Brasília/DF. A Polícia Federal deflagrou, nesta sexta-feira (17/10), a Operação Decrypt, com o cumprimento de dois mandados de busca e apreensão em Minas Gerais e de um mandado de…
Weekly intelligence
Trend-first
Weekly ransomware & data leak landscape
A seven-day view of claim activity, leak escalation, actor concentration, sector shifts, and supporting news context from eCrime.ch.
Window: 2025-10-11 → 2025-10-17 UTC
Choose a report date
Observed events
195
Public claims in the selected week
Data leak indicators
118
60.5% of observed events
Active actors
33
Distinct groups with observed activity
Torrent-linked events
7
Events intersecting with torrent intelligence
What changed this week?
•
Qilin generated the highest visible claim volume this week, representing 44.1% of observed events.
•
60.5% of observed events in this window showed a public data-leak indicator, which is a stronger escalation signal than a fresh listing alone.
•
Construction was the most represented sector in this window with 13 observed events.
•
5 actor(s) appeared active this week without matching activity in the prior 30-day lookback, suggesting fresh campaigns, rebrands, or resurfacing infrastructure.
•
7 observed events in this week intersected with torrent intelligence, which is useful for understanding data-distribution tactics beyond plain leak-site posts.
Coverage snapshot
As of 2025-10-17 UTC.
Leak sites observed this week
33
Leak sites online near report date
0
Threat actor profiles updated this week
0
Countries represented this week
36
Sectors represented this week
72
Top active actors
By observed claim volumeQilin
86 events · 43 leak indicators
Coinbase Cartel
17 events · 6 leak indicators
Akira
10 events · 6 leak indicators
Sinobi
9 events · 9 leak indicators
DragonForce
7 events · 7 leak indicators
PLAY
7 events · 6 leak indicators
RALord
6 events · 6 leak indicators
Rhysida
5 events · 5 leak indicators
Emerging or resurfacing actors
No matching activity in prior 30 days- Coinbase Cartel 17 events
- BQTlock 2 events
- Dire Wolf 2 events
- Kraken 1 event
- Kyber 1 event
Country mix
Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
United States98
- Qilin45 events · 28 leak indicators
- Akira10 events · 6 leak indicators
- PLAY7 events · 6 leak indicators
- Sinobi7 events · 7 leak indicators
- Coinbase Cartel6 events · 2 leak indicators
- CL0P3 events · 3 leak indicators
- INC Ransom3 events · 2 leak indicators
- DragonForce2 events · 2 leak indicators
France15
- Qilin13 events · 2 leak indicators
- Coinbase Cartel1 event · 0 leak indicators
- Devman1 event · 1 leak indicator
Canada10
- Qilin7 events · 5 leak indicators
- Coinbase Cartel2 events · 2 leak indicators
- BrotherHood1 event · 0 leak indicators
Australia6
- RADAR3 events · 0 leak indicators
- Anubis1 event · 0 leak indicators
- Lynx1 event · 1 leak indicator
- Qilin1 event · 0 leak indicators
Germany6
- Coinbase Cartel2 events · 1 leak indicator
- Qilin1 event · 0 leak indicators
- RansomHouse1 event · 1 leak indicator
- Rhysida1 event · 1 leak indicator
- Sinobi1 event · 1 leak indicator
Spain5
- Qilin4 events · 2 leak indicators
- BlackNevas1 event · 0 leak indicators
Argentina4
- DragonForce2 events · 2 leak indicators
- Qilin1 event · 1 leak indicator
- RALord1 event · 1 leak indicator
Italy3
- DragonForce1 event · 1 leak indicator
- Gentlemen1 event · 0 leak indicators
- Qilin1 event · 1 leak indicator
Sector mix
Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
Construction13
- Qilin7 events · 0 leak indicators
- Sinobi2 events · 2 leak indicators
- Akira1 event · 0 leak indicators
- INC Ransom1 event · 1 leak indicator
- PLAY1 event · 1 leak indicator
- Rhysida1 event · 1 leak indicator
Government Administration10
- Qilin6 events · 2 leak indicators
- Devman1 event · 1 leak indicator
- Obscura1 event · 1 leak indicator
- RALord1 event · 1 leak indicator
- Sarcoma1 event · 1 leak indicator
Real Estate10
- Qilin5 events · 3 leak indicators
- RADAR3 events · 0 leak indicators
- DragonForce1 event · 1 leak indicator
- RALord1 event · 1 leak indicator
Law Practice9
- Qilin3 events · 1 leak indicator
- Akira1 event · 0 leak indicators
- Coinbase Cartel1 event · 0 leak indicators
- DragonForce1 event · 1 leak indicator
- INC Ransom1 event · 0 leak indicators
- Kraken1 event · 1 leak indicator
- PEAR1 event · 1 leak indicator
Software Development7
- Qilin3 events · 2 leak indicators
- Everest1 event · 1 leak indicator
- PEAR1 event · 1 leak indicator
- PLAY1 event · 0 leak indicators
- Radiant1 event · 0 leak indicators
Transportation, Logistics, Supply Chain and Storage7
- Coinbase Cartel3 events · 0 leak indicators
- Dire Wolf1 event · 1 leak indicator
- DragonForce1 event · 1 leak indicator
- Medusa1 event · 1 leak indicator
- Qilin1 event · 0 leak indicators
Hospitals and Health Care6
- Qilin2 events · 1 leak indicator
- Sinobi2 events · 2 leak indicators
- Devman1 event · 1 leak indicator
- RALord1 event · 1 leak indicator
Retail6
- Qilin5 events · 4 leak indicators
- 3AM1 event · 1 leak indicator
Organization size bands
Share of weekly events by employee-size group across the last 12 reporting windows.
