Skip to main content
Darkfield

Operator dossier

nightspire (also tracked as NIGHT SPIRE) is a ransomware operator currently active on public leak sites. Darkfield has indexed 315 public victims claimed by this operator between March 12, 2025 and July 14, 2026. Nightspire is a ransomware group that first emerged in March 2025 and appears to be primarily financially motivated, having targeted over 215 victims in a relatively short operational timeframe. The group's origin and affiliations remain unclear due to limited public documentation from major cybersecurity organizations, though their targeting patterns suggest a broad opportunistic approach rather than nation-state backing. Based on available victim data, Nightspire appears to employ common ransomware attack vectors targeting organizations across multiple sectors, with a particular focus on manufacturing, technology, healthcare, and construction industries, while demonstrating a geographic preference for victims in the United States, India, Taiwan, France, and Hong Kong. The group's rapid victim acquisition rate since their March 2025 emergence suggests an active and potentially effective operational capability, though specific technical details about their attack methodology, encryption techniques, or extortion tactics have not been publicly documented by major threat intelligence firms. Given the recent emergence of this group and limited public reporting from established cybersecurity organizations like CISA, FBI, or Mandiant, Nightspire remains an active threat with insufficient public documentation to fully assess their operational sophistication or organizational structure.

Most-targeted sectors

Most-affected countries

Recent disclosures by nightspire

Most recent 150 of 315 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for nightspire →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

nightspire

aka NIGHT SPIRE · 315 victims indexed · first seen 1 year ago · last activity 17 hours ago

315
Victims indexed
#28 of 364 tracked operators
1y 4m
Active period
Mar 2025 → Jul 2026
30
Countries hit
top United States · 57

At a glance

Status
active
Aliases
NIGHT SPIRE
First seen
1 year ago
Last activity
17 hours ago
Onion sites
1 known endpoint
Primary sector
Not Found · 121 hits

About

Nightspire is a ransomware group that first emerged in March 2025 and appears to be primarily financially motivated, having targeted over 215 victims in a relatively short operational timeframe. The group's origin and affiliations remain unclear due to limited public documentation from major cybersecurity organizations, though their targeting patterns suggest a broad opportunistic approach rather than nation-state backing. Based on available victim data, Nightspire appears to employ common ransomware attack vectors targeting organizations across multiple sectors, with a particular focus on manufacturing, technology, healthcare, and construction industries, while demonstrating a geographic preference for victims in the United States, India, Taiwan, France, and Hong Kong. The group's rapid victim acquisition rate since their March 2025 emergence suggests an active and potentially effective operational capability, though specific technical details about their attack methodology, encryption techniques, or extortion tactics have not been publicly documented by major threat intelligence firms. Given the recent emergence of this group and limited public reporting from established cybersecurity organizations like CISA, FBI, or Mandiant, Nightspire remains an active threat with insufficient public documentation to fully assess their operational sophistication or organizational structure.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

14 months
2025-03-01T00:00:00+00:00 · 152025-04-01T00:00:00+00:00 · 262025-05-01T00:00:00+00:00 · 162025-06-01T00:00:00+00:00 · 92025-07-01T00:00:00+00:00 · 72025-10-01T00:00:00+00:00 · 62025-11-01T00:00:00+00:00 · 152025-12-01T00:00:00+00:00 · 82026-01-01T00:00:00+00:00 · 202026-02-01T00:00:00+00:00 · 402026-03-01T00:00:00+00:00 · 632026-04-01T00:00:00+00:00 · 322026-05-01T00:00:00+00:00 · 182026-06-01T00:00:00+00:00 · 22
2025-03-01T00:00:00+00:002026-06-01T00:00:00+00:00

Top countries

🇺🇸 United States
57
🇺🇸 United States
20
🇫🇷 France
12
🇪🇸 Spain
10
🇮🇳 India
10
🇩🇪 Germany
9
🇹🇼 Taiwan
9
Hong Kong SAR China
8
United States dossier →United States dossier →France dossier →Spain dossier →

Top sectors

Manufacturing
29
Healthcare
23
Technology
18
Business Services
16
Construction
13
Financial Services
11
Transportation/Logistics
10
Consumer Services
9
Manufacturing dossier →Healthcare dossier →Technology dossier →Business Services dossier →

MITRE ATT&CK

4 techniques · 3 tactics

Tactics

Initial AccessExecutionImpact

Techniques

  • T1566Phishing
  • T1190Exploit Public-Facing Application
  • T1059Command and Scripting Interpreter
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

1 known
  • http://nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion/database

Source

Updated 17 hours ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time nightspire posts a victim.

Add nightspire to your watchlist — Pro pings you within 5 minutes of any new nightspire leak-site post, Telegram callout, or affiliate-rebrand inference.