qilin
ELEVATED5
Victims disclosed (30d)
108 total Canada victims
Government & Defense, Financial Services, Agriculture and Food Production
Snapshot • Sep 4, 2026
Live Intelligence
Ransomware Tracker
Fresh intelligence sourced from ransomware.live, prioritising Canadian disclosures and extortion campaigns.
Last refresh: Sep 13, 2026
Canadian Threat Pulse
🇨🇦 Live ransomware intelligence feed.
Powered by ransomware.live Pro. We prioritise Ontario, GTA, British Columbia, and Quebec victims to drive rapid outreach across our Canadian client base.
Last refresh
Sep 13, 2026
Live polling active
Ransomware IOC
27
Victims disclosed in the past 30 days
−7% MoMCloud Drift
0
Misconfiguration paths blocked this week
0% WoWIdentity Attacks
2
Credential-stuffing bursts contained
+100% WoWStorm
ELEVATED4
Victims disclosed (30d)
7 total Canada victims
Manufacturing, Retail & E-Commerce, Energy & Utilities
Snapshot • Sep 7, 2026
krybit
ELEVATED2
Victims disclosed (30d)
3 total Canada victims
Manufacturing, Agriculture and Food Production
Snapshot • Sep 12, 2026
Canadian victims
27
Canadian disclosures in the past 30 days.
Global spotlight
100
Victims tracked worldwide in the rolling archive.
Active crews
25
Top 20 ransomware crews ranked by victim disclosures in this archive.
qilin: 5 logged
North America Heat Map
Canada, the United States, and Mexico weighted by confirmed disclosures across the rolling ransomware archive.
Global Extortion Surface
Victim geography & supply-chain exposure
Hover bubbles for detail
- watchops.comUnited States
unsafe
Published Sep 12, 2026
- www.tender.mxMexico
krybit
Published Sep 12, 2026
- www.metalware.caCanada
krybit
Published Sep 12, 2026
- Sutton Public SchoolsUnited States
global
Published Sep 12, 2026
- Frisby Roofing (Frisby Construction LLC)United States
medusalocker
Published Sep 12, 2026
- TOWN OF SUTTON | MASSACHUSETTSUnited States
global
Published Sep 12, 2026
Regional Spotlight
Ontario, GTA, British Columbia, and Quebec accounts comprise the majority of Canadian disclosures today. We surface the most recent activity in each market.
GTA and Ottawa focus
Ontario
- www.metalware.cakrybitSep 12, 2026
- Air CanadathegentlemenSep 9, 2026
- mcnishsteel.comsafepaySep 8, 2026
- FlexmasterStormSep 7, 2026
- LowerysStormSep 7, 2026
- MelitronStormSep 7, 2026
Toronto metro
GTA
- FlexmasterStormSep 7, 2026
- Canadian Mental Health AssociationStormAug 11, 2026
- European DesignthegentlemenJul 23, 2026
- SymcoreverestMay 2, 2026
Lower Mainland & Island
British Columbia
- No recent disclosures
Montréal & provincial
Quebec
- No recent disclosures
Most Active Ransomware Crews (90 days)
TAG momentum report
Most active crews observed by TAG over the last quarter with last-seen timestamps.
- TAG
01. rhysida
24 victims logged · Last seen Sep 12, 2026
- TAG
02. krybit
15 victims logged · Last seen Sep 12, 2026
- TAG
03. safepay
43 victims logged · Last seen Sep 11, 2026
- TAG
04. qilin
112 victims logged · Last seen Sep 11, 2026
- TAG
05. play
100 victims logged · Last seen Sep 10, 2026
- TAG
06. incransom
53 victims logged · Last seen Sep 10, 2026
- TAG
07. clop
57 victims logged · Last seen Sep 10, 2026
- TAG
08. dragonforce
22 victims logged · Last seen Sep 10, 2026
- TAG
09. akira
86 victims logged · Last seen Sep 10, 2026
- TAG
10. thegentlemen
21 victims logged · Last seen Sep 9, 2026
- TAG
11. interlock
9 victims logged · Last seen Jul 17, 2026
- TAG
12. lynx
22 victims logged · Last seen Feb 3, 2026
Global exposure
Country distribution for victims captured within the combined archive.
Global Extortion Surface
Victim geography & supply-chain exposure
Hover bubbles for detail
| Rank | Country/Region | Victims |
|---|---|---|
| 1 | Canada | 1,087 |
| 2 | United States | 31 |
| 3 | India | 7 |
| 4 | United Kingdom | 4 |
| 5 | France | 3 |
| 6 | Russia | 3 |
| 7 | Spain | 3 |
| 8 | Germany | 3 |
| 9 | Argentina | 3 |
| 10 | United Arab Emirates | 2 |
| 11 | Philippines | 2 |
| 12 | Brazil | 2 |
Intelligence headlines
Curated advisories surfaced alongside ransomware activity.
- Open source · cyber.gc.ca ↗CCCS warns of increased ransomware targeting Canadian municipalitiesJan 15, 2025
Canadian Centre for Cyber Security
The Cyber Centre observed coordinated credential-stuffing attempts preceding LockBit compromises in Ontario.
- Open source · ransomware.live ↗Healthcare sector sees spike in extortion incidentsJan 12, 2025
Ransomware.live
Ransomware.live telemetry shows healthcare victim listings rising 18% week-over-week.
Five-Year Canadian Threat Trend
Comparative look at ransomware disclosures versus phishing, smishing, vishing, and business email compromise (BEC) reports across Canada.
Next data feeds
Broaden coverage with phishing, vulnerability, and IoC sources wired into the backend.
Phishing & Malware
Canadian Centre for Cyber Security Advisories
Official bulletins covering critical vulnerabilities, phishing campaigns, and ransomware guidance tailored to Canadian operators.
/api/threats/cyber-centreDocumentation ↗Vulnerability Intelligence
CISA Known Exploited Vulnerabilities (KEV)
Authoritative catalogue of vulnerabilities actively exploited in the wild with remediation deadlines to drive patch prioritisation.
/api/threats/kevDocumentation ↗IoC Feeds
Abuse.ch ThreatFox
Community-driven repository of fresh indicators of compromise spanning malware, C2 infrastructure, and phishing kits.
/api/threats/threatfoxDocumentation ↗Phishing Intelligence
OpenPhish Commercial API
Continuously updated feed of verified phishing URLs suitable for mail and web gateway enforcement.
/api/threats/phishingDocumentation ↗Malware & Botnet Activity
Shadowserver Daily Reports
Global sensor telemetry on malware callbacks, exposed services, and botnet drones to support containment playbooks.
/api/threats/shadowserverDocumentation ↗
Live Ransomware Disclosures
Tracking leagues sourced from ransomware.live and Cybersystem telemetry.
| Threat Group | Victim | Date Published |
|---|---|---|
| Doommageddon | INCOR Group | Sep 13, 2026 |
| Vexy Ransomware | Strad Solutions | Sep 12, 2026 |
| rhysida | Axdia International | Sep 12, 2026 |
| unsafe | watchops.com | Sep 12, 2026 |
| krybit | www.tiflispalace.ge | Sep 12, 2026 |
| krybit | www.tender.mx | Sep 12, 2026 |
| krybit | capricornlogistics.com | Sep 12, 2026 |
| krybit | www.ibnsinatrust.com | Sep 12, 2026 |
| krybit | lasultanahotels.com | Sep 12, 2026 |
| krybit | eracm.fr | Sep 12, 2026 |
| krybit | pss.ht | Sep 12, 2026 |
| krybit | www.metalware.ca | Sep 12, 2026 |
| krybit | intherpro.com | Sep 12, 2026 |
| krybit | meridian16.hr | Sep 12, 2026 |
| krybit | www.eac-airports.com | Sep 12, 2026 |
| krybit | swadeshicipl.com | Sep 12, 2026 |
| global | Sutton Public Schools | Sep 12, 2026 |
| medusalocker | 瑞祥机电 (Ruixiang Jidian) | Sep 12, 2026 |
| medusalocker | Abourametals | Sep 12, 2026 |
| medusalocker | Frisby Roofing (Frisby Construction LLC) | Sep 12, 2026 |
| medusalocker | Praveg Caves Jawai | Sep 12, 2026 |
| global | TOWN OF SUTTON | MASSACHUSETTS | Sep 12, 2026 |
| AuditTeam | TE***PB | Sep 12, 2026 |
| securotrop | Shelco Filters | Sep 12, 2026 |
| emperador | Nexbex Solutions Private Limited | Sep 11, 2026 |
| safepay | compunnel.com | Sep 11, 2026 |
| direwolf | Port of Tanjung Pelepas | Sep 11, 2026 |
| fulcrumsec | Dustin Group | Sep 11, 2026 |
| Panzer | Konica Minolta Bulgaria | Sep 11, 2026 |
| Panzer | Agencia Estatal de Meteorología | Sep 11, 2026 |
| qilin | Imperial Healthcare Solutions | Sep 11, 2026 |
| Global Secret Group | CO-OP URBAN BANK LTD | Sep 10, 2026 |
| Vexy Ransomware | i2k2 Networks | Sep 10, 2026 |
| play | Sys-kool | Sep 10, 2026 |
| play | Grunthal Welding & Supplies | Sep 10, 2026 |
| rhysida | General Santos Doctors Hospital | Sep 10, 2026 |
| rhysida | Professional Retail Services | Sep 10, 2026 |
| chaos | mankatoclinic.com | Sep 10, 2026 |
| chaos | artiflexmfg.com | Sep 10, 2026 |
| Wallstreet | Goldston Oil Corporation | Sep 10, 2026 |