{
  "generated_at": "2026-09-22T07:41:14.052Z",
  "api_version": "v1",
  "disclaimer": "Aggregated from public sources. Freshness depends on upstream feeds; this is not a commercial threat-intel feed and carries no SLA. Verify before acting.",
  "attribution": [
    {
      "name": "ransomware.live",
      "url": "https://www.ransomware.live/",
      "licence": "see ransomware.live terms"
    }
  ],
  "sources": [
    {
      "name": "ransomware.live",
      "ok": true,
      "count": 40,
      "response_ms": 4,
      "error": null
    }
  ],
  "count_total_available": 40,
  "limit_applied": 500,
  "count": 40,
  "indicators": [
    {
      "type": "victim",
      "value": "Sealcon",
      "context": "termite — US — Manufacturing",
      "group": "termite",
      "country": "US",
      "sector": "Manufacturing",
      "tags": [
        "ransomware",
        "victim",
        "termite"
      ],
      "seenAt": "2026-09-22T02:45:36.882685+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/U2VhbGNvbkB0ZXJtaXRl"
    },
    {
      "type": "victim",
      "value": "FinSoft (Kolibri retail back-office software)",
      "context": "N0n — UZ — Retail & E-Commerce",
      "group": "N0n",
      "country": "UZ",
      "sector": "Retail & E-Commerce",
      "tags": [
        "ransomware",
        "victim",
        "n0n"
      ],
      "seenAt": "2026-09-22T01:51:38.794148+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/RmluU29mdCAoS29saWJyaSByZXRhaWwgYmFjay1vZmZpY2Ugc29mdHdhcmUpQE4wbg=="
    },
    {
      "type": "victim",
      "value": "TruAmerica Multifamily",
      "context": "termite — US — Not Found",
      "group": "termite",
      "country": "US",
      "sector": null,
      "tags": [
        "ransomware",
        "victim",
        "termite"
      ],
      "seenAt": "2026-09-22T01:45:30.663148+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/VHJ1QW1lcmljYSBNdWx0aWZhbWlseUB0ZXJtaXRl"
    },
    {
      "type": "victim",
      "value": "theLender",
      "context": "termite — US — Financial Services",
      "group": "termite",
      "country": "US",
      "sector": "Financial Services",
      "tags": [
        "ransomware",
        "victim",
        "termite"
      ],
      "seenAt": "2026-09-22T01:44:58.093768+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/dGhlTGVuZGVyQHRlcm1pdGU="
    },
    {
      "type": "victim",
      "value": "Metallco",
      "context": "play — BR — Manufacturing",
      "group": "play",
      "country": "BR",
      "sector": "Manufacturing",
      "tags": [
        "ransomware",
        "victim",
        "play"
      ],
      "seenAt": "2026-09-21T22:16:54.217399+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/TWV0YWxsY29AcGxheQ=="
    },
    {
      "type": "victim",
      "value": "Hurley",
      "context": "play — US — Other",
      "group": "play",
      "country": "US",
      "sector": "Other",
      "tags": [
        "ransomware",
        "victim",
        "play"
      ],
      "seenAt": "2026-09-21T22:16:19.325560+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/SHVybGV5QHBsYXk="
    },
    {
      "type": "victim",
      "value": "Astemo, Ltd.",
      "context": "metaencryptor — JP — Manufacturing",
      "group": "metaencryptor",
      "country": "JP",
      "sector": "Manufacturing",
      "tags": [
        "ransomware",
        "victim",
        "metaencryptor"
      ],
      "seenAt": "2026-09-21T22:14:32.083951+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/QXN0ZW1vLCBMdGQuQG1ldGFlbmNyeXB0b3I="
    },
    {
      "type": "victim",
      "value": "Hogan Lovells Cadwalader",
      "context": "SilentRansomGroup — ? — Professional Services",
      "group": "SilentRansomGroup",
      "country": null,
      "sector": "Professional Services",
      "tags": [
        "ransomware",
        "victim",
        "silentransomgroup"
      ],
      "seenAt": "2026-09-21T21:55:47.896780+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/SG9nYW4gTG92ZWxscyBDYWR3YWxhZGVyQFNpbGVudFJhbnNvbUdyb3Vw"
    },
    {
      "type": "victim",
      "value": "kyyba.com",
      "context": "unsafe — FI — Technology",
      "group": "unsafe",
      "country": "FI",
      "sector": "Technology",
      "tags": [
        "ransomware",
        "victim",
        "unsafe"
      ],
      "seenAt": "2026-09-21T19:23:38.618927+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/a3l5YmEuY29tQHVuc2FmZQ=="
    },
    {
      "type": "victim",
      "value": "Spo**** Schools",
