Falcon is a ransomware operator currently active on public leak sites. Darkfield has indexed 2 public victims claimed by this operator between August 30, 2026. Falcon is a ransomware group first observed in August 2026 with an apparent financial motivation, though limited public documentation exists given the group's recent emergence and low victim count. Based on available data, the group has claimed or been attributed to at least two known victims, with targeting concentrated in the United States across the manufacturing and healthcare sectors. Due to the group's nascent operational history and minimal coverage by major threat intelligence sources such as CISA, the FBI, Mandiant, or comparable research organizations, detailed technical attribution regarding country of origin, RaaS infrastructure, specific initial access vectors, encryption methodologies, or extortion tactics cannot be responsibly stated at this time. The targeting of manufacturing and healthcare verticals is consistent with broader ransomware ecosystem trends, where threat actors prioritize sectors with low tolerance for operational downtime and heightened incentive to pay ransoms quickly. Falcon's current operational status remains unclear, and the group should be considered an emerging or low-visibility threat warranting continued monitoring as its activity profile develops.

Recent disclosures by Falcon

All 2 indexed disclosures. Click any row for the full per-victim dossier.

• Globus MedicalHealthcare · US · August 30, 2026
• DistributionNOW (DNOW Inc.)Manufacturing · US · August 30, 2026

See every disclosure indexed for Falcon →