Lamashtu Emerges From Zero, Safepay Accelerates Hard
The most significant development in the last 24 hours is the sudden emergence of Lamashtu, which went from zero recorded victims to 10 in a single cycle — a 1,000% spike that signals either a new group breaking cover or a rebranded actor executing a pre-staged bulk dump of compromised targets…
- Deventer Group (Overijssel)safepay · Netherlands5 minutes ago
- Municipality of Mannosafepay · Switzerland5 minutes ago
- Surface-Finishing Company (Samut Prakan)safepay · Thailand5 minutes ago
- Industrial Technical Systems Design Companysafepay5 minutes ago
- Wholesale and Retail Electrical Household Appliances Companysafepay5 minutes ago
- Construction and Infrastructure Company (Rhineland-Palatinate/Saarland)safepay · Germany5 minutes ago
- Unknown County/Medical EntityRhysida · US12 minutes ago
- Main Placenetrunner18 minutes ago
- Italy (Government/Organizations)IAMNOTAVILLAIN · Italy36 minutes ago
- Unknown Staffing Providergenesis40 minutes ago
Latest disclosures
View all victims →Deventer Group (Overijssel)
5 minutes agoSafepay
Business Services · NetherlandsClaimedMunicipality of Manno
5 minutes agoSafepay
Government/Public Administration · SwitzerlandClaimedSurface-Finishing Company (Samut Prakan)
5 minutes agoSafepay
Manufacturing · ThailandClaimedIndustrial Technical Systems Design Company
5 minutes agoSafepayEngineering/IndustrialClaimedWholesale and Retail Electrical Household Appliances Company
5 minutes agoSafepayWholesale/RetailClaimedConstruction and Infrastructure Company (Rhineland-Palatinate/Saarland)
5 minutes agoSafepay
Construction · GermanyClaimedUnknown County/Medical Entity
12 minutes agoRhysida
Government / Healthcare · United StatesClaimedMain Place
18 minutes agoNetrunnerReal EstateClaimedItaly (Government/Organizations)
36 minutes agoIAMNOTAVILLAIN
Government · ItalyClaimed
Build on the free Darkfield feed
Pull the latest ransomware disclosures into your own tools and research — an open JSON feed and free API, no signup.
Live snapshot
Darkfield currently tracks 495 ransomware operators (116 with a disclosure in the last 60 days) and has indexed 46,685 public victim disclosures from their leak sites. Browse the full ransomware groups catalog, the live victims feed, or drill into sector and country breakdowns.
Most active ransomware operators
Recent public victim disclosures
- Deventer Group (Overijssel)safepay · Netherlands
- Municipality of Mannosafepay · Switzerland
- Surface-Finishing Company (Samut Prakan)safepay · Thailand
- Industrial Technical Systems Design Companysafepay
- Wholesale and Retail Electrical Household Appliances Companysafepay
- Construction and Infrastructure Company (Rhineland-Palatinate/Saarland)safepay · Germany
- Unknown County/Medical EntityRhysida · US
- Main Placenetrunner
- Italy (Government/Organizations)IAMNOTAVILLAIN · Italy
- Unknown Staffing Providergenesis
- Unknown CPA Firm 3genesis
- Unknown Restaurant Companygenesis
Most-targeted sectors
These 8 cover 25,010 of 46,685 disclosures. A further 5,956 carry no usable sector label.
- Manufacturing5,251
- Business Services4,662
- Technology4,644
- Healthcare3,523
- Financial Services1,710
- Construction1,536
- Education1,506
- Transportation/Logistics1,181
Most-affected countries
These 8 cover 26,444 of 46,685 disclosures.
- United States18,192
- United Kingdom1,637
- Canada1,372
- Germany1,325
- Italy952
- France951
- India693
- Brazil665
What we monitor
six catalogs, all browsableRansomware operators
tracked groups, mirrors crawled daily
Public disclosures
victims indexed across leak sites
Industries
distinct sectors with observed activity
Countries hit
geographies with disclosed victims
Blocklists
wallets · phishing · breaches
Active exploitation
CVE signals + triangulated clusters
Featured this week
Most active group
LockBit
Open dossier →
Biggest recent leak
Unknown County/Medical Entity
Open dossier →
CVE trending in chatter