      "context": "nightspire — US — Education",
      "group": "nightspire",
      "country": "US",
      "sector": "Education",
      "tags": [
        "ransomware",
        "victim",
        "nightspire"
      ],
      "seenAt": "2026-09-21T18:43:08.077144+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/U3BvKioqKiBTY2hvb2xzQG5pZ2h0c3BpcmU="
    },
    {
      "type": "victim",
      "value": "Summa Gold",
      "context": "anubis — ? — Manufacturing",
      "group": "anubis",
      "country": null,
      "sector": "Manufacturing",
      "tags": [
        "ransomware",
        "victim",
        "anubis"
      ],
      "seenAt": "2026-09-21T18:22:50.400306+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/U3VtbWEgR29sZEBhbnViaXM="
    },
    {
      "type": "victim",
      "value": "Allied Supply Co.",
      "context": "Global Secret Group — ? — Manufacturing",
      "group": "Global Secret Group",
      "country": null,
      "sector": "Manufacturing",
      "tags": [
        "ransomware",
        "victim",
        "global secret group"
      ],
      "seenAt": "2026-09-21T17:53:28.897930+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/QWxsaWVkIFN1cHBseSBDby5AR2xvYmFsIFNlY3JldCBHcm91cA=="
    },
    {
      "type": "victim",
      "value": "Kjla",
      "context": "Global Secret Group — US — Not Found",
      "group": "Global Secret Group",
      "country": "US",
      "sector": null,
      "tags": [
        "ransomware",
        "victim",
        "global secret group"
      ],
      "seenAt": "2026-09-21T17:52:29.577566+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/S2psYUBHbG9iYWwgU2VjcmV0IEdyb3Vw"
    },
    {
      "type": "victim",
      "value": "Telrad Networks",
      "context": "qilin — IL — Technology",
      "group": "qilin",
      "country": "IL",
      "sector": "Technology",
      "tags": [
        "ransomware",
        "victim",
        "qilin"
      ],
      "seenAt": "2026-09-21T17:22:14.870319+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/VGVscmFkIE5ldHdvcmtzQHFpbGlu"
    },
    {
      "type": "victim",
      "value": "U.S. Electrical Services and Wiedenbach Brown",
      "context": "moneymessage — ? — Energy & Utilities",
      "group": "moneymessage",
      "country": null,
      "sector": "Energy & Utilities",
      "tags": [
        "ransomware",
        "victim",
        "moneymessage"
      ],
      "seenAt": "2026-09-21T15:12:20.806801+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/VS5TLiBFbGVjdHJpY2FsIFNlcnZpY2VzIGFuZCBXaWVkZW5iYWNoIEJyb3duQG1vbmV5bWVzc2FnZQ=="
    },
    {
      "type": "victim",
      "value": "Hudson MD Group, LLC",
      "context": "metaencryptor — US — Healthcare",
      "group": "metaencryptor",
      "country": "US",
      "sector": "Healthcare",
      "tags": [
        "ransomware",
        "victim",
        "metaencryptor"
      ],
      "seenAt": "2026-09-21T13:08:14.932281+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/SHVkc29uIE1EIEdyb3VwLCBMTENAbWV0YWVuY3J5cHRvcg=="
    },
    {
      "type": "victim",
      "value": "Bruker Corporation",
      "context": "metaencryptor — US — Manufacturing",
      "group": "metaencryptor",
      "country": "US",
      "sector": "Manufacturing",
      "tags": [
        "ransomware",
        "victim",
        "metaencryptor"
      ],
      "seenAt": "2026-09-21T13:07:23.145036+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/QnJ1a2VyIENvcnBvcmF0aW9uQG1ldGFlbmNyeXB0b3I="
    },
    {
      "type": "victim",
      "value": "Flex Ltd",
      "context": "metaencryptor — US — Manufacturing",
      "group": "metaencryptor",
      "country": "US",
      "sector": "Manufacturing",
      "tags": [
        "ransomware",
        "victim",
        "metaencryptor"
      ],
      "seenAt": "2026-09-21T13:06:25.909929+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/RmxleCBMdGRAbWV0YWVuY3J5cHRvcg=="
    },
    {
      "type": "victim",
      "value": "HyVision System. Inc",
      "context": "metaencryptor — KR — Technology",
      "group": "metaencryptor",
      "country": "KR",
      "sector": "Technology",
      "tags": [
        "ransomware",
        "victim",
        "metaencryptor"
      ],
      "seenAt": "2026-09-21T13:05:38.592556+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/SHlWaXNpb24gU3lzdGVtLiBJbmNAbWV0YWVuY3J5cHRvcg=="
    },
    {
      "type": "victim",
      "value": "Visual Intelligence, Inc.",
      "context": "metaencryptor — US — Technology",
      "group": "metaencryptor",
      "country": "US",
      "sector": "Technology",
      "tags": [
        "ransomware",
        "victim",
        "metaencryptor"
      ],
      "seenAt": "2026-09-21T13:04:07.966017+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/VmlzdWFsIEludGVsbGlnZW5jZSwgSW5jLkBtZXRhZW5jcnlwdG9y"
    },
    {
      "type": "victim",
      "value": "Prestige Management",
      "context": "akira — US — Professional Services",
      "group": "akira",
      "country": "US",
      "sector": "Professional Services",
      "tags": [
        "ransomware",
        "victim",
        "akira"
      ],
      "seenAt": "2026-09-21T12:24:42.712887+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/UHJlc3RpZ2UgTWFuYWdlbWVudEBha2lyYQ=="
    },
    {
      "type": "victim",
      "value": "Grupolider",
      "context": "thegentlemen — AO — Other",
      "group": "thegentlemen",
      "country": "AO",
      "sector": "Other",
      "tags": [
        "ransomware",
        "victim",
        "thegentlemen"
      ],
      "seenAt": "2026-09-21T11:42:16.073177+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/R3J1cG9saWRlckB0aGVnZW50bGVtZW4="
    },
    {
      "type": "victim",
      "value": "The Money Store",
      "context": "Storm — US — Financial Services",
      "group": "Storm",
      "country": "US",
      "sector": "Financial Services",
      "tags": [
        "ransomware",
        "victim",
        "storm"
      ],
      "seenAt": "2026-09-21T11:31:54.260657+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/VGhlIE1vbmV5IFN0b3JlQFN0b3Jt"
    },
    {
      "type": "victim",
      "value": "TrueCore Behavioral Solutions",
      "context": "Storm — US — Healthcare",
      "group": "Storm",
      "country": "US",
      "sector": "Healthcare",
      "tags": [
        "ransomware",
        "victim",
        "storm"
      ],
      "seenAt": "2026-09-21T11:31:22.958248+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/VHJ1ZUNvcmUgQmVoYXZpb3JhbCBTb2x1dGlvbnNAU3Rvcm0="
    },
    {
      "type": "victim",
      "value": "Manroc Developments",
      "context": "Storm — CA — Other",
      "group": "Storm",
      "country": "CA",
      "sector": "Other",
      "tags": [
        "ransomware",
        "victim",
        "storm"
      ],
      "seenAt": "2026-09-21T11:30:51.754788+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/TWFucm9jIERldmVsb3BtZW50c0BTdG9ybQ=="
    },
    {
      "type": "victim",
      "value": "Charlottesville Police Department",
      "context": "Doommageddon — US — Government & Defense",
      "group": "Doommageddon",
      "country": "US",
      "sector": "Government & Defense",
      "tags": [
        "ransomware",
        "victim",
        "doommageddon"
      ],
      "seenAt": "2026-09-21T10:21:20.195134+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/Q2hhcmxvdHRlc3ZpbGxlIFBvbGljZSBEZXBhcnRtZW50QERvb21tYWdlZGRvbg=="
    },
    {
      "type": "victim",
      "value": "Gomomentum.com",
      "context": "EndZone — ? — Not Found",
      "group": "EndZone",
      "country": null,
      "sector": null,
      "tags": [
        "ransomware",
        "victim",
        "endzone"
      ],
      "seenAt": "2026-09-21T09:20:55.521959+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/R29tb21lbnR1bS5jb21ARW5kWm9uZQ=="
    },
    {
      "type": "victim",
      "value": "IKEGAMI TSUSHINKI COMPANY LIMITED",
      "context": "qilin — JP — Manufacturing",
      "group": "qilin",
      "country": "JP",
      "sector": "Manufacturing",
      "tags": [
        "ransomware",
        "victim",
        "qilin"
      ],
      "seenAt": "2026-09-21T08:01:50.407973+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/SUtFR0FNSSBUU1VTSElOS0kgQ09NUEFOWSBMSU1JVEVEQHFpbGlu"
    },
    {
      "type": "victim",
      "value": "siinqeebank.com",
      "context": "lockbit5 — SO — Financial Services",
      "group": "lockbit5",
      "country": "SO",
      "sector": "Financial Services",
      "tags": [
        "ransomware",
        "victim",
        "lockbit5"
      ],
      "seenAt": "2026-09-21T06:10:58.119416+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/c2lpbnFlZWJhbmsuY29tQGxvY2tiaXQ1"
    },
    {
      "type": "victim",
      "value": "newmantractor.com",
      "context": "threeam — US — Manufacturing",
      "group": "threeam",
      "country": "US",
      "sector": "Manufacturing",
      "tags": [
        "ransomware",
