nightspire ransomware group

NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, India, Taiwan, and Japan, using aggressive double-extortion with ransom deadlines as short as two days.

Claims in 7 days: 3
Claims in 30 days: 6
Reported techniques: 31

Listings on leak sites are claims by criminals. They are unverified and can be false. coldbraid shows counts here, not names.

Where it claims victims

Country	Claims in 60 days
Italy	1
United Kingdom	1
Spain	1
Argentina	1
United States	1

Sectors

Sector	Claims in 60 days
Other	2
Professional Services	1
Healthcare	1
Energy & Utilities	1
Technology	1

Reported techniques

Valid Accounts Brute Force Exploit Public-Facing Application Phishing Command and Scripting Interpreter Software Deployment Tools Scheduled Task/Job Create Account Boot or Logon Autostart Execution Exploitation for Privilege Escalation Obfuscated Files or Information Masquerading Indicator Removal System Binary Proxy Execution OS Credential Dumping Unsecured Credentials Network Service Discovery Process Discovery System Information Discovery File and Directory Discovery Remote Services Windows Management Instrumentation Automated Collection Archive Collected Data Exfiltration Over C2 Channel Exfiltration Over Alternative Protocol Exfiltration Over Web Service Application Layer Protocol Encrypted Channel Data Encrypted for Impact Develop Capabilities

Ransomware tracker