Description Summary
64 orgs Mar–Jun 2025, growing to 316 claimed by Aug 2026.
Threat Actor
RaaS, double extortion; victim-specific payloads (UUID/MachineGUID); initial access via RDP + remote admin tooling; 48h publication deadlines.
Technical Indicators
Encryption Extension
.nspire (also silently encrypts OneDrive files without changing extension)
Encryption Algorithm
Not publicly reported
Ransom Note Name
Not publicly reported
Targeted Industries
Cross-sector (retail, manufacturing, healthcare, finance, maritime, education)
First Seen
February 2025 (leak site 12 March 2025)
Last Seen
Active (316 claimed by Aug 2026)
Geographical Location
Global; US-heavy
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |