chaos
ELEVATED3
Victims disclosed (30d)
4 total Canada victims
Other, Agriculture and Food Production, Transportation
Snapshot • Jul 26, 2026
Live Intelligence
Ransomware Tracker
Fresh intelligence sourced from ransomware.live, prioritising Canadian disclosures and extortion campaigns.
Last refresh: Jul 30, 2026
Canadian Threat Pulse
🇨🇦 Live ransomware intelligence feed.
Powered by ransomware.live Pro. We prioritise Ontario, GTA, British Columbia, and Quebec victims to drive rapid outreach across our Canadian client base.
Last refresh
Jul 30, 2026
Live polling active
Ransomware IOC
27
Victims disclosed in the past 30 days
+35% MoMCloud Drift
0
Misconfiguration paths blocked this week
0% WoWIdentity Attacks
1
Credential-stuffing bursts contained
+100% WoWakira
ELEVATED3
Victims disclosed (30d)
81 total Canada victims
Professional Services, Technology
Snapshot • Jul 24, 2026
qilin
ELEVATED3
Victims disclosed (30d)
100 total Canada victims
Professional Services, Manufacturing
Snapshot • Jul 23, 2026
Canadian victims
27
Canadian disclosures in the past 30 days.
Global spotlight
100
Victims tracked worldwide in the rolling archive.
Active crews
25
Top 20 ransomware crews ranked by victim disclosures in this archive.
chaos: 3 logged
North America Heat Map
Canada, the United States, and Mexico weighted by confirmed disclosures across the rolling ransomware archive.
Global Extortion Surface
Victim geography & supply-chain exposure
Hover bubbles for detail
- StellarRAD SystemsUnited States
spacebears
Published Jul 29, 2026
- Bretford ManufacturingUnited States
aurora
Published Jul 29, 2026
- Buck KnivesUnited States
thegentlemen
Published Jul 28, 2026
- B-K Tool & DesignUnited States
cmdorganization
Published Jul 28, 2026
- Oklahoma Manufacturing AllianceUnited States
Booba Project
Published Jul 28, 2026
- Incredible TechnologiesUnited States
Booba Project
Published Jul 28, 2026
Regional Spotlight
Ontario, GTA, British Columbia, and Quebec accounts comprise the majority of Canadian disclosures today. We surface the most recent activity in each market.
GTA and Ottawa focus
Ontario
- SpergelGlobal Secret GroupJul 26, 2026
- Williams Accounting ProfessionalgenesisJul 26, 2026
- remco.cachaosJul 26, 2026
- Emerge2 DigitalakiraJul 24, 2026
- Corporate 360 Business SolutionsqilinJul 23, 2026
- European DesignthegentlemenJul 23, 2026
Toronto metro
GTA
- European DesignthegentlemenJul 23, 2026
- SymcoreverestMay 2, 2026
- mattandsteve.comsafepayMar 17, 2026
Lower Mainland & Island
British Columbia
- No recent disclosures
Montréal & provincial
Quebec
- No recent disclosures
Most Active Ransomware Crews (90 days)
TAG momentum report
Most active crews observed by TAG over the last quarter with last-seen timestamps.
- TAG
01. incransom
54 victims logged · Last seen Jul 29, 2026
- TAG
02. akira
83 victims logged · Last seen Jul 29, 2026
- TAG
03. qilin
106 victims logged · Last seen Jul 28, 2026
- TAG
04. thegentlemen
17 victims logged · Last seen Jul 28, 2026
- TAG
05. safepay
40 victims logged · Last seen Jul 27, 2026
- TAG
06. CRPxO
20 victims logged · Last seen Jul 27, 2026
- TAG
07. dragonforce
22 victims logged · Last seen Jul 27, 2026
- TAG
08. ExfilSquad
11 victims logged · Last seen Jul 26, 2026
- TAG
09. Global Secret Group
12 victims logged · Last seen Jul 26, 2026
- TAG
10. play
94 victims logged · Last seen May 11, 2026
- TAG
11. clop
54 victims logged · Last seen Feb 7, 2026
- TAG
12. lynx
22 victims logged · Last seen Feb 3, 2026
Global exposure
Country distribution for victims captured within the combined archive.
