MS13-089

MS13-089 is a ransomware group first observed in May 2026 with an apparent financial motivation, though its limited documented activity makes comprehensive attribution difficult at this time. Based on available data, the group has claimed or been linked to a single known victim, with targeting focused on the United States and specifically the Healthcare and Social Services sector, a pattern consistent with threat actors who deliberately select high-pressure targets likely to pay ransoms quickly to restore critical operations. No public reporting from CISA, the FBI, Mandiant, or other established threat intelligence sources has yet documented the group's specific initial access vectors, tooling, encryption methods, or affiliation with known ransomware ecosystems, and it remains unclear whether MS13-089 operates as a Ransomware-as-a-Service platform or as an independent closed group. Given its extremely recent emergence and minimal victim footprint at the time of this writing, MS13-089 should be considered an emerging and under-documented threat, and the Healthcare sector in particular should monitor for indicators of compromise as the group's tactics, techniques, and procedures become more clearly defined through ongoing incident investigations and threat intelligence collection. Current status remains active based on first observation date, though the full scope of its operations has yet to be established in open-source reporting.