Signalis
sign in--:--:--UTC
Threat actors

Nightspire

Reports
39
First seen
Apr 7
Last seen
Jun 25
Motivation
extortion, financial, financial extortion

Targeting

Sectors
other ×5healthcare ×4manufacturing ×3energy utilities ×2government ×2retail ecommerce ×2professional services ×1hospitality ×1
Victim regions
United States ×10Egypt ×2Italy ×1Spain ×1Japan ×1Türkiye ×1

Top ATT&CK techniques

T1133 External Remote Services ×2T1486 Data Encrypted for Impact ×2T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage ×1T1021.001 Remote Services: Remote Desktop Protocol ×1T1491 Defacement ×1T1562 Impair Defenses ×1T1110 Brute Force ×1T1219 Remote Access Software ×1T1566 Phishing ×1T1490 Inhibit System Recovery ×1T1547 Boot or Logon Autostart Execution ×1T1083 File and Directory Discovery ×1

Indicators

domain ×38hash_sha256 ×4email ×2filename ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2024-40766 (exploited)CVE-2024-47575 (exploited)CVE-2024-50383 (exploited)

Recent reports

High

Nightspire claims Grupo Riquelme ransomware victim on ransomware.live

ransomware.liveHigh

Nightspire ransomware claims Artistic Smiles as victim

ransomware.liveHigh

Nightspire ransomware gang publishes Blue Ox / Paul Bunyan / Lumberjack Electric as victim

ransomware.liveHigh

Nightspire ransomware gang claims Dean Cosmetic Dentistry breach

ransomware.liveHigh

Nightspire publishes new victim: Guy E******* & F*******, P.A

ransomware.liveMedium

Nightspire publishes Central Texas victim on ransomware.live

ransomware.liveMedium

Nightspire publishes new victim: Ri***** Co**** Europe S.r.l.

ransomware.liveHigh

Nightspire ransomware gang claims new victim

ransomware.liveHigh

Nightspire claims Sheraton Miramar Resort El Gouna as ransomware victim

ransomware.liveMedium

Nightspire publishes new victim on ransomware.live

ransomware.liveHigh

Nightspire ransomware gang claims Silsbee Police Department as victim

ransomware.liveHigh

Nightspire publishes new victim: K****** County, Minnesota

ransomware.liveMedium

Nightspire ransomware gang claims WaxWorks Inc victim on leak site

ransomware.liveHigh

Nightspire claims Blue Nile Medical Center in ransomware extortion post

ransomware.liveHigh

Nightspire ransomware gang publishes Pattono S.r.l as new victim

ransomware.liveHigh

Nightspire ransomware gang publishes Sierra West Jewelers as victim

ransomware.liveHigh

Nightspire ransomware gang publishes GRIP Outreach For Youth as victim

ransomware.liveHigh

Nightspire publishes Unique Litho, Inc as new ransomware victim

ransomware.liveMedium

Nightspire publishes new victim on ransomware.live

ransomware.liveMedium

Nightspire publishes ASIA STRATEGIC as ransomware victim

ransomware.liveHigh

Nightspire ransomware gang publishes First Mutual Holdings as victim

ransomware.liveMedium

Nightspire ransomware gang publishes Krum Public Library as victim

ransomware.liveHigh

Nightspire publishes victim: basatamfi

ransomware.liveMedium

Nightspire ransomware claims victim: Red-Line

ransomware.liveMedium

Nightspire ransomware claims new victim

ransomware.liveHigh

Nightspire publishes La Familia Adult Day Center as ransomware victim

ransomware.liveHigh

Nightspire publishes new victim Pat**** S.r.l on ransomware.live

ransomware.liveMedium

Nightspire ransomware gang publishes new victim claim

ransomware.liveHigh

Nightspire ransomware gang publishes Bresme Madrid S.L. as victim

ransomware.liveHigh

Nightspire ransomware claims Papa John's Egypt as victim

ransomware.live

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans