Ransomware Intelligence

Ransomware needs a way in. Stolen credentials are the cheapest one.

Check Your Exposure

spacebears Ransomware Group

Ransomware group profile

68Victims
RussiaSource country
69Impact score

Description

SpaceBears is a ransomware group that primarily focuses on high-profile cyberattacks across various industries. Known for employing sophisticated tactics, they utilize advanced encryption and double extortion methods while also operating as a data broker. Their operations have a global reach, making significant impacts on targeted organizations.

Key insights

  • •Employs double extortion tactics by encrypting data and threatening to publish it online.
  • •Targets a wide range of sectors, including healthcare and energy, capitalizing on vulnerabilities related to ongoing events like the COVID-19 pandemic.
  • •Gains initial access through social engineering, phishing, and exploiting known software vulnerabilities.
  • •Adopts zero-day vulnerabilities for breaches, indicating a shift towards more advanced hacking techniques.
  • •Ransom demands are typically high, reflecting their focus on financial gain through data exfiltration.

Threat Level & Status Breakdown

For spacebears · Based on incidents in selected period

2.4threat level
Aggressiveness5/ 10
Lethality0.1/ 10
Criticality2.1/ 10

Status Breakdown

Data Leaked2.9%2
Claimed97.1%66
First seenOct 2025
Last seenSep 2026
Avg ransom—
Payment rate—
Statusactive
Sophistication0
Last updatedSep 22, 2026

Recent activity

Monthly attack count for spacebears in the selected period

68Total attacks
10peak in Jun
6.2avg / month
↑ 3 vs first month
OctNovDecFebMarAprMayJunJulAugSep036912

Intelligence

IOCs, YARA/Sigma rules, and related families for spacebears

  1. 5butbkrljkaorg5maepuca25oma7eiwo6a2rlhvkblb4v6mf3ki2ovid.onion
View full IOC feed1 total

TTPs & Attack Vectors

Tools, initial access, and MITRE ATT&CK techniques for spacebears

Other

T1486

T1486

T1490

T1490

T1078

T1078

T1041

T1041

T1562

T1562

T1021

T1021

T1059

T1059

T1021.001

T1021.001

T1105

T1105

T1033

T1033

T1110

T1110

T1583

T1583

Victims(68)

Government & Defense
Claimed
8 days ago
PortugalManufacturingtomix.com.pt
Claimed
10 days ago
United StatesManufacturingdmaxinc.com
Claimed
29 days ago
United StatesRetail & E-Commercesportsendeavors.com
Claimed
29 days ago
United StatesProfessional Servicessglacpas.com
Claimed
30 days ago
ItalyHealthcareoculisticaciraci.it
Claimed
30 days ago
GermanyRetail & E-Commerceholzmarkt-chemnitz.de
Claimed
about 1 month ago
Czech RepublicTechnologyfreelom.cz
Claimed
about 1 month ago
MexicoRetail & E-Commercesears.com.mx
Claimed
about 2 months ago
MexicoRetail & E-Commercesears.com.mx
Claimed
about 2 months ago
ItalyOtheroliobasso.com
Claimed
about 2 months ago
SwitzerlandHealthcareelixi-int.com
Claimed
about 2 months ago
ItalyTechnologyhtdi.it
Claimed
about 2 months ago
BrazilTechnologypontobrsistemas.com.br
Claimed
about 2 months ago
United StatesTechnologystellarrad.com
Claimed
2 months ago
South KoreaTechnologydoalltech.com
Claimed
2 months ago
ColombiaProfessional Servicesanpra.co
Claimed
2 months ago
Claimed
2 months ago
PolandTechnologytechpolsystem.pl
Claimed
3 months ago
United KingdomOtherblenheim.co.uk
Claimed
3 months ago

Page 1 of 4