- 51-200 employees 50
- 11-50 employees 46
- 201-500 employees 19
- 501-1,000 employees 19
- 1,001-5,000 employees 15
- 2-10 employees 15
Notable actor profile updates
Active actor records only.
New ransom note observed
No ransom-note change logged in this reporting window.
New actor infrastructure / contact channel
No infrastructure/contact-channel change logged in this reporting window.
New vuln / TTP intelligence
No vuln/TTP change logged in this reporting window.
Recent signal samples
Selected weekly signals.
| Actor | Sector | Country | Leak proof | Seen |
|---|---|---|---|---|
| Sinobi | Renewables and Environment | Germany | Data leak | 2025-10-17 |
| Sinobi | Book and Periodical Publishing | United States | Data leak | 2025-10-17 |
| Gentlemen | Airlines and Aviation | Madagascar | Claim only | 2025-10-17 |
| INC Ransom | Law Practice | United States | Claim only | 2025-10-17 |
| CL0P | Automation Machinery Manufacturing | United States | Data leak | 2025-10-17 |
| CL0P | Building Materials | United States | Data leak | 2025-10-17 |
| PLAY | Hospitality | United States | Data leak | 2025-10-17 |
| Rhysida | Medical Practice | United States | Data leak | 2025-10-17 |
| PEAR | Law Practice | United States | Data leak | 2025-10-17 |
| Akira | Construction | United States | Claim only | 2025-10-17 |
| Akira | Glass, Ceramics and Concrete Manufacturing | United States | Claim only | 2025-10-17 |
| RADAR | Real Estate | Australia | Claim only | 2025-10-17 |
News and research context
Recent articles from the same time window.
In Q3 2025, the Information Technology - Information Sharing and Analysis Center (IT-ISAC) recorded a total of 1,417 ransomware attacks, with the Critical Manufacturing, Commercia…
In 80% of the cyber incidents Microsoft’s security teams investigated last year, attackers sought to steal data—a trend driven more by financial gain than intelligence gathering.…
Related actor: Akira
Seit April vergangenen Jahres führt die Bundesanwaltschaft (BA) ein Strafverfahren, wie der Bund am Donnerstag mitteilte. Die Ermittlungen werden unter Koordination des Bundesamte…
Related actor: Devman
In late September 2025, a ransomware operator known as Devman sent me a link to a new Ransomware-as-a-Service platform days before its public launch. For months, the man behind th…
Canadian Tire Corporation (CTC), the parent company of the stores listed above, notified customers on Tuesday that it had identified a data breach involving customer information i…
Microsoft Disrupted Vanilla Tempest Attack by Revoking Certificates Used to Sign Fake Teams File
2025-10-16
Related actor: Rhysida
Microsoft announced that it had revoked more than 200 digital certificates exploited by the notorious Vanilla Tempest hacking group.
This action effectively disrupted an ongoin…
15th October 2025 – (Hong Kong) The Vegetable Marketing Organisation (VMO) has revealed that a ransomware attack was detected on a segment of its computer systems on 13th October.…
Related actor: Qilin
The City of Sugar Land experienced a cyber incident on Thursday, October 9. The Sugar Land Police Department is working closely with local, state and federal law enforcement offic…
Related actor: BlackBasta
We have issued a fine of £14m to Capita for failing to ensure the security of personal data related to a breach in 2023 that saw hackers steal millions of people’s information.…
Notes
- Observed events reflect monitored leak-site and extortion activity, not independent confirmation of every intrusion.
- Data-leak indicators reflect visible public leak evidence or escalation, which is stronger than a fresh listing alone.
- Country, sector, and company-size metadata can be incomplete. Unknown values are excluded from the public mix views.
- The goal is to explain concentration, escalation, churn, and patterns — not to build a wall of named victims.
Method
- The page uses a fixed seven-day window based on the selected date.
- Only public-facing actor and event records are included.
- Counts and breakdowns are designed for trend review, not incident confirmation.