nightspire · Ransomware · RaqibCTI

Knowledge/Actors/nightspireCorpus

+ Request intel workspace

ransomware

nightspire

Provisional

Ransomware

Motivation

—

Attribution confidence

Provisional — not yet assessed

Provisional profile auto-created from leak-site claims — not analyst-vetted. A group's self-claim of a victim, not a confirmed breach.

Why it mattersRansomware actor, unrated confidence.

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

No open hunts or recent alerts tracked against this actor right now.

Associated with

Targets

Ozel & Ozel Laws OfficetargetLeak-site claim · ransomware.live2026-09-02
DiamondLeasetargetLeak-site claim · ransomware.live2026-08-30
Tianji Auto Care Service CompanytargetLeak-site claim · ransomfeed2026-08-12
MKS TransformatortargetLeak-site claim · ransomware.live2026-06-20
Sheraton Miramar Resort El GounatargetLeak-site claim · ransomware.live2026-06-02
basatamfitargetLeak-site claim · ransomware.live2026-05-25
Rawaj Consumer FinancetargetLeak-site claim · ransomware.live2026-05-19
Papa John's EgypttargetLeak-site claim · ransomware.live2026-05-16
TAKOSAN OTOMOBILtargetLeak-site claim · ransomware.live2026-05-14
PARS AR-GEtargetLeak-site claim · ransomware.live2026-03-31
TTAF DefensetargetLeak-site claim · ransomware.live2026-03-30
AKOL LAWtargetLeak-site claim · ransomware.live2026-02-18

Overview Attribution¹ TTPs Indicators Reporting Coverage

History

History profile is being researched

Will appear here shortly. Tracker note: nightspire is a ransomware group auto-tracked from public leak-site victim claims. This is a provisional, lightweight profile created because the group cleared an activity threshold — it has not been analyst-vetted and makes no attribution claim.

Useful?

Related

Semantically related in the corpus — a discovery aid, not asserted attribution.

Actorpayload
Actorapt73
ActorGunra
Actor8Base
ActorDoommageddon
ActorDeadlock