        "victim",
        "threeam"
      ],
      "seenAt": "2026-09-21T06:07:48.540462+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/bmV3bWFudHJhY3Rvci5jb21AdGhyZWVhbQ=="
    },
    {
      "type": "victim",
      "value": "SECOND HOUSE",
      "context": "incransom — ES — Hospitality",
      "group": "incransom",
      "country": "ES",
      "sector": "Hospitality",
      "tags": [
        "ransomware",
        "victim",
        "incransom"
      ],
      "seenAt": "2026-09-21T00:35:05.808718+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/U0VDT05EIEhPVVNFQGluY3JhbnNvbQ=="
    },
    {
      "type": "victim",
      "value": "Maryann Kriger",
      "context": "incransom — US — Not Found",
      "group": "incransom",
      "country": "US",
      "sector": null,
      "tags": [
        "ransomware",
        "victim",
        "incransom"
      ],
      "seenAt": "2026-09-21T00:34:36.706236+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/TWFyeWFubiBLcmlnZXJAaW5jcmFuc29t"
    },
    {
      "type": "victim",
      "value": "Alabama Woman's Health Care",
      "context": "emperador — US — Healthcare",
      "group": "emperador",
      "country": "US",
      "sector": "Healthcare",
      "tags": [
        "ransomware",
        "victim",
        "emperador"
      ],
      "seenAt": "2026-09-20T15:51:17.640727+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/QWxhYmFtYSBXb21hbidzIEhlYWx0aCBDYXJlQGVtcGVyYWRvcg=="
    },
    {
      "type": "victim",
      "value": "acilnet.com",
      "context": "krybit — TR — Technology",
      "group": "krybit",
      "country": "TR",
      "sector": "Technology",
      "tags": [
        "ransomware",
        "victim",
        "krybit"
      ],
      "seenAt": "2026-09-20T14:11:58.952794+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/YWNpbG5ldC5jb21Aa3J5Yml0"
    },
    {
      "type": "victim",
      "value": "Zorlu Holding",
      "context": "qilin — TR — Manufacturing",
      "group": "qilin",
      "country": "TR",
      "sector": "Manufacturing",
      "tags": [
        "ransomware",
        "victim",
        "qilin"
      ],
      "seenAt": "2026-09-20T12:15:03.477485+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/Wm9ybHUgSG9sZGluZ0BxaWxpbg=="
    },
    {
      "type": "victim",
      "value": "ShopDunk",
      "context": "qilin — TH — Retail & E-Commerce",
      "group": "qilin",
      "country": "TH",
      "sector": "Retail & E-Commerce",
      "tags": [
        "ransomware",
        "victim",
        "qilin"
      ],
      "seenAt": "2026-09-20T12:14:25.639076+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/U2hvcER1bmtAcWlsaW4="
    },
    {
      "type": "victim",
      "value": "KMLS",
      "context": "qilin — DE — Not Found",
      "group": "qilin",
      "country": "DE",
      "sector": null,
      "tags": [
        "ransomware",
        "victim",
        "qilin"
      ],
      "seenAt": "2026-09-20T12:13:43.083355+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/S01MU0BxaWxpbg=="
    },
    {
      "type": "victim",
      "value": "Touring Club Suisse",
      "context": "qilin — CH — Transportation",
      "group": "qilin",
      "country": "CH",
      "sector": "Transportation",
      "tags": [
        "ransomware",
        "victim",
        "qilin"
      ],
      "seenAt": "2026-09-20T12:13:05.737287+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/VG91cmluZyBDbHViIFN1aXNzZUBxaWxpbg=="
    },
    {
      "type": "victim",
      "value": "Studio Notarile Associato Salvatore Costantino E Anna Favarato",
      "context": "emperador — IT — Professional Services",
      "group": "emperador",
      "country": "IT",
      "sector": "Professional Services",
      "tags": [
        "ransomware",
        "victim",
        "emperador"
      ],
      "seenAt": "2026-09-20T09:35:30.781513+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/U3R1ZGlvIE5vdGFyaWxlIEFzc29jaWF0byBTYWx2YXRvcmUgQ29zdGFudGlubyBFIEFubmEgRmF2YXJhdG9AZW1wZXJhZG9y"
    },
    {
      "type": "victim",
      "value": "Paylogix",
      "context": "akira — US — Financial Services",
      "group": "akira",
      "country": "US",
      "sector": "Financial Services",
      "tags": [
        "ransomware",
        "victim",
        "akira"
      ],
      "seenAt": "2026-01-15T13:48:29.435004+00:00",
      "source": "ransomware.live",
      "sourceKey": "ransomware.live",
      "link": "https://www.ransomware.live/id/UGF5bG9naXhAYWtpcmE="
    }
  ]
}