Ransomware Intelligence

radiant group Ransomware Group

Ransomware group profile

5Victims
South KoreaSource country
60Impact score
Also Known As
radiand group

Description

Radiant is a ransomware group that emerged in September 2025, known for its aggressive double extortion tactics. They particularly target sensitive data related to children and have been implicated in high-profile attacks such as the Kido International nursery chain incident.

Key insights

  • Employs a double extortion model, encrypting data and threatening to publish stolen information.
  • Initially gains access through vulnerabilities in third-party software or purchased access from brokers.
  • Targets sensitive data, including that of children, leading to public backlash and unusual public apologies.
  • Uses dark web leak sites to apply pressure and publicize stolen data.
  • Directly contacts individual victims, escalating extortion tactics through personalized demands.

Threat Level & Status Breakdown

For radiant group · Based on incidents in selected period

1.4threat level
Aggressiveness1.3/ 10
Lethality0/ 10
Criticality3.3/ 10

Status Breakdown

Claimed100.0%5
First seenOct 2025
Last seenOct 2025
Avg ransom
Payment rate
Statusactive
Sophistication0
Last updatedAug 8, 2026

Recent activity

Monthly attack count for radiant group in the selected period

5Total attacks
5peak in Oct
5avg / month
Oct02468

No intelligence data for this group.

TTPs & Attack Vectors

Tools, initial access, and MITRE ATT&CK techniques for radiant group

Other

T1486

T1486

T1490

T1490

T1021

T1021

T1562

T1562

T1080

T1080

T1078

T1078

T1547

T1547

T1059

T1059

T1021.001

T1021.001

T1046

T1046

T1105

T1105

T1040

T1040

Victims(5)

FinlandTransportationdocurail.com
Claimed
10 months ago
United StatesRetail & E-Commerce
Claimed
10 months ago
United KingdomTransportation
Claimed
10 months ago
GermanyHospitalitymagnafoodservice.co.uk
Claimed
10 months ago
United StatesHealthcare
Claimed
10 months ago

Affected countries(7)

Countries where this group has been reported to target or leak victims.