The Expel threat intel team has seen a spike in a specific type of pre-ransomware activity this week, and we’re writing this up to highlight the tactics and indicators we’ve obser…
Weekly intelligence
Trend-first
Weekly ransomware & data leak landscape
A seven-day view of claim activity, leak escalation, actor concentration, sector shifts, and supporting news context from eCrime.ch.
Window: 2025-04-19 → 2025-04-25 UTC
Choose a report date
Observed events
95
Public claims in the selected week
Data leak indicators
73
76.8% of observed events
Active actors
26
Distinct groups with observed activity
Torrent-linked events
1
Events intersecting with torrent intelligence
What changed this week?
•
Lynx generated the highest visible claim volume this week, representing 14.7% of observed events.
•
76.8% of observed events in this window showed a public data-leak indicator, which is a stronger escalation signal than a fresh listing alone.
•
Hospitals and Health Care was the most represented sector in this window with 6 observed events.
•
3 actor(s) appeared active this week without matching activity in the prior 30-day lookback, suggesting fresh campaigns, rebrands, or resurfacing infrastructure.
•
1 observed events in this week intersected with torrent intelligence, which is useful for understanding data-distribution tactics beyond plain leak-site posts.
•
1 tracked leak sites were still online as of the report date snapshot, giving useful context on current ecosystem churn and monitoring pressure.
Coverage snapshot
As of 2025-04-25 UTC.
Leak sites observed this week
26
Leak sites online near report date
1
Threat actor profiles updated this week
4
Countries represented this week
29
Sectors represented this week
53
Top active actors
By observed claim volumeLynx
14 events · 14 leak indicators
Akira
13 events · 1 leak indicator
SAFEPAY
8 events · 8 leak indicators
PLAY
7 events · 7 leak indicators
Medusa
5 events · 5 leak indicators
Qilin
5 events · 3 leak indicators
Hunters International
4 events · 4 leak indicators
RALord
4 events · 4 leak indicators
Emerging or resurfacing actors
No matching activity in prior 30 days- Silent 4 events
- Gunra 3 events
- Blackout 1 event
Country mix
Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
United States46
- Lynx10 events · 10 leak indicators
- Akira9 events · 1 leak indicator
- PLAY5 events · 5 leak indicators
- SAFEPAY4 events · 4 leak indicators
- Medusa3 events · 3 leak indicators
- Qilin3 events · 2 leak indicators
- Silent3 events · 3 leak indicators
- Blacksuit2 events · 0 leak indicators
Canada6
- PLAY2 events · 2 leak indicators
- Lynx1 event · 1 leak indicator
- Medusa1 event · 1 leak indicator
- Qilin1 event · 1 leak indicator
- Silent1 event · 1 leak indicator
Brazil5
- Akira1 event · 0 leak indicators
- Cicada33011 event · 1 leak indicator
- RALord1 event · 1 leak indicator
- Rhysida1 event · 1 leak indicator
- Sarcoma1 event · 1 leak indicator
Germany4
- SAFEPAY2 events · 2 leak indicators
- Nitrogen1 event · 1 leak indicator
- Sarcoma1 event · 1 leak indicator
Italy4
- Akira1 event · 0 leak indicators
- INC Ransom1 event · 1 leak indicator
- LockBit 3.01 event · 1 leak indicator
- Lynx1 event · 1 leak indicator
United Kingdom4
- Lynx2 events · 2 leak indicators
- Kairos1 event · 1 leak indicator
- RansomHouse1 event · 0 leak indicators
Belgium2
- Hunters International1 event · 1 leak indicator
- RansomHouse1 event · 0 leak indicators
Japan2
- Blackout1 event · 1 leak indicator
- Gunra1 event · 0 leak indicators
Sector mix
Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
Hospitals and Health Care6
- INC Ransom2 events · 2 leak indicators
- Gunra1 event · 0 leak indicators
- Hunters International1 event · 1 leak indicator
- INTERLOCK1 event · 1 leak indicator
- NightSpire1 event · 1 leak indicator
Construction5
- Akira2 events · 0 leak indicators
- Lynx1 event · 1 leak indicator
- RALord1 event · 1 leak indicator
- Rhysida1 event · 1 leak indicator
Financial Services4
- Hunters International1 event · 1 leak indicator
- Lynx1 event · 1 leak indicator
- PLAY1 event · 1 leak indicator
- Qilin1 event · 1 leak indicator
Government Administration4
- Medusa2 events · 2 leak indicators
- Blacksuit1 event · 0 leak indicators
- NightSpire1 event · 1 leak indicator
Law Practice4
- Lynx2 events · 2 leak indicators
- Akira1 event · 0 leak indicators
- Medusa1 event · 1 leak indicator
Real Estate4
- Akira2 events · 0 leak indicators
- Gunra1 event · 0 leak indicators
- Qilin1 event · 1 leak indicator
Transportation, Logistics, Supply Chain and Storage4
- Cicada33011 event · 1 leak indicator
- Lynx1 event · 1 leak indicator
- RansomHouse1 event · 0 leak indicators
- SAFEPAY1 event · 1 leak indicator
Accounting3
- Cicada33011 event · 1 leak indicator
- Lynx1 event · 1 leak indicator
- Qilin1 event · 1 leak indicator
Organization size bands
Share of weekly events by employee-size group across the last 12 reporting windows.
- 51-200 employees 31
- 11-50 employees 30
- 201-500 employees 14
- 501-1,000 employees 10
- 2-10 employees 3
- 1,001-5,000 employees 1
Notable actor profile updates
Active actor records only.
New ransom note observed
No ransom-note change logged in this reporting window.
New actor infrastructure / contact channel
No infrastructure/contact-channel change logged in this reporting window.
New vuln / TTP intelligence
No vuln/TTP change logged in this reporting window.
Recent signal samples
Selected weekly signals.
| Actor | Sector | Country | Leak proof | Seen |
|---|---|---|---|---|
| SAFEPAY | Business Consulting and Services | United States | Data leak | 2025-04-25 |
| SAFEPAY | Wholesale | United States | Data leak | 2025-04-25 |
| Nitrogen | Utilities | Germany | Data leak | 2025-04-25 |
| Akira | Insurance | Greece | Claim only | 2025-04-25 |
| Lynx | Accounting | United States | Data leak | 2025-04-25 |
| Hunters International | Motor Vehicle Manufacturing | Mexico | Data leak | 2025-04-25 |
| Lynx | Airlines and Aviation | United States | Data leak | 2025-04-25 |
| Lynx | Textile Manufacturing | United States | Data leak | 2025-04-25 |
| Hunters International | Financial Services | Pakistan | Data leak | 2025-04-25 |
| Akira | Machinery Manufacturing | Switzerland | Claim only | 2025-04-25 |
| Akira | Real Estate | United States | Claim only | 2025-04-25 |
| Nitrogen | Hospitality | Portugal | Data leak | 2025-04-25 |
News and research context
Recent articles from the same time window.
Bei einem Cyberangriff auf das IT-Netzwerk sind Daten abgeflossen. Mittlerweile seien die Daten gesichert und die Systeme teilweise wieder hochgefahren worden.
Related actor: RansomHouse
Die Brauerei bestätigte den Cyberangriff am Donnerstag gegenüber dem Fachmagazin "Lebensmittel Zeitung" (LZ) und erklärte: "Oettinger Getränke hat umgehend und mit allen erforderl…
Your Guide for an OT-Specific Incident Response IT incident response plans aren’t built for the realities of ICS/OT environments. This white paper provides a practical, engineerin…
Related actor: INC Ransom
Saint James Hospital was the target of a “sophisticated cyber-attack” but the breach was immediately contained, the private hospital said in a statement.
Following the attack,…
MTN Group would like to inform stakeholders that it has experienced a cybersecurity incident that resulted in unauthorised access to personal information of some MTN customers in…
Ransomware in Focus: Meet IMN Crew
2025-04-24
Related actor: IMN Crew
IMN crew is a newly constituted extortion group, first identified in late March 2025. Beginning as a data-extortion operation, more recently, the group has also deployed payloads…
Cybervorfall - Birklehof
2025-04-24
In der Nacht auf den 25. März 2025 ist der Birklehof Opfer eines Cyber-Angriffes geworden. Wir haben gemeinsam mit externen Dienstleistern sofort alle erforderlichen Maßnahmen erg…
In der vergangenen Nacht sind wir Opfer einer Ransomware-Attacke geworden. Es kommt daher aktuell zu technischen Einschränkungen auf der Website und in der Kommunikation mit uns.…
Nth Degree Data Breach Lawsuit Investigation
2025-04-24
A data breach at Nth Degree Investment Group, a trade show and event management company, resulted in unauthorized access to the company's network between December 12, 2024 and Dec…
Notes
- Observed events reflect monitored leak-site and extortion activity, not independent confirmation of every intrusion.
- Data-leak indicators reflect visible public leak evidence or escalation, which is stronger than a fresh listing alone.
- Country, sector, and company-size metadata can be incomplete. Unknown values are excluded from the public mix views.
- The goal is to explain concentration, escalation, churn, and patterns — not to build a wall of named victims.
Method
- The page uses a fixed seven-day window based on the selected date.
- Only public-facing actor and event records are included.
- Counts and breakdowns are designed for trend review, not incident confirmation.