secpo

SecPo is a ransomware group that first emerged in April 2026, operating with apparent financial motivations based on their limited documented activity. With only four known victims primarily concentrated in Canada, the group appears to target business services and manufacturing sectors, though their small operational footprint suggests they may be a nascent or highly selective threat actor. Due to the group's recent emergence and limited public documentation, details regarding their country of origin, potential affiliations, or ransomware-as-a-service model remain unclear to security researchers. Their attack methodology, encryption techniques, and specific tools have not been extensively documented by major security firms, likely due to their limited scope of operations and recent timeline of activity. No major campaigns, high-profile victims, or significant law enforcement actions have been publicly reported for this group, which aligns with their apparently small-scale operations. Given their recent emergence in 2026, SecPo's current operational status and long-term capabilities remain to be determined as security researchers continue to monitor their activities.