Ransomware Intelligence

Ransomware needs a way in. Stolen credentials are the cheapest one.

Check Your Exposure

spacebears Ransomware Group

Ransomware group profile

72Victims
RussiaSource country
69Impact score

Description

SpaceBears is a ransomware group that primarily focuses on high-profile cyberattacks across various industries. Known for employing sophisticated tactics, they utilize advanced encryption and double extortion methods while also operating as a data broker. Their operations have a global reach, making significant impacts on targeted organizations.

Key insights

  • Employs double extortion tactics by encrypting data and threatening to publish it online.
  • Targets a wide range of sectors, including healthcare and energy, capitalizing on vulnerabilities related to ongoing events like the COVID-19 pandemic.
  • Gains initial access through social engineering, phishing, and exploiting known software vulnerabilities.
  • Adopts zero-day vulnerabilities for breaches, indicating a shift towards more advanced hacking techniques.
  • Ransom demands are typically high, reflecting their focus on financial gain through data exfiltration.

Threat Level & Status Breakdown

For spacebears · Based on incidents in selected period

2.6threat level
Aggressiveness5/ 10
Lethality0.2/ 10
Criticality2.8/ 10

Status Breakdown

Data Leaked4.2%3
Claimed95.8%69
First seenSep 2025
Last seenSep 2026
Avg ransom
Payment rate
Statusactive
Sophistication0
Last updatedSep 17, 2026

Recent activity

Monthly attack count for spacebears in the selected period

72Total attacks
10peak in Jun
6avg / month
↑ 1 vs first month
SepOctNovDecFebMarAprMayJunJulAugSep036912

Intelligence

IOCs, YARA/Sigma rules, and related families for spacebears

  1. 5butbkrljkaorg5maepuca25oma7eiwo6a2rlhvkblb4v6mf3ki2ovid.onion
View full IOC feed1 total

TTPs & Attack Vectors

Tools, initial access, and MITRE ATT&CK techniques for spacebears

Other

T1486

T1486

T1490

T1490

T1078

T1078

T1041

T1041

T1562

T1562

T1021

T1021

T1059

T1059

T1021.001

T1021.001

T1105

T1105

T1033

T1033

T1110

T1110

T1583

T1583

Victims(72)

United StatesManufacturingdmaxinc.com
Claimed
13 days ago
United StatesRetail & E-Commercesportsendeavors.com
Claimed
14 days ago
United StatesProfessional Servicessglacpas.com
Claimed
15 days ago
ItalyHealthcareoculisticaciraci.it
Claimed
15 days ago
GermanyRetail & E-Commerceholzmarkt-chemnitz.de
Claimed
27 days ago
Czech RepublicTechnologyfreelom.cz
Claimed
27 days ago
MexicoRetail & E-Commercesears.com.mx
Claimed
about 1 month ago
MexicoRetail & E-Commercesears.com.mx
Claimed
about 1 month ago
ItalyOtheroliobasso.com
Claimed
about 1 month ago
SwitzerlandHealthcareelixi-int.com
Claimed
about 1 month ago
ItalyTechnologyhtdi.it
Claimed
about 1 month ago
BrazilTechnologypontobrsistemas.com.br
Claimed
about 1 month ago
United StatesTechnologystellarrad.com
Claimed
about 2 months ago
South KoreaTechnologydoalltech.com
Claimed
about 2 months ago
ColombiaProfessional Servicesanpra.co
Claimed
about 2 months ago
Claimed
about 2 months ago
PolandTechnologytechpolsystem.pl
Claimed
2 months ago
United KingdomOtherblenheim.co.uk
Claimed
2 months ago
United StatesEnergy & Utilitiessalterspropane.com
Claimed
3 months ago
United StatesRetail & E-Commercefitcrunch.com
Claimed
2 months ago

Page 1 of 4