Global Extortion Surface
Victim geography & supply-chain exposure
Hover bubbles for detail
| Rank | Country/Region | Victims |
|---|---|---|
| 1 | Canada | 1,039 |
| 2 | United States | 50 |
| 3 | Germany | 9 |
| 4 | United Kingdom | 6 |
| 5 | United Arab Emirates | 2 |
| 6 | Spain | 2 |
| 7 | Italy | 2 |
| 8 | Mexico | 2 |
| 9 | France | 2 |
| 10 | India | 2 |
| 11 | Panama | 1 |
| 12 | Malaysia | 1 |
Intelligence headlines
Curated advisories surfaced alongside ransomware activity.
- Open source · cyber.gc.ca ↗CCCS warns of increased ransomware targeting Canadian municipalitiesJan 15, 2025
Canadian Centre for Cyber Security
The Cyber Centre observed coordinated credential-stuffing attempts preceding LockBit compromises in Ontario.
- Open source · ransomware.live ↗Healthcare sector sees spike in extortion incidentsJan 12, 2025
Ransomware.live
Ransomware.live telemetry shows healthcare victim listings rising 18% week-over-week.
Five-Year Canadian Threat Trend
Comparative look at ransomware disclosures versus phishing, smishing, vishing, and business email compromise (BEC) reports across Canada.
Next data feeds
Broaden coverage with phishing, vulnerability, and IoC sources wired into the backend.
Phishing & Malware
Canadian Centre for Cyber Security Advisories
Official bulletins covering critical vulnerabilities, phishing campaigns, and ransomware guidance tailored to Canadian operators.
/api/threats/cyber-centreDocumentation ↗Vulnerability Intelligence
CISA Known Exploited Vulnerabilities (KEV)
Authoritative catalogue of vulnerabilities actively exploited in the wild with remediation deadlines to drive patch prioritisation.
/api/threats/kevDocumentation ↗IoC Feeds
Abuse.ch ThreatFox
Community-driven repository of fresh indicators of compromise spanning malware, C2 infrastructure, and phishing kits.
/api/threats/threatfoxDocumentation ↗Phishing Intelligence
OpenPhish Commercial API
Continuously updated feed of verified phishing URLs suitable for mail and web gateway enforcement.
/api/threats/phishingDocumentation ↗Malware & Botnet Activity
Shadowserver Daily Reports
Global sensor telemetry on malware callbacks, exposed services, and botnet drones to support containment playbooks.
/api/threats/shadowserverDocumentation ↗
Live Ransomware Disclosures
Tracking leagues sourced from ransomware.live and Cybersystem telemetry.
| Threat Group | Victim | Date Published |
|---|---|---|
| Section9 | ****.com.pa | Jul 29, 2026 |
| spacebears | StellarRAD Systems | Jul 29, 2026 |
| incransom | harwal.net | Jul 29, 2026 |
| gunra | Weilhotel | Jul 29, 2026 |
| akira | Northwood Country Club | Jul 29, 2026 |
| aurora | Bretford Manufacturing | Jul 29, 2026 |
| Deadlock | AHENK lab | Jul 28, 2026 |
| qilin | Hoc | Jul 28, 2026 |
| blacknevas | Speed Group | Jul 28, 2026 |
| thegentlemen | Buck Knives | Jul 28, 2026 |
| chaos | thecranewaregroup.com | Jul 28, 2026 |
| cmdorganization | B-K Tool & Design | Jul 28, 2026 |
| Deadlock | DIATER | Jul 28, 2026 |
| Deadlock | Pasello | Jul 28, 2026 |
| Booba Project | Oklahoma Manufacturing Alliance | Jul 28, 2026 |
| Booba Project | Incredible Technologies | Jul 28, 2026 |
| incransom | Della Casa Group AG | Jul 28, 2026 |
| qilin | Gran valle negocios | Jul 28, 2026 |
| termite | Affinia Healthcare | Jul 28, 2026 |
| incransom | minigrip.com.mx | Jul 28, 2026 |
| incransom | DUCON | Jul 28, 2026 |
| anubis | Prelys Courtage | Jul 28, 2026 |
| incransom | greenecountyga.gov | Jul 28, 2026 |
| incransom | foundationstofreedom.org | Jul 28, 2026 |
| coinbasecartel | Accesso | Jul 28, 2026 |
| akira | Franz Krause artworksgroup | Jul 28, 2026 |
| incransom | https://eclmn.com/