Ransomware Intelligence

Ransomware needs a way in. Stolen credentials are the cheapest one.

Check Your Exposure

spacebears Ransomware Group

Ransomware group profile

39Victims
RussiaSource country
71Impact score

Description

SpaceBears is a ransomware group that primarily focuses on high-profile cyberattacks across various industries. Known for employing sophisticated tactics, they utilize advanced encryption and double extortion methods while also operating as a data broker. Their operations have a global reach, making significant impacts on targeted organizations.

Key insights

  • Employs double extortion tactics by encrypting data and threatening to publish it online.
  • Targets a wide range of sectors, including healthcare and energy, capitalizing on vulnerabilities related to ongoing events like the COVID-19 pandemic.
  • Gains initial access through social engineering, phishing, and exploiting known software vulnerabilities.
  • Adopts zero-day vulnerabilities for breaches, indicating a shift towards more advanced hacking techniques.
  • Ransom demands are typically high, reflecting their focus on financial gain through data exfiltration.

Threat Level & Status Breakdown

For spacebears · Based on incidents in selected period

3.4threat level
Aggressiveness7/ 10
Lethality0.3/ 10
Criticality2.8/ 10

Status Breakdown

Data Leaked5.1%2
Claimed94.9%37
First seenSep 2025
Last seenAug 2026
Avg ransom
Payment rate
Statusactive
Sophistication0
Last updatedAug 26, 2026

Recent activity

Monthly attack count for spacebears in the selected period

39Total attacks
8peak in Aug
3.9avg / month
↑ 5 vs first month
SepOctNovDecFebAprMayJunJulAug02468

Intelligence

IOCs, YARA/Sigma rules, and related families for spacebears

  1. 5butbkrljkaorg5maepuca25oma7eiwo6a2rlhvkblb4v6mf3ki2ovid.onion
View full IOC feed1 total

TTPs & Attack Vectors

Tools, initial access, and MITRE ATT&CK techniques for spacebears

Other

T1486

T1486

T1490

T1490

T1078

T1078

T1041

T1041

T1562

T1562

T1021

T1021

T1059

T1059

T1021.001

T1021.001

T1105

T1105

T1033

T1033

T1110

T1110

T1583

T1583

Victims(39)

GermanyRetail & E-Commerceholzmarkt-chemnitz.de
Claimed
5 days ago
Czech RepublicTechnologyfreelom.cz
Claimed
5 days ago
MexicoRetail & E-Commercesears.com.mx
Claimed
12 days ago
MexicoRetail & E-Commercesears.com.mx
Claimed
12 days ago
ItalyOtheroliobasso.com
Claimed
16 days ago
SwitzerlandHealthcareelixi-int.com
Claimed
17 days ago
ItalyTechnologyhtdi.it
Claimed
20 days ago
BrazilTechnologypontobrsistemas.com.br
Claimed
22 days ago
United StatesTechnologystellarrad.com
Claimed
29 days ago
South KoreaTechnologydoalltech.com
Claimed
about 1 month ago
ColombiaProfessional Servicesanpra.co
Claimed
about 1 month ago
Claimed
about 1 month ago
United StatesEnergy & Utilitiessalterspropane.com
Claimed
about 2 months ago
United StatesRetail & E-Commercefitcrunch.com
Claimed
about 2 months ago
CameroonTechnologyturbosoft.cm
Claimed
about 2 months ago
BrazilProfessional Serviceschebib.com.br
Claimed
2 months ago
ItalyManufacturingbiessseworld.com
Claimed
about 2 months ago
ChinaRetail & E-Commerceecovacs.com
Claimed
2 months ago
BrazilProfessional Servicesgerencialcontabil.com.br
Claimed
2 months ago
ItalyHealthcarecattani.it
Claimed
3 months ago

Page 1 of 2