ZeroHour

nightspire

ransomware group · aka nightspire (dashboard listing; no widely reported alternate names identified) · unknown · active since 2026-06-14 (earliest leak-site post tracked on this dashboard; earlier activity unknown)

Victims · 7d
4▲4 vs prev. week
Victims · 30d
10active targets
Victims · 90d
33
All-time (tracked)
384since 2025-03-12
Last post
09-12 07:42UTC
Estimated earnings
public reporting
Profile · glm-5.3-flash · updated

NightSpire is a data-extortion group tracked on this dashboard primarily through its leak-site postings. Its leak site shows sustained activity, with 39 victims listed between 2026-06-14 and 2026-09-01 (roughly 3-4 new posts per week), indicating an actively operating group rather than sporadic activity. The victim set spans transportation and logistics, manufacturing, legal services, and consumer-facing businesses, with names suggesting victims across the Americas, Asia-Pacific, and North America. No widely reported public research detailing the group's origins, aliases, tooling, or affiliate relationships was identified at profile time, so many attributes remain unknown. No public earnings estimates or widely attributed CVEs were found.

Tactics & tooling
  • Operates a dedicated leak site listing victim organizations by name (39 listings since 2026-06-14)
  • Leak-site postings imply a data-theft extortion model; whether the group also deploys encrypting ransomware is unknown
  • Consistent posting cadence of ~3-4 new victims per week indicates sustained operational tempo
  • Initial access vectors, malware tooling, and affiliate structure: unknown (no widely reported public technical research identified)
Targeted sectors
Transportation and LogisticsManufacturingLegal / Professional ServicesConsumer Goods and RetailAutomotive Services
Notable public victims

Transportes Montejo S.A.S., Easyoga, Truckworx, Victory Personal Care, Inc, Tianji Auto Care Service Company, The Mountain, Kates Nussman Ellis Earle & Landolfi LLP, Akribis Systems Pte Ltd

Estimated earnings

No public figure.

Leak-site victims

VictimDiscoveredDetails
Stalwart Development Group LLC · Mar 7, 2026
CPG Documentation · Mar 7, 2026
MAGNETA LOGISTICS, UAB · Mar 7, 2026
11th Street Veterinary Hospital · Mar 7, 2026
thallos AG · Mar 7, 2026
B** *r*t**r* *i* **s***s of ***te** *i**o**i · Mar 6, 2026
**a****t ***el*****t Gr*up L** · Mar 5, 2026
KLEIN IBERICA SA · Mar 5, 2026
N*X*** ** I**r****c**** · Mar 5, 2026
AKOL LAW · Mar 4, 2026
K**I* I***I*A *A · Mar 4, 2026
Union Laitiere de la Meuse · Mar 3, 2026
IOTA HOTEL TBILISI · Mar 3, 2026
SIMETRI Inc · Mar 2, 2026
Bain Oil Company · Mar 2, 2026
SIMETRI LLC · Mar 2, 2026
Hicare.net Inc · Feb 28, 2026
PriceTable · Feb 28, 2026
hicare · Feb 28, 2026
GoHighLevel · Feb 28, 2026
Whipflip · Feb 28, 2026
US.MAD DOG CONSTRUCTION · Feb 27, 2026
**d* **r *e*s · Feb 26, 2026
*i***q** **r**n*s * H**o* · Feb 26, 2026
OFFICINE FRATELLI AMADORI snc · Feb 25, 2026
Vera, spool. s.r.o. · Feb 25, 2026
Regal Building Materials Ltd. · Feb 24, 2026
AKOLLAW · Feb 24, 2026
SATURNO transporti · Feb 23, 2026
Kelington Engineering Singapore Pte Ltd · Feb 23, 2026
Pearl Institute for Clinical Research LLC · Feb 20, 2026
Makimura Co., Ltd · Feb 20, 2026
TCPN Inc · Feb 19, 2026
Fico Ferragens Indústria e Comércio Ltda · Feb 19, 2026
RS Development LLC · Feb 19, 2026
Ausgewählt Vertriebs GmbH · Feb 19, 2026
MD Charts · Feb 19, 2026
Holmes Riseley CPA · Feb 19, 2026
American Piping & Boiler Co · Feb 18, 2026
KFZ Sauter GmbH Co. KG · Feb 18, 2026
Wilson Workflow Solutions · Feb 17, 2026
Raja Ferry Port Public Company Limited · Feb 16, 2026
Business Ledger Limited · Feb 16, 2026
Tohpe Corporation · Feb 16, 2026
Wilson Re Limited · Feb 16, 2026
Bridgewater Retirement Community · Feb 16, 2026
Sanyo Special Steel India Pvt. Ltd · Feb 16, 2026
Hydro-Vacuum S.A · Feb 16, 2026
KHAZMODAN STUDIOS · Feb 16, 2026
Powiatowy UrzÄ…d Pracy w Å»orach(Poland) · Feb 16, 2026

In the newsAll →

No articles mention this group yet.

Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .