ZeroHour

nightspire

ransomware group · aka nightspire (dashboard listing; no widely reported alternate names identified) · unknown · active since 2026-06-14 (earliest leak-site post tracked on this dashboard; earlier activity unknown)

Victims · 7d
4▲4 vs prev. week
Victims · 30d
10active targets
Victims · 90d
31
All-time (tracked)
384since 2025-03-12
Last post
09-12 07:42UTC
Estimated earnings
public reporting
Profile · glm-5.3-flash · updated

NightSpire is a data-extortion group tracked on this dashboard primarily through its leak-site postings. Its leak site shows sustained activity, with 39 victims listed between 2026-06-14 and 2026-09-01 (roughly 3-4 new posts per week), indicating an actively operating group rather than sporadic activity. The victim set spans transportation and logistics, manufacturing, legal services, and consumer-facing businesses, with names suggesting victims across the Americas, Asia-Pacific, and North America. No widely reported public research detailing the group's origins, aliases, tooling, or affiliate relationships was identified at profile time, so many attributes remain unknown. No public earnings estimates or widely attributed CVEs were found.

Tactics & tooling
  • Operates a dedicated leak site listing victim organizations by name (39 listings since 2026-06-14)
  • Leak-site postings imply a data-theft extortion model; whether the group also deploys encrypting ransomware is unknown
  • Consistent posting cadence of ~3-4 new victims per week indicates sustained operational tempo
  • Initial access vectors, malware tooling, and affiliate structure: unknown (no widely reported public technical research identified)
Targeted sectors
Transportation and LogisticsManufacturingLegal / Professional ServicesConsumer Goods and RetailAutomotive Services
Notable public victims

Transportes Montejo S.A.S., Easyoga, Truckworx, Victory Personal Care, Inc, Tianji Auto Care Service Company, The Mountain, Kates Nussman Ellis Earle & Landolfi LLP, Akribis Systems Pte Ltd

Estimated earnings

No public figure.

Leak-site victims

VictimDiscoveredDetails
ChangShen Hospital, Taiwan · Feb 16, 2026
Hospital José Agurto Tello de Chosica (Peru) · Feb 16, 2026
Hyatt Place New York · Feb 16, 2026
Hilong Petroleum Pipe Company, LLC · Feb 16, 2026
Aromate Industries Co., Ltd · Feb 16, 2026
The Successful Match · Feb 16, 2026
Abu Dhabi Indian School - Branch 1, Al Wathba · Feb 16, 2026
*e**a*c, F**t**i, *il**o · Feb 16, 2026
*F* *a**e* G**H & Co. *G · Feb 16, 2026
**ci**n* *us*i** LLC · Feb 16, 2026
Adirondack Networks · Feb 16, 2026
C**U*O Co., Ltd · Feb 16, 2026
Z*e***d M**ti* · Feb 16, 2026
A.T.I di Zuinisi srl · Feb 16, 2026
PERLITE, S.L.U · Feb 16, 2026
S.Y.L Pastilhas e Sapatas de Freios · Feb 16, 2026
Anc Legal Office · Feb 16, 2026
*e**l I*s***u*e f*r Clinical Research LLC · Feb 16, 2026
Abrahamsom Center · Feb 16, 2026
Master Handlers · Feb 16, 2026
RIECO Industries Limited · Feb 16, 2026
Makimura Co., Ltd. · Feb 16, 2026
UniTurn Kft. · Feb 16, 2026
HO** RIL** LLP · Feb 16, 2026
**ls*n W**k*l*w So**ti**s · Feb 16, 2026
*it**a*e *ut**ot**e Ltd · Feb 16, 2026
*m**i**n ***i*g & *o**e* Co · Feb 16, 2026
BrandingBusiness · Jan 29, 2026
CMA Flooring & Design · Jan 28, 2026
DataBank · Jan 28, 2026
Abu Dhabi Indian School – Branch 1, Al Wathba · Jan 27, 2026
OEC Medical Systems, Inc · Jan 27, 2026
Prince & Schmidt LLP · Jan 26, 2026
BIDAIAK BANOA S.L. · Jan 25, 2026
Aromate Industries Co., Ltd. z · Jan 25, 2026
Lesk Engineers Limited · Jan 25, 2026
Golden Growth Biotechnology · Jan 25, 2026
The Successful Match (MD2B) · Jan 25, 2026
KICKSTAGE · Jan 25, 2026
Gianni Botsford Architects · Jan 24, 2026
Hilong Petroleum Pipe Company LLC · Jan 24, 2026
Supriya Aesthetic Dermatology · Jan 23, 2026
Service Lane eAdvisor · Jan 22, 2026
Serometrix LLC · Jan 21, 2026
TriApex US Laboratories · Jan 20, 2026
Hyatt Place New York / Chelsea Hotel · Jan 14, 2026
AUTOCARES CARRETERO · Jan 14, 2026
Midkiff, Muncie & Ross, P.C · Dec 30, 2025
THT Bio-Science, France · Dec 26, 2025
International Door, Inc · Dec 24, 2025

In the newsAll →

No articles mention this group yet.

Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .