⚠️ New threat actor on the radar ⚠️
🥷🏻 audit
🗓️ added on April 07, active since March 2026
#ransomNews #cybersecurity #newthreatactor
⚠️ New threat actor on the radar ⚠️
🥷🏻 Cry0
🗓️ added on April 06
#ransomNews #potatosecurity #newthreatactor
⚠️ New threat actor on the radar ⚠️
🥷🏻 Cry0
🗓️ added on April 06
#ransomNews #cybersecurity #newthreatactor
⚠️ New threat actor on the radar ⚠️
🥷🏻 KRYBIT
🗓️ added on April 2
#ransomNews #cybersecurity #newthreatactor
⚠️ New threat actor on the radar ⚠️
🥷🏻 ALP-001
🗓️ added on March 27
#ransomNews #cybersecurity #newthreatactor
⚠️ New threat actor on the radar ⚠️
🥷🏻 ALP-001
🗓️ added on March 22
#ransomNews #potatosecurity #newthreatactor
⚠️ New threat actor on the radar ⚠️
🥷🏻 ALP-001
🗓️ added on March 22
#ransomNews #cybersecurity #newthreatactor
⚠️ New threat actor on the radar ⚠️
🥷🏻 Kyber
🗓️ added on March 18
#ransomNews #cybersecurity #newthreatactor
⚠️ New threat actor on the radar ⚠️
🥷🏻 Loki
🗓️ added on March 12
#ransomNews #cybersecurity #newthreatactor
⚠️ New threat actor on the radar ⚠️
🥷🏻 Exitium
🗓️ added on March 12
#ransomNews #cybersecurity #newthreatactor
However, some victim claims are unverified, indicating possible fabrications to inflate reputation.
#ransomNews #cybersecurity #newthreatactor
⚠️ New threat actor on the radar ⚠️
🥷🏻 XP95
🗓️ added on March 03
#ransomNews #cybersecurity #newthreatactor
⚠️ New threat actor on the radar ⚠️
🥷🏻 ShadowByt3$
🗓️ added on February 25
#ransomNews #cybersecurity #newthreatactor
⚠️ New threat actor on the radar ⚠️
🥷🏻 KittyKatKrew
🗓️ added on February 21
🥢 Overview Group is active since February, tho no listings on their DLS as of today.
#ransomNews #cybersecurity #newthreatactor
⚠️ New threat actor on the radar ⚠️
🥷🏻 Payload
🗓️ added on February 17
#ransomNews #cybersecurity #newthreatactor
♻️ Threat actor rebrand
🥷🏻 Meduza Locker, group has rebranded (previously known as Medusa Locker)
#ransomNews #cybersecurity #newthreatactor
Until additional victims, technical IOCs, or infrastructure reuse are observed, REYNOLDS remains an incident-level label, not a confirmed threat actor.
#ransomNews #cybersecurity #newthreatactor
⚠️ New threat actor on the radar ⚠️
🥷🏻 Insomnia
🗓️ added on February 09
#ransomNews #cybersecurity #newthreatactor
⚠️ New threat actor on the radar ⚠️
🥷🏻 0APT
🗓️ added on January 28
#ransomNews #cybersecurity #newthreatactor
⚠️ New threat actor on the radar ⚠️
🥷🏻 Orion Leaks
🗓️ added on January 13
🥢 Overview
So far, the group Orion Leaks has listed 13 victims on its DLS, dated October 2025.
#ransomNews #cybersecurity #newthreatactor
⚠️ New threat actor on the radar ⚠️
🥷🏻 VECT Ransomware
🗓️ added on January 06
🥢 Overview So far, the group VECT Ransomware has listed one victim on its DLS.
#ransomNews #security #infosec #newthreatactor
⚠️ New threat actor on the radar ⚠️
🥷🏻 MintEye
🗓️ added on December 13
🥢 Overview
So far, the group MintEye has listed five victims its DLS.
#ransomNews #security #infosec #newthreatactor
⚠️ New threat actor on the radar ⚠️
🥷🏻 TridentLocker
🗓️ added on November 29
🥢 Overview
So far, the group TridentLocker has listed 8 victims of ransomware on its DSL.
#ransomNews #security #infosec #newthreatactor
🥷🏻 Kazu
🗓️ added on November 10
🥢 Overview
So far, the group KAZU has listed two victims of ransomware and several for-sale databases and server accesses.
Among those listing, still unverified, there's an access to a non-specified Italian Magento portal.
#ransomNews #security #newthreatactor
Treat them as an influence-and-operations actor until corroborated by technical IOCs and victim confirmations consistent with ransomware tradecraft.
#ransomNews #security #infosec #newthreatactor
⚠️ New threat actor on the radar ⚠️
🥷🏻 Brotherhood
🗓️ added on October 13
🥢 Overview
Group is active since October; on their DLS have already listed 11 victims.
#ransomNews #security #infosec #newthreatactor
⚠️ New threat actor on the radar ⚠️
🥷🏻 KRYPTOS
🗓️ added on October 8
🥢 Overview
Kryptos Group portrays itself as a decentralized “council” of hackers with no leader or HQ. Their creed: encryption, balance, and disruption.
#ransomNews #security #infosec #newthreatactor
⚠️ (not quite) new threat actor on the radar ⚠️
🥷🏻 Scattered LAPSUS$ Hunters
👉🏻 not new on the scene, YKWIM
🗓️ added on October 03
🥢 Overview
Group behind the Salesforce heist happening since weeks now. Their TG channel resurfaced in the last days.
#ransomNews #security #infosec #newthreatactor
⚠️ New threat actor on the radar ⚠️
🥷🏻 Arachna Leak
🗓️ added on September 25
#ransomNews #security #infosec #newthreatactor
So far, no confirmed or official references from reliable sources have been identified, and its name, echoing the American “MAGA” slogan, suggests it may be more symbolic than operational at this stage.
#ransomNews #security #infosec #newthreatactor