States | Retail / E-commerce | — | pending | |
|
Data is not available now. |
||||||
| Ransomware | dean cosmetic dentistry id29989 View details | United States | Healthcare / Pharma | — | pending | |
|
Data is not available now. |
||||||
| Ransomware | Guy E******* & F*******, P.A id29948 View details | Finance / Legal / Insurance | — | pending | ||
|
Data is not available now. |
||||||
| Ransomware | Central Texas ***** ***** id29949 View details | Energy | — | pending | ||
|
Data is not available now. |
||||||
| Ransomware | Ri***** Co**** Europe S.r.l. id29950 View details | Retail / E-commerce | — | pending | ||
|
Data is not available now. |
||||||
| Ransomware | B****S I******t***l id29906 View details | Finance / Legal / Insurance | — | pending | ||
|
Data is not available now. |
||||||
| Ransomware | Sheraton Miramar Resort El Gouna id29907 View details | Egypt | Hospitality / Food & Beverage / Tourism | — | pending | |
|
Data is not available now. |
||||||
| Ransomware | G**** R****l*e id29908 View details | Construction / Real Estate | — | deleted | ||
|
Data is not available now. |
||||||
| Ransomware | Silsbee Police Department id29857 View details | United States | Education | — | pending | |
|
Court Information |
||||||
| Ransomware | K****** County. Mi**e**ta id29858 View details | United States | Public Sector | — | pending | |
|
Data is not available now. |
||||||
| Ransomware | WaxWorks Inc id29859 View details | United States | IT | — | pending | |
|
[AI generated] N/A |
||||||