nightspire
ransomware group · aka nightspire (dashboard listing; no widely reported alternate names identified) · unknown · active since 2026-06-14 (earliest leak-site post tracked on this dashboard; earlier activity unknown)
Victims · 7d
4▲4 vs prev. week
Victims · 30d
9active targets
Victims · 90d
31
All-time (tracked)
384since 2025-03-12
Last post
09-12 07:42UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
NightSpire is a data-extortion group tracked on this dashboard primarily through its leak-site postings. Its leak site shows sustained activity, with 39 victims listed between 2026-06-14 and 2026-09-01 (roughly 3-4 new posts per week), indicating an actively operating group rather than sporadic activity. The victim set spans transportation and logistics, manufacturing, legal services, and consumer-facing businesses, with names suggesting victims across the Americas, Asia-Pacific, and North America. No widely reported public research detailing the group's origins, aliases, tooling, or affiliate relationships was identified at profile time, so many attributes remain unknown. No public earnings estimates or widely attributed CVEs were found.
Tactics & tooling
- Operates a dedicated leak site listing victim organizations by name (39 listings since 2026-06-14)
- Leak-site postings imply a data-theft extortion model; whether the group also deploys encrypting ransomware is unknown
- Consistent posting cadence of ~3-4 new victims per week indicates sustained operational tempo
- Initial access vectors, malware tooling, and affiliate structure: unknown (no widely reported public technical research identified)
Targeted sectors
Transportation and LogisticsManufacturingLegal / Professional ServicesConsumer Goods and RetailAutomotive Services
Notable public victims
Transportes Montejo S.A.S., Easyoga, Truckworx, Victory Personal Care, Inc, Tianji Auto Care Service Company, The Mountain, Kates Nussman Ellis Earle & Landolfi LLP, Akribis Systems Pte Ltd
Estimated earnings
No public figure.
Leak-site victims384 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Calcadawines (Portugal) | · Jun 7, 2025 | — |
| Siena Hotel (United States) | · Jun 7, 2025 | — |
| Tan Logistics in Turkey | · Jun 7, 2025 | — |
| Valentin Hotels (Spain) | · Jun 7, 2025 | — |
| Lars Myhre Ostfold AS (Norway) | · Jun 7, 2025 | — |
| Datatrykk (Norway) | · Jun 7, 2025 | — |
| Hospital José Agurto Tello de Chosica (Peru) | · Jun 7, 2025 | — |
| Pistolero (Mexico) | · Jun 7, 2025 | — |
| Ingonyama Trust Board (South Africa) | · Jun 7, 2025 | — |
| The Green Flame Gas Co. (Kuwait) | · Jun 7, 2025 | — |
| QuadMiners (South Korea) | · Jun 7, 2025 | — |
| To Taiwan Government and Chansn Hospital .2025.05.11 | · May 13, 2025 | Taiwan Government and Chansn Hospital are still lying to people that their files are secure. They're saying their files were encrypted, so we didn't take anything from them. Here's example data what we exactly have. For one person, we have information like this. (Photos, Name, Sex, Birthdate, ID Number, Medical Records....) Here we've just shown Pacs Server Medical Records. |
| Sisnet, Costa Rica | · Apr 27, 2025 | — |
| MFR CULTIVONS LES REUSSITES, France | · Apr 24, 2025 | — |
| M-POWER Information, Taiwan | · Apr 22, 2025 | — |
| promenade-village-dental, Canada | · Apr 22, 2025 | — |
| Accueil - Site Offciel de la commune d'Ardon | · Apr 21, 2025 | — |
| ChangShen Hospital (長慎醫院), Taiwan | · Apr 19, 2025 | — |
| Compliance Consulting Group (US) | · Apr 18, 2025 | — |
| Mid-America POOL RENOVATION, Inc (US) | · Apr 18, 2025 | — |
| Wilmington Personal Injury Lawyer - DPLAW(US) | · Apr 17, 2025 | — |
| REFFINDO-PT Pupk Indonesia (Indonesia) | · Apr 14, 2025 | — |
| Emotrans Chile(Chile) | · Apr 13, 2025 | — |
| Zaphira Uniformes (Argentina) | · Apr 13, 2025 | — |
| Audit Accounting Advisory Taxes (Luxemburg) | · Apr 13, 2025 | — |
| InterLOGIC Inc(US) | · Apr 10, 2025 | — |
| Nicera(Japan) | · Apr 10, 2025 | — |
| InterLOGIC Inc(United States) | · Apr 10, 2025 | — |
| Secretaria de Educacion de Veracruz, SEV(Mexico) | · Apr 10, 2025 | — |
| InterLOGIC Inc(Japan) | · Apr 10, 2025 | — |
| Tanaka Electronics Taiwan Co., LTD | · Apr 9, 2025 | — |
| Views: 33 | · Apr 9, 2025 | — |
| Views: 32 | · Apr 9, 2025 | — |
| Views: 31 | · Apr 9, 2025 | — |
| Sistel Connections(Italy) | · Apr 9, 2025 | — |
| Views: 30 | · Apr 9, 2025 | — |
| Views: 38 | · Apr 9, 2025 | — |
| Views: 37 | · Apr 8, 2025 | — |
| Views: 36 | · Apr 8, 2025 | — |
| Views: 35 | · Apr 8, 2025 | — |
| Views: 28 | · Apr 8, 2025 | — |
| Views: 24 | · Apr 8, 2025 | — |
| Views: 27 | · Apr 8, 2025 | — |
| Views: 26 | · Apr 8, 2025 | — |
| Views: 20 | · Apr 8, 2025 | — |
| Views: 25 | · Apr 8, 2025 | — |
| Views: 18 | · Apr 8, 2025 | — |
| Views: 16 | · Apr 8, 2025 | — |
| Views: 23 | · Apr 8, 2025 | — |
| Views: 21 | · Apr 7, 2025 | — |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .