Nightspire

☆ pin

Also known as NightSpire

Reports

105

First seen

Apr 7, 2026

Last seen

Oct 15, 2026

Motivation

Financial

Targeting

Sectors

Manufacturing ×10 Other ×10 Healthcare ×9 Professional Services ×7 Transport & Logistics ×6 Education ×5 Hospitality ×4 Government ×3

Victim regions

×2

×27

United States×27

Italy×3

Türkiye×3

Egypt×2

Germany×2

Thailand×2

Colombia×2

Brazil×2

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1486 Data Encrypted for Impact ×2T1133 External Remote Services ×2T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage ×1T1021.001 Remote Services: Remote Desktop Protocol ×1T1562 Impair Defenses ×1T1547 Boot or Logon Autostart Execution ×1T1078 Valid Accounts ×1T1021 Remote Services ×1T1491 Defacement ×1T1110 Brute Force ×1T1219 Remote Access Software ×1T1490 Inhibit System Recovery ×1

Indicators

domain ×127hash_sha256 ×11ip_v4 ×6hash_sha1 ×3hash_md5 ×3email ×2filename ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2024-40766 (exploited)CVE-2024-47575 (exploited)CVE-2024-50383 (exploited)

Recent reports

High

Nightspire

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

Nightspire publishes Sonoma Public Schools as ransomware victim

Nightspire claims Colorado Texas as ransomware victim

Nightspire publishes Colorado Texas as ransomware victim

Nightspire publishes new victim: Software Solutions company

Nightspire publishes new victim on ransomware.live

Nightspire publishes Cognosis Limited as ransomware victim

Nightspire publishes new ransomware victim

Nightspire ransomware claims Spo****** Public Schools victim

Nightspire ransomware gang claims MGT Lojistik AŞ victim

Nightspire ransomware gang publishes KP Industries as victim

Nightspire ransomware gang claims Fondy Food Pantry victim

Nightspire publishes The Bernard Osher Foundation as ransomware victim

Nightspire publishes PMG Project Management Group as ransomware victim

Nightspire publishes Mäntelhaus Kaiser GmbH & Co. KG as ransomware victim

Nightspire ransomware gang claims breach of Chilean government IP agency INAPI

Nightspire claims new victim: Medcom Tech Information

Nightspire published victim: WAGA Enterprises Architects LLC

Nightspire ransomware claims Heidi's Events & Catering, Inc.

Nightspire claims Sangre de Cristo Arts and Conference Center

Nightspire ransomware gang claims Vietnam SuperPort as victim

Nightspire ransomware gang claims Valvorobica Industriale S.p.A

Nightspire ransomware gang publishes KC Pharmaceuticals, Inc as victim

Nightspire publishes Asociación de Escribanos del Uruguay as ransomware victim

Nightspire ransomware gang publishes Sociedad Portuaria Mardique S.A. as victim

Nightspire ransomware gang publishes Sinae Phuket Luxury Hotel as victim

Nightspire claims compromise of INI Fiocruz, Brazil healthcare research institute

Nightspire claims new victim: Lumabuilt

Nightspire ransomware group claims Royal EGT victim

Nightspire ransomware gang publishes Deese and Locklear Chiropractic Center as victim

Nightspire publishes KSL Dirtworks as ransomware victim