Clínica La Sabana2026-06-26
payloadransomwareCosta Rica
Una institución médica en Bogotá, Colombia, Clínica La Sabana, ha sido afectada por un ataque cibernético relacionado con ransomware. El incidento ocurrió el 26 de junio de 2026 y se atribuy...
Mosaic Partners2026-06-26
payloadransomwareSwitzerland
El 26 de junio de 2026, la empresa suiza Mosaic Partners fue objeto de un ataque cibernético que se presume es un ransomware. La organización, especializada en servicios IT, desarrollo de so...
Ido Cohen: Two ransomware groups are showing a sharp increase in activity during 2026. SafePay Q1 2026: 22 victims Q2 2026: 59 victims (+168%) RALord (Nova) Q1 2026: 14 victims Q2 2026: 60 victims (+329%) Both groups have significantly accelerated their operations in recent months, making them two of the fastest-growing ransomware threats to watch. Track ransomware trends and emerging threat groups with DarkFeed.2026-06-26
ido_cohen2ransomwareUnknownT1566
Independent cyber threat research covering malware campaigns, phishing infrastructure and vulnerability exploitation.
Ido Cohen: Tracking the pulse of ransomware in 2026—these are the groups leading the global attack landscape right now: Qilin – 665 attacks The Gentleman – 453 attacks Akira – 290 attacks DragonForce – 245 attacks INC – 239 attacks Lockbit – 199 attacks Play – 154 attacks CLOP – 127 attacks NightSpire – 115 attacks CoinBase Cartel – 97 attacks Stay ahead of ransomware threats.2026-06-26
ido_cohen2ransomwareUnknownT1566
Independent cyber threat research covering malware campaigns, phishing infrastructure and vulnerability exploitation.
Ransomware Monitor: Actor: #akira Victim: Precise Forms Date: 2026-06-26 19:01:44 UTC+3 According to #DarkWeb #Ransomware activity detected by the ThreatMon Threat Intelligence Team. The “#akira” Ransomware group has added Precise Forms to its victims.2026-06-26
TMRansomMonransomwareUnknown
Ransomware monitoring feed tracking new victim disclosures, data leaks and group activity.
Ransomware Monitor: Actor: #nova Victim: NSW Rural Fire Service Date: 2026-06-26 17:15:21 UTC+3 According to #DarkWeb #Ransomware activity detected by the ThreatMon Threat Intelligence Team. The “#nova” Ransomware group has added NSW Rural Fire Service to its victims.2026-06-26
TMRansomMonransomwareUnknown
Ransomware monitoring feed tracking new victim disclosures, data leaks and group activity.
Ransomware Monitor: Actor: #payload Victim: Software Arge Date: 2026-06-26 17:19:44 UTC+3 According to #DarkWeb #Ransomware activity detected by the ThreatMon Threat Intelligence Team. The “#payload” Ransomware group has added Software Arge to its victims.2026-06-26
TMRansomMonransomwareUnknown
Ransomware monitoring feed tracking new victim disclosures, data leaks and group activity.
Ransomware Monitor: Actor: #payload Victim: Clínica La Sabana Date: 2026-06-26 17:19:50 UTC+3 According to #DarkWeb #Ransomware activity detected by the ThreatMon Threat Intelligence Team. The “#payload” Ransomware group has added Clínica La Sabana to its victims.2026-06-26
TMRansomMonransomwareUnknown
Ransomware monitoring feed tracking new victim disclosures, data leaks and group activity.
Ransomware Monitor: Actor: #nova Victim: vslmarine Date: 2026-06-26 14:13:51 UTC+3 According to #DarkWeb #Ransomware activity detected by the ThreatMon Threat Intelligence Team. The “#nova” Ransomware group has added vslmarine to its victims.2026-06-26
TMRansomMonransomwareUnknown
Ransomware monitoring feed tracking new victim disclosures, data leaks and group activity.
Ransomware Monitor: Actor: #payload Victim: Mosaic Partners Date: 2026-06-26 16:17:54 UTC+3 According to #DarkWeb #Ransomware activity detected by the ThreatMon Threat Intelligence Team. The “#payload” Ransomware group has added Mosaic Partners to its victims.2026-06-26
TMRansomMonransomwareUnknown
Ransomware monitoring feed tracking new victim disclosures, data leaks and group activity.
Ransomware Monitor: Actor: #ailock Victim: Hokua Date: 2026-06-26 14:38:35 UTC+3 According to #DarkWeb #Ransomware activity detected by the ThreatMon Threat Intelligence Team. The “#ailock” Ransomware group has added Hokua to its victims.2026-06-26
TMRansomMonransomwareUnknown
Ransomware monitoring feed tracking new victim disclosures, data leaks and group activity.
Ransomware Monitor: Actor: #incransom Victim: GSP Crop Science Pvt Date: 2026-06-26 07:10:34 UTC+3 According to #DarkWeb #Ransomware activity detected by the ThreatMon Threat Intelligence Team. The “#incransom” Ransomware group has added GSP Crop Science Pvt to its victims.2026-06-26
TMRansomMonransomwareUnknown
Ransomware monitoring feed tracking new victim disclosures, data leaks and group activity.
Ransomware Monitor: Actor: #incransom Victim: Life Bridges Date: 2026-06-26 05:08:35 UTC+3 According to #DarkWeb #Ransomware activity detected by the ThreatMon Threat Intelligence Team. The “#incransom” Ransomware group has added Life Bridges to its victims.2026-06-26
TMRansomMonransomwareUnknown
Ransomware monitoring feed tracking new victim disclosures, data leaks and group activity.
Ransomware Monitor: Actor: #nightspire Victim: Grupo Riquelme Date: 2026-06-26 03:15:53 UTC+3 According to #DarkWeb #Ransomware activity detected by the ThreatMon Threat Intelligence Team. The “#nightspire” Ransomware group has added Grupo Riquelme to its victims.2026-06-26
TMRansomMonransomwareUnknown
Ransomware monitoring feed tracking new victim disclosures, data leaks and group activity.
MalwareHunterTeam: List of names: "CamScanner 19-06-2026 16.49.accdr" "Adv Int Course (Rome).accdr" "Expression of Interest (EOI).accdr" "Security Orientation Course-41.accdr" "001210.accdr" "Proposal for Area Admin Meeting - SLNS Barana.accdr" "UN-System-wide-Strategy-on-SSC-2026-2029.accdr" 2026-06-26
malwrhunterteamcampaignUnknown
Malware samples, IOCs and indicators of compromise distributed by the MalwareHunterTeam research group.
MalwareHunterTeam: A possible interesting, low detected sample that was seen from Italy has @ET_Labs "ET MALWARE Win32/Darkme Trojan Checkin M1" traffic match to that IP address. In case correct, that IP can be related to Evilnum APT... As soon as @smica83 has time, the sample will be uploaded to Bazaar and then anyone can look. cc @marsomx_ @G609309532026-06-26
malwrhunterteammalwareItaly
Malware samples, IOCs and indicators of compromise distributed by the MalwareHunterTeam research group.
Hackmanac: Cyber Alert ‼ USA - 𝗣𝗼𝗹𝘆𝗺𝗮𝗿𝗸𝗲𝘁 Polymarket confirmed a third-party compromise that enabled attackers to inject malicious code into its website, leading to the theft of user funds. The company contained the incident and will refund affected users. Around the same time, researchers reported a phishing campaign targeting Polymarket users that allegedly stole about US$3 million in cryptocurrency.2026-06-26
H4ckmanacphishingUnited StatesT1566
Threat intelligence and cyber alert feed covering data breaches, ransomware incidents and vulnerability disclosures.