ZeroHour

nightspire

ransomware group · aka nightspire (dashboard listing; no widely reported alternate names identified) · unknown · active since 2026-06-14 (earliest leak-site post tracked on this dashboard; earlier activity unknown)

Victims · 7d
4▲4 vs prev. week
Victims · 30d
10active targets
Victims · 90d
33
All-time (tracked)
384since 2025-03-12
Last post
09-12 07:42UTC
Estimated earnings
public reporting
Profile · glm-5.3-flash · updated

NightSpire is a data-extortion group tracked on this dashboard primarily through its leak-site postings. Its leak site shows sustained activity, with 39 victims listed between 2026-06-14 and 2026-09-01 (roughly 3-4 new posts per week), indicating an actively operating group rather than sporadic activity. The victim set spans transportation and logistics, manufacturing, legal services, and consumer-facing businesses, with names suggesting victims across the Americas, Asia-Pacific, and North America. No widely reported public research detailing the group's origins, aliases, tooling, or affiliate relationships was identified at profile time, so many attributes remain unknown. No public earnings estimates or widely attributed CVEs were found.

Tactics & tooling
  • Operates a dedicated leak site listing victim organizations by name (39 listings since 2026-06-14)
  • Leak-site postings imply a data-theft extortion model; whether the group also deploys encrypting ransomware is unknown
  • Consistent posting cadence of ~3-4 new victims per week indicates sustained operational tempo
  • Initial access vectors, malware tooling, and affiliate structure: unknown (no widely reported public technical research identified)
Targeted sectors
Transportation and LogisticsManufacturingLegal / Professional ServicesConsumer Goods and RetailAutomotive Services
Notable public victims

Transportes Montejo S.A.S., Easyoga, Truckworx, Victory Personal Care, Inc, Tianji Auto Care Service Company, The Mountain, Kates Nussman Ellis Earle & Landolfi LLP, Akribis Systems Pte Ltd

Estimated earnings

No public figure.

Leak-site victims

VictimDiscoveredDetails
Krum Public Library · Jun 5, 2026
basatamfi · May 26, 2026
Bresme Madrid S.L. · May 24, 2026
Papa John's Egypt · May 24, 2026
Red-Line · May 24, 2026
Qua****Pro · May 24, 2026
la familia adualt day center · May 24, 2026
Pat**** S.r.l · May 24, 2026
Si**** West J******* · May 24, 2026
Rawaj Consumer Finance · May 24, 2026
Ueno Fine Chemicals Industry · May 24, 2026
Huse Incorporated · May 18, 2026
TAKOSAN OTOMOBIL · May 18, 2026
Vantage Energy LLC · May 18, 2026
C***r*o T**uc**n* · May 18, 2026
m***o*ul · May 18, 2026
A**** F***** Plas**** · May 2, 2026
Filter to A**** F***** Plas**** · May 1, 2026
The Country Club of Darien · May 1, 2026
Progressive Oral Surgery & Implantology · Apr 30, 2026
P**g**s***e O*al S**g**y & I**la**ol**y · Apr 27, 2026
J**es **l*o · Apr 27, 2026
Swansea Ambulance Corps · Apr 25, 2026
The **u***y C*** o* **r**n · Apr 25, 2026
S***s*a A**ul***e C***s · Apr 18, 2026
D-Troy Logistics · Apr 15, 2026
BK Tomorrow · Apr 14, 2026
Sahara Air Products · Apr 11, 2026
*W* **L LLC · Apr 9, 2026
Sa**** A** Products · Apr 6, 2026
C***n** **tu*e *n S**ur*** P**ot**hn**u* · Apr 6, 2026
Carmelo Candy Inc · Apr 6, 2026
Cabinet d’Étude en Sécurité Pyrotechnique · Apr 6, 2026
Advanced Vehicle Assemblies · Apr 4, 2026
Southeastern Conference of Seventh-day Adventists · Apr 3, 2026
Dubosson Frères SA · Apr 3, 2026
Siena Construction · Apr 3, 2026
PARS AR-GE · Apr 3, 2026
Neptune Mechanical, Inc. · Apr 3, 2026
TTAF Defense · Apr 3, 2026
Association OCACIA · Apr 3, 2026
S***a V**a***s · Apr 3, 2026
The GMP Group ( Premier Singapore Recruitment Firm with Global Reach ) · Apr 2, 2026
A****ia**on O*A**A · Apr 1, 2026
Notre-Dame du Grandchamp · Apr 1, 2026
Ghazi Brothers · Apr 1, 2026
The GMP Group · Apr 1, 2026
S**n* *o**tr***io* · Apr 1, 2026
P**S****E · Apr 1, 2026
*ep***e M***a*i***, Inc. · Apr 1, 2026

In the newsAll →

No articles mention this group yet.

Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .