CyberSystem logo

Live Intelligence

Ransomware Tracker

Fresh intelligence sourced from ransomware.live, prioritising Canadian disclosures and extortion campaigns.

Last refresh: Oct 28, 2026

Canadian Threat Pulse

🇨🇦 Live ransomware intelligence feed.

Powered by ransomware.live Pro. We prioritise Ontario, GTA, British Columbia, and Quebec victims to drive rapid outreach across our Canadian client base.

Last refresh

Oct 28, 2026

Live polling active

Ransomware IOC

26

Victims disclosed in the past 30 days

+4% MoM

Cloud Drift

0

Misconfiguration paths blocked this week

0% WoW

Identity Attacks

0

Credential-stuffing bursts contained

0% WoW

thegentlemen

ELEVATED

7

Victims disclosed (30d)

27 total Canada victims

Manufacturing, Professional Services, Education

Snapshot • Oct 14, 2026

Booba Project

ELEVATED

3

Victims disclosed (30d)

3 total Canada victims

Education, Healthcare

Snapshot • Oct 27, 2026

N0n

ELEVATED

3

Victims disclosed (30d)

3 total Canada victims

Financial Services, Not Found

Snapshot • Oct 11, 2026

Canadian victims

26

Canadian disclosures in the past 30 days.

Global spotlight

100

Victims tracked worldwide in the rolling archive.

Active crews

25

Top 20 ransomware crews ranked by victim disclosures in this archive.

thegentlemen: 7 logged

North America Heat Map

Canada, the United States, and Mexico weighted by confirmed disclosures across the rolling ransomware archive.

Live telemetry

Global Extortion Surface

Victim geography & supply-chain exposure

Hover bubbles for detail
1127362
Darker fills = higher relative volume; red bubbles mark live disclosures

Drag to pan • Scroll to pan • Double-click to reset

  • RyderUnited States

    Whitearmor

    Published Oct 27, 2026

  • Coast 2 CoastUnited States

    play

    Published Oct 27, 2026

  • VPC BuildersUnited States

    play

    Published Oct 27, 2026

  • HygienaUnited States

    play

    Published Oct 27, 2026

  • Money Concepts CapitalUnited States

    play

    Published Oct 27, 2026

  • QLCUnited States

    play

    Published Oct 27, 2026

Regional Spotlight

Ontario, GTA, British Columbia, and Quebec accounts comprise the majority of Canadian disclosures today. We surface the most recent activity in each market.

High-priority outreach

GTA and Ottawa focus

Ontario

89
  • RCOA- Regent Christian Online Academy
    Booba Project
    Oct 27, 2026
  • Regent Christian Online Academy
    Booba Project
    Oct 27, 2026
  • OpenText
    Mimori
    Oct 20, 2026
  • ServiceMaster of Ottawa
    thegentlemen
    Oct 14, 2026
  • CAS Paper Mill
    thegentlemen
    Oct 14, 2026
  • Shediac Lobster Shop
    akira
    Oct 14, 2026

Toronto metro

GTA

3
  • Flexmaster
    Storm
    Sep 7, 2026
  • Canadian Mental Health Association
    Storm
    Aug 11, 2026
  • European Design
    thegentlemen
    Jul 23, 2026

Lower Mainland & Island

British Columbia

1
  • Island
    qilin
    Sep 27, 2026

Montréal & provincial

Quebec

0
  • No recent disclosures

Most Active Ransomware Crews (90 days)

TAG momentum report

Most active crews observed by TAG over the last quarter with last-seen timestamps.

  • 01. rhysida

    23 victims logged · Last seen Oct 28, 2026

    TAG
  • 02. N0n

    11 victims logged · Last seen Oct 28, 2026

    TAG
  • 03. Whitearmor

    11 victims logged · Last seen Oct 28, 2026

    TAG
  • 04. akira

    86 victims logged · Last seen Oct 28, 2026

    TAG
  • 05. play

    105 victims logged · Last seen Oct 27, 2026

    TAG
  • 06. Booba Project

    13 victims logged · Last seen Oct 27, 2026

    TAG
  • 07. everest

    15 victims logged · Last seen Oct 27, 2026

    TAG
  • 08. qilin

    137 victims logged · Last seen Oct 27, 2026

    TAG
  • 09. dragonforce

    23 victims logged · Last seen Oct 26, 2026

    TAG
  • 10. incransom

    52 victims logged · Last seen Oct 21, 2026

    TAG
  • 11. thegentlemen

    27 victims logged · Last seen Oct 14, 2026

    TAG
  • 12. safepay

    32 victims logged · Last seen Sep 8, 2026

    TAG

Global exposure

Country distribution for victims captured within the combined archive.

Global Extortion Surface

Victim geography & supply-chain exposure

Hover bubbles for detail
1127361211118122132413
Darker fills = higher relative volume; red bubbles mark live disclosures

Drag to pan • Scroll to pan • Double-click to reset

RankCountry/RegionVictims
1Canada1,127
2United States36
3Germany8
4United Kingdom4
5Malaysia3
6Italy3
7Denmark2
8Belgium2
9Mexico2
10Spain2
11Pakistan1
12United Arab Emirates1

Five-Year Canadian Threat Trend

Comparative look at ransomware disclosures versus phishing, smishing, vishing, and business email compromise (BEC) reports across Canada.

Security Canada roll-up

Next data feeds

Broaden coverage with phishing, vulnerability, and IoC sources wired into the backend.

  • Phishing & Malware

    Canadian Centre for Cyber Security Advisories

    Official bulletins covering critical vulnerabilities, phishing campaigns, and ransomware guidance tailored to Canadian operators.

    /api/threats/cyber-centreDocumentation ↗
  • Vulnerability Intelligence

    CISA Known Exploited Vulnerabilities (KEV)

    Authoritative catalogue of vulnerabilities actively exploited in the wild with remediation deadlines to drive patch prioritisation.

    /api/threats/kevDocumentation ↗
  • IoC Feeds

    Abuse.ch ThreatFox

    Community-driven repository of fresh indicators of compromise spanning malware, C2 infrastructure, and phishing kits.

    /api/threats/threatfoxDocumentation ↗
  • Phishing Intelligence

    OpenPhish Commercial API

    Continuously updated feed of verified phishing URLs suitable for mail and web gateway enforcement.

    /api/threats/phishingDocumentation ↗
  • Malware & Botnet Activity

    Shadowserver Daily Reports

    Global sensor telemetry on malware callbacks, exposed services, and botnet drones to support containment playbooks.

    /api/threats/shadowserverDocumentation ↗

Live Ransomware Disclosures

Tracking leagues sourced from ransomware.live and Cybersystem telemetry.

Threat GroupVictimDate Published
BarracudaFemern Link ContractorsOct 28, 2026
rhysidaBroadstreet HEOROct 28, 2026
N0nCompany #112Oct 28, 2026
WhitearmorEcho.comOct 28, 2026
Whitearmorwagyu.xyz unfairnessOct 28, 2026
akiraTrulifeOct 28, 2026
akiraRoberts Consulting ServicesOct 28, 2026
auroraEWM GroupOct 28, 2026
akiraInsurance ServicesOct 28, 2026
auroraMeleghy Automotive & Cie. GmbHOct 28, 2026
WhitearmorRyderOct 27, 2026
rhysidaMachelen (Belgium)Oct 27, 2026
Whitearmorhttps://t.me/whitearmorxdOct 27, 2026
emperadorTWICE SRLOct 27, 2026
playTailormade LogisticsOct 27, 2026
playCoast 2 CoastOct 27, 2026
playVPC BuildersOct 27, 2026
playHygienaOct 27, 2026
playMoney Concepts CapitalOct 27, 2026
playMicroSearchOct 27, 2026
playQLCOct 27, 2026
Whitearmorwagyu.xyzOct 27, 2026
Booba ProjectHorizon Eye Specialists & LASIK CenterOct 27, 2026
direwolfGRUPO PETROILOct 27, 2026
Booba ProjectHudson River MuseumOct 27, 2026
Booba ProjectBASS Medical GroupOct 27, 2026
Booba ProjectKerckstede vzwOct 27, 2026
Booba ProjectRCOA- Regent Christian Online AcademyOct 27, 2026
Booba ProjectRegent Christian Online AcademyOct 27, 2026
Booba ProjectCharter Township of CommerceOct 27, 2026
Booba ProjectKING FAMILY MEDICALOct 27, 2026
Booba ProjectCity of Big SpringOct 27, 2026
Booba ProjectAesthetic Specialty CentreOct 27, 2026
WallstreetBristol City CouncilOct 27, 2026
N0nCompany #111Oct 27, 2026
everestOR TechnologyOct 27, 2026
crypto24DATEM, Inc.Oct 27, 2026
everestBurris & MacOmberOct 27, 2026
everestEnergy Storage Terminal in SingaporeOct 27, 2026
everestPoint RoboticsOct 27, 2026