LeakBazaar

Based on available public reporting, LeakBazaar is a relatively new ransomware group that first emerged in May 2026, appearing to be financially motivated given their targeting of high-value sectors and geographic focus on developed economies. The group's country of origin and potential affiliations with other cybercriminal organizations remain unknown at this time, and there is insufficient public documentation to determine whether they operate as a Ransomware-as-a-Service model or as an independent entity. With only nine documented victims since their emergence, LeakBazaar demonstrates a targeted approach focusing primarily on manufacturing, technology, business services, transportation/logistics, and financial services sectors across the United States, India, Singapore, and the United Kingdom, though their specific initial access vectors, encryption methods, and whether they employ double or triple extortion tactics have not been publicly documented by major threat intelligence firms or law enforcement agencies. Due to the group's recent emergence and limited public reporting from established sources such as CISA, FBI, or Mandiant, there are no widely reported notable campaigns or high-profile attacks that have gained significant attention in the cybersecurity community. LeakBazaar appears to remain active as of current reporting, though the limited intelligence available makes it difficult to assess their operational tempo or expansion plans.