Reported by 6 outlets
Ransomware victims: SEVEN SEAS GROUP, Forma Therapeutics, Paessolucoes
Why this score
- Breadth
- 2.00 / 2.0 · 6 sources
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 1.00 / 5.0 · CVSS + content signals
- Velocity
- 0.50 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.70 temporal multiplier
- Community
- + 0.40 / 1.5 · reddit signal
- Score
- 3.5 / 10 = base × recency + community
Desk analysis
Three new ransomware victims were claimed in the latest disclosure: SEVEN SEAS GROUP hit by spirals, Forma Therapeutics Holdings by nightspire, and Paessolucoes by panzer v. The claims appear in ransomware monitoring feeds without additional technical details on initial access, encryption timelines, or data exfiltration volumes. The groups span different sectors and ransomware families, suggesting continued broad targeting rather than a coordinated campaign. Without confirmed IOCs or breach reports from the victims, the significance is primarily tracking for downstream threat intelligence and potential supply chain exposure. Organizations in logistics, pharmaceuticals, and IT services should treat these as signals to review their own ransomware readiness.
Timeline
-
original reporting
🩸 New ransomware victims claimed — 3 • SEVEN SEAS GROUP — spirals • Forma Therapeutics Holdings, Inc. — nightspire • Paessolucoes — panzer v
ransomware.ninja · 11d ago · October 3rd, 2026
🩸 New ransomware victims claimed — 3 • SEVEN SEAS GROUP — spirals • Forma Therapeutics Holdings, Inc. — nightspire • Paessolucoes — panzer v
via Mastodon https://ransomware.ninja/
-
update from socradar.io
Dark Web Profile: NightSpire Ransomware
socradar.io · 501d ago · May 30th, 2025
SOCRadar's dark web profile describes NightSpire as a financially motivated ransomware group that emerged in early 2025 and runs a double extortion model, encrypting victim data and threatening to publish it on the group's dark web leak site if ransoms are not paid. The profile notes wide targeting of organizations across multiple sectors.
-
update from provendata.com
NightSpire Ransomware: How It Works and How to Defend Against It
provendata.com · 230d ago · February 25th, 2026
Proven Data's NightSpire analysis documents stolen data being transferred to attacker-controlled infrastructure with WinSCP, MEGACmd, or Rclone before a Go-based encryption payload obfuscated with RC4 and XOR is deployed. The writeup also describes extended sleep intervals between encryption operations to avoid real-time detection and log manipulation on the victim's systems.
-
update from huntress.com
Decoding NightSpire: Ransomware IOCs Aren't Set in Stone
huntress.com · 189d ago · April 7th, 2026
Huntress walks through an incident linked to the NightSpire ransomware workflow and uses it to show why indicators of compromise shift under a ransomware-as-a-service structure. The post argues the affiliate model means fixed IOC lists for the NightSpire brand go stale quickly.
-
update from picussecurity.com
NightSpire Ransomware Attack Chain, Tools and Tactics
picussecurity.com · 143d ago · May 23rd, 2026
Picus Security counts at least 64 organizations across 33 countries hit by NightSpire between March and June 2025, with the United States leading the victim list ahead of Turkey, Hong Kong, Japan, Taiwan, Mexico, Spain, and Egypt. The analysis describes a Go-based encryptor paired with data theft before encryption and threats to publish stolen files on a Tor-based leak site.
-
update from www.yazoul.net
🛡 THREAT INTEL | University of San Francisco 🟢 Actor "thegentlemen" claims Undisclosed Allegedly exposed • Financial records • NDA documents
www.yazoul.net · 32d ago · September 11th, 2026
🛡 THREAT INTEL | University of San Francisco 🟢 Actor "thegentlemen" claims Undisclosed Allegedly exposed • Financial records • NDA documents
via Mastodon https://www.yazoul.net/intel/claim/2026-09-11-university-of-san-francisco-ransomware-claim-by-thegentlemen-sep-2026
-
mentioned by www.yazoul.net
🛡 THREAT INTEL | University of San Francisco 🟢 Actor "thegentlemen" claims Undisclosed Allegedly exposed • Financial records • NDA documents
www.yazoul.net · 32d ago · September 11th, 2026
-
mentioned by www.yazoul.net
🛡 THREAT INTEL | PharmaEssentia Corporation 🔴 Actor "thegentlemen" claims Undisclosed Allegedly exposed • Financial records ⚠️ Unverified cl
www.yazoul.net · 31d ago · September 12th, 2026
-
mentioned by ransomware.ninja
🩸 New ransomware victims claimed — 1 • capitalbankhaiti.biz — lockbit5 via dark-web leak sites 🔗 https:// ransomware.ninja # ransomware # cy
ransomware.ninja · 9d ago · October 5th, 2026
-
update from ransomware.ninja
🩸 New ransomware victims claimed — 20 • Global Security Concepts — qilin • dd-automation.ch — safepay • Praxis EMR — insomnia • Standpointe
ransomware.ninja · 8d ago · October 5th, 2026
🩸 New ransomware victims claimed — 20 • Global Security Concepts — qilin • dd-automation.ch — safepay • Praxis EMR — insomnia • Standpointe
via Mastodon https://ransomware.ninja/
-
update from ransomware.ninja
🩸 New ransomware victims claimed — 5 • Agri Industrial — everest • B-accountants — everest • Morcon Developments — everest • Watermark Retir
ransomware.ninja · 8d ago · October 6th, 2026
🩸 New ransomware victims claimed — 5 • Agri Industrial — everest • B-accountants — everest • Morcon Developments — everest • Watermark Retir
via Mastodon https://ransomware.ninja/
-
update from ransomware.ninja
🩸 New ransomware victims claimed — 2 • ⚠️ Philander Smith University — endzone • TheraCare — storm via dark-web leak sites 🔗 https:// ransom
ransomware.ninja · 7d ago · October 6th, 2026
🩸 New ransomware victims claimed — 2 • ⚠️ Philander Smith University — endzone • TheraCare — storm via dark-web leak sites 🔗 https:// ransom
via Mastodon https://ransomware.ninja/
-
mentioned by www.yazoul.net
🛡 THREAT INTEL | Philander Smith University 🟠 Actor "EndZone" claims 500GB Allegedly exposed • Financial records ⚠️ Unverified claim https:/
www.yazoul.net · 7d ago · October 6th, 2026
-
update from ransomware.ninja
🩸 New ransomware victims claimed — 33 • Ability Enterprise — the gentlemen • Alcoholics Anonymous — the gentlemen • Mabris — the gentlemen •
ransomware.ninja · 7d ago · October 6th, 2026
🩸 New ransomware victims claimed — 33 • Ability Enterprise — the gentlemen • Alcoholics Anonymous — the gentlemen • Mabris — the gentlemen •
via Mastodon https://ransomware.ninja/
-
update from ransomware.ninja
🩸 New ransomware victims claimed — 10 • Reed & Giordano PA — rhysida • Kookabarra Juice — vexy • Company #29 — n0n • Company #28 — n0n • Com
ransomware.ninja · 2d ago · October 11th, 2026
🩸 New ransomware victims claimed — 10 • Reed & Giordano PA — rhysida • Kookabarra Juice — vexy • Company #29 — n0n • Company #28 — n0n • Com
via Mastodon https://ransomware.ninja/
-
update from ransomware.ninja
🩸 New ransomware victims claimed — 42 • Guarufilme — vexy • Excess Baggage — ransomhouse • Iliff, Meredith, Wildberger & Brennan, P.C — qili
ransomware.ninja · 13h ago · October 13th, 2026
🩸 New ransomware victims claimed — 42 • Guarufilme — vexy • Excess Baggage — ransomhouse • Iliff, Meredith, Wildberger & Brennan, P.C — qili
via Mastodon https://ransomware.ninja/