Signalis
sign in--:--:--UTC
Threat actors

Pear

☆ pin
Also known as PEAR, Pure Extraction and Ransom
Reports
47
First seen
May 20, 2026
Last seen
Oct 16, 2026
Motivation
Financial

Targeting

Sectors
Healthcare ×8Manufacturing ×5Financial Services ×3Retail & E-commerce ×3Other ×3Energy & Utilities ×2Professional Services ×2Transport & Logistics ×1
Victim regions
×1
×18
United States×18
Singapore×1
Jamaica×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1041 Exfiltration Over C2 Channel ×1T1565.001 Data Destruction ×1

Indicators

domain ×46hash_sha1 ×1

Indicator values are available on Pro and via the API.

Recent reports

High

Pear ransomware gang publishes Macfarlan Capital Partners as victim

ransomware.liveHigh

Pear ransomware claims Macfarlan Capital Partners victim

ransomware.liveHigh

Pear ransomware publishes Solar Communications International as victim

ransomware.liveHigh

Pear ransomware gang publishes Caretaker Landscape and Tree Management as victim

ransomware.liveHigh

Pear ransomware gang publishes Caretaker Landscape and Tree Management as victim

ransomware.liveHigh

Pear ransomware claims Software Answers (Banyan Software subsidiary) as victim

ransomware.liveHigh

Pear ransomware publishes Kellys Home Center as victim

ransomware.liveHigh

Pear ransomware gang publishes Westside GI as victim

ransomware.liveHigh

Pear ransomware gang publishes Martin Lawrence Galleries as victim

ransomware.liveHigh

Pear ransomware gang publishes Indroj Medical Group Inc. as victim

ransomware.liveMedium

Pear ransomware group claims Foss Inc. as victim

ransomware.liveHigh

Pear ransomware gang publishes EdgeChem Jamaica Limited as victim

ransomware.liveHigh

Pear ransomware claims Kovo Healthtech Corp victim

ransomware.liveHigh

Pear ransomware gang publishes NEXT LEVEL MEDICAL, LLC as victim

ransomware.liveHigh

Pear ransomware gang publishes Island Networks as victim

ransomware.liveHigh

Pear ransomware claims Mogren, Glessner & Ahrens, P.S. as victim

ransomware.liveHigh

Pear ransomware claims Clifton Architectural Glass & Metal victim

ransomware.liveMedium

Pear ransomware claims First Commerce LLC victim

ransomware.liveHigh

Pear ransomware gang claims Medical Arts Chemists and Surgicals victim

ransomware.liveHigh

Pear ransomware gang publishes Club One Casino as new victim

ransomware.liveHigh

Pear ransomware gang publishes Practi-Cal as victim

ransomware.liveHigh

Pear ransomware gang publishes Austin Plastic Surgery Institute as victim

ransomware.liveHigh

Pear ransomware claims Sonitor Technologies victim

ransomware.liveCritical

Data breach at medical billing firm MCBS affects 1.26 million people

Bleeping ComputerHigh

Pear ransomware gang publishes Metropolitan Construction Systems as victim

ransomware.liveHigh

Pear Ransomware Claims Carient Heart & Vascular as Victim

ransomware.liveHigh

Pear ransomware gang claims breach of South Plains Rural Health Services

ransomware.liveHigh

Pear ransomware gang claims Faro Products Inc. victim

ransomware.liveHigh

Pear ransomware gang publishes Tostrud & Temp, S.C. as victim

ransomware.liveHigh

Pear ransomware gang publishes AC Beverage, Inc. as victim

ransomware.live

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans