Ransomware needs a way in. Stolen credentials are the cheapest one.
lamashtu Ransomware Group
Ransomware group profile
Description
Lamashtu is an emerging data extortion group that primarily focuses on financial gain through large-scale exposure of sensitive organizational data. They utilize a unique centralized leak platform to publish victim disclosures and employ peer-to-peer methods for wide dissemination of compromised information. Their dual-impact extortion strategy combines ransom demands with threats of continued public data availability, increasing risk for victims.
Key insights
- •Operates a centralized leak platform for data exposure rather than traditional ransomware.
- •Uses peer-to-peer torrent-based distribution for disseminating stolen data.
- •Employs a dual-impact extortion model, threatening both ransom and public exposure of data.
- •Targets a variety of sectors including health care, real estate, and manufacturing.
- •First observed in April 2026, highlighting its recent emergence as a threat group.
- •Demands ransom payments while simultaneously threatening ongoing exposure of sensitive data.
Threat Level & Status Breakdown
For lamashtu · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for lamashtu in the selected period
Intelligence
IOCs, YARA/Sigma rules, and related families for lamashtu
- lamashtux5j74mcm7lwwgn5yrvuwtrpxjoyendif3v3hrztjesfoyayd.onion
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for lamashtu
T1486
T1486
T1490
T1490
T1041
T1041
T1021
T1021
T1562
T1562
T1071.001
T1071.001
T1048
T1048
T1005
T1005
T1070.001
T1070.001
T1105
T1105
Victims(48)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Fluge Audiovisuales | Spain | Claimed | 2 days ago | |
| Bender Tribünen | Germany | Claimed | 2 days ago | |
| TRANSLOGROÑO | Spain | Claimed | 2 days ago | |
| Grupo Tauro | Mexico | Claimed | 2 days ago | |
| Dr Damiel Pugliese | Argentina | Claimed | 7 days ago | |
| Bquadro | Italy | Claimed | 7 days ago | |
| Vinco Energy Services, S.A. de C.V. | United States | Claimed | 7 days ago | |
| Becker Logistik GmbH | Germany | Claimed | 7 days ago | |
| Wilhelm Kühne | Germany | Claimed | 7 days ago | |
| FIDUCIAL | France | Claimed | 7 days ago | |
| Virtual Ideas | Australia | Claimed | 7 days ago | |
| PROJAHN | Germany | Claimed | 7 days ago | |
| Altmannshofer Sicherheits-Videotechnik OHG | Germany | Claimed | 7 days ago | |
| GERLON | Germany | Claimed | 7 days ago | |
| Great Foods, Inc. | Egypt | Claimed | 4 months ago | |
| PATAYA FOOD GROUP | Thailand | Claimed | 4 months ago | |
| Shan Poornam Metals Sdn. Bhd. | India | Claimed | 4 months ago | |
| HWG Horst Weidner GmbH | Germany | Claimed | 4 months ago | |
| ROTH‑TECHNIK AUSTRIA | Austria | Claimed | 5 months ago | |
| Malaysia Smelting Corporation Berhad | Malaysia | Claimed | 5 months ago |
Page 1 of 3
Affected countries(23)
Countries where this group has been reported to target or leak victims.