qilin
ELEVATED4
Victims disclosed (30d)
96 total Canada victims
Construction, Energy, Hospitality and Tourism
Snapshot • Jun 5, 2026
Live Intelligence
Ransomware Tracker
Fresh intelligence sourced from ransomware.live, prioritising Canadian disclosures and extortion campaigns.
Last refresh: Jun 15, 2026
Canadian Threat Pulse
🇨🇦 Live ransomware intelligence feed.
Powered by ransomware.live Pro. We prioritise Ontario, GTA, British Columbia, and Quebec victims to drive rapid outreach across our Canadian client base.
Last refresh
Jun 15, 2026
Live polling active
Ransomware IOC
17
Victims disclosed in the past 30 days
−48% MoMCloud Drift
1
Misconfiguration paths blocked this week
0% WoWIdentity Attacks
1
Credential-stuffing bursts contained
0% WoWdragonforce
ELEVATED4
Victims disclosed (30d)
20 total Canada victims
Consumer Services, Technology, Manufacturing
Snapshot • May 27, 2026
m3rx
ELEVATED2
Victims disclosed (30d)
3 total Canada victims
Business Services, Not Found
Snapshot • Jun 11, 2026
Canadian victims
17
Canadian disclosures in the past 30 days.
Global spotlight
100
Victims tracked worldwide in the rolling archive.
Active crews
25
Top 20 ransomware crews ranked by victim disclosures in this archive.
qilin: 4 logged
North America Heat Map
Canada, the United States, and Mexico weighted by confirmed disclosures across the rolling ransomware archive.
Global Extortion Surface
Victim geography & supply-chain exposure
Hover bubbles for detail
- Charisma MediaUnited States
securotrop
Published Jun 14, 2026
- GITHUB INTERNALUnited States
lapsus$
Published Jun 13, 2026
- agroexportavocados.comMexico
threeam
Published Jun 12, 2026
- mgrlaw.comUnited States
threeam
Published Jun 12, 2026
- Demand.ioUnited States
coinbasecartel
Published Jun 12, 2026
- Cambridge Mobile TelematicsUnited States
coinbasecartel
Published Jun 12, 2026
Regional Spotlight
Ontario, GTA, British Columbia, and Quebec accounts comprise the majority of Canadian disclosures today. We surface the most recent activity in each market.
GTA and Ottawa focus
Ontario
- hbexperts-conseils.cam3rxJun 11, 2026
- ktwhs.comm3rxJun 11, 2026
- Cal FreshtermiteJun 8, 2026
- Ontario Home Builders' AssociationqilinJun 5, 2026
- compactmould.comsafepayJun 1, 2026
- squamish.netBrainCipherJun 1, 2026
Toronto metro
GTA
- SymcoreverestMay 2, 2026
- mattandsteve.comsafepayMar 17, 2026
- STRATEGICOBJECTIVES.COMclopFeb 7, 2026
Lower Mainland & Island
British Columbia
- CCCM.BC.CAclopJan 25, 2026
Montréal & provincial
Quebec
- No recent disclosures
Most Active Ransomware Crews (90 days)
TAG momentum report
Most active crews observed by TAG over the last quarter with last-seen timestamps.
- TAG
01. dragonforce
32 victims logged · Last seen Jun 14, 2026
- TAG
02. shinyhunters
9 victims logged · Last seen Jun 13, 2026
- TAG
03. threeam
13 victims logged · Last seen Jun 12, 2026
- TAG
04. coinbasecartel
9 victims logged · Last seen Jun 12, 2026
- TAG
05. qilin
114 victims logged · Last seen Jun 12, 2026
- TAG
06. akira
78 victims logged · Last seen Jun 12, 2026
- TAG
07. incransom
51 victims logged · Last seen Jun 11, 2026
- TAG
08. lynx
23 victims logged · Last seen Jun 11, 2026
- TAG
09. thegentlemen
16 victims logged · Last seen Jun 10, 2026
- TAG
10. play
96 victims logged · Last seen Jun 10, 2026
- TAG
11. safepay
30 victims logged · Last seen Jun 1, 2026
- TAG
12. clop
54 victims logged · Last seen Feb 7, 2026
Global exposure
Country distribution for victims captured within the combined archive.
Global Extortion Surface
Victim geography & supply-chain exposure
Hover bubbles for detail
| Rank | Country/Region | Victims |
|---|---|---|
| 1 | Canada | 994 |
| 2 | United States | 30 |
| 3 | Germany | 7 |
| 4 | Brazil | 5 |
| 5 | India | 4 |
| 6 | United Kingdom | 3 |
| 7 | France | 3 |
| 8 | Malaysia | 3 |
| 9 | Argentina | 3 |
| 10 | Mexico | 3 |
| 11 | Japan | 3 |
| 12 | United Arab Emirates | 3 |
Intelligence headlines
Curated advisories surfaced alongside ransomware activity.
- Open source · cyber.gc.ca ↗CCCS warns of increased ransomware targeting Canadian municipalitiesJan 15, 2025
Canadian Centre for Cyber Security
The Cyber Centre observed coordinated credential-stuffing attempts preceding LockBit compromises in Ontario.
- Open source · ransomware.live ↗Healthcare sector sees spike in extortion incidentsJan 12, 2025
Ransomware.live
Ransomware.live telemetry shows healthcare victim listings rising 18% week-over-week.
Five-Year Canadian Threat Trend
Comparative look at ransomware disclosures versus phishing, smishing, vishing, and business email compromise (BEC) reports across Canada.
Next data feeds
Broaden coverage with phishing, vulnerability, and IoC sources wired into the backend.
Phishing & Malware
Canadian Centre for Cyber Security Advisories
Official bulletins covering critical vulnerabilities, phishing campaigns, and ransomware guidance tailored to Canadian operators.
/api/threats/cyber-centreDocumentation ↗Vulnerability Intelligence
CISA Known Exploited Vulnerabilities (KEV)
Authoritative catalogue of vulnerabilities actively exploited in the wild with remediation deadlines to drive patch prioritisation.
/api/threats/kevDocumentation ↗IoC Feeds
Abuse.ch ThreatFox
Community-driven repository of fresh indicators of compromise spanning malware, C2 infrastructure, and phishing kits.
/api/threats/threatfoxDocumentation ↗Phishing Intelligence
OpenPhish Commercial API
Continuously updated feed of verified phishing URLs suitable for mail and web gateway enforcement.
/api/threats/phishingDocumentation ↗Malware & Botnet Activity
Shadowserver Daily Reports
Global sensor telemetry on malware callbacks, exposed services, and botnet drones to support containment playbooks.
/api/threats/shadowserverDocumentation ↗
Live Ransomware Disclosures
Tracking leagues sourced from ransomware.live and Cybersystem telemetry.
| Threat Group | Victim | Date Published |
|---|---|---|
| AuditTeam | I-***YS | Jun 14, 2026 |
| krybit | frey.com | Jun 14, 2026 |
| nova | Bandung | Jun 14, 2026 |
| dragonforce | Ink | Jun 14, 2026 |
| securotrop | Charisma Media | Jun 14, 2026 |
| shinyhunters | coe.int | Jun 13, 2026 |
| lapsus$ | INGKA GROUP | Jun 13, 2026 |
| lapsus$ | GITHUB INTERNAL | Jun 13, 2026 |
| krybit | www.mbt-energy.com | Jun 13, 2026 |
| payload | myipo.gov.my | Jun 13, 2026 |
| threeam | jetmachprod.com | Jun 12, 2026 |
| threeam | jastrebarsko.hr | Jun 12, 2026 |
| threeam | palmero.com | Jun 12, 2026 |
| threeam | insamani.com.ar | Jun 12, 2026 |
| threeam | bsynchro.com | Jun 12, 2026 |
| threeam | molinoscabodi.com.ar | Jun 12, 2026 |
| threeam | ws.com.br | Jun 12, 2026 |
| threeam | consultic.be | Jun 12, 2026 |
| threeam | amc.org.au | Jun 12, 2026 |
| threeam | agroexportavocados.com | Jun 12, 2026 |
| threeam | hoplongtech.com | Jun 12, 2026 |
| threeam | mgrlaw.com | Jun 12, 2026 |
| coinbasecartel | Demand.io | Jun 12, 2026 |
| coinbasecartel | Cambridge Mobile Telematics | Jun 12, 2026 |
| shadowbyt3$ | Nintendo Company (Nintendo.com) | Jun 12, 2026 |
| qilin | DISTINET MURCIA SL | Jun 12, 2026 |
| gunra | MHE9 Logística Ltda | Jun 12, 2026 |
| gunra | Suárez&Clavera | Jun 12, 2026 |
| dragonforce | Corniche Hotel Abu Dhabi | Jun 12, 2026 |
| dragonforce | Cheoy Lee Shipyards | Jun 12, 2026 |
| dragonforce | Al Ishrak Contracting | Jun 12, 2026 |
| dragonforce | The DRM | Jun 12, 2026 |
| dragonforce | Al Shafar GRC | Jun 12, 2026 |
| dragonforce | A. Liberty Engineering Co. Ltd | Jun 12, 2026 |
| shinyhunters | Madison Square Garden Sports Corp. | Jun 12, 2026 |
| shinyhunters | JCPenney & several other subsdiaries under Catalyst Brands & Authentic Brands Group | Jun 12, 2026 |
| shinyhunters | American Tower Corporation | Jun 12, 2026 |
| shinyhunters | Zayo.com & Allstream.com | Jun 12, 2026 |
| krybit | aisem.gob.bo | Jun 12, 2026 |
| krybit | www.progress-security.com | Jun 12, 2026 |