lamashtu is a ransomware operator currently active on public leak sites. Darkfield has indexed 30 public victims claimed by this operator between April 13, 2026 and May 19, 2026. Based on the limited available information, Lamashtu is an emerging ransomware group that was first observed in April 2026, appearing to be financially motivated based on their operational patterns. The group's origin and potential affiliations remain unclear due to their recent emergence and limited public documentation by major threat intelligence organizations. Lamashtu's attack methodology and specific technical capabilities have not been extensively documented by established security researchers, though their targeting patterns suggest they employ standard ransomware deployment techniques across multiple industry verticals. The group has conducted at least 8 confirmed attacks, demonstrating a geographically diverse targeting approach with victims identified in France, Italy, the United States, Singapore, and Malaysia, while focusing primarily on business services, manufacturing, transportation and logistics, hospitality and tourism, and energy sectors. Given the group's recent first observation in April 2026 and limited public threat intelligence reporting from established sources like CISA, FBI, or major security firms, Lamashtu appears to represent a newly active threat actor whose current operational status and long-term capabilities require further monitoring and analysis.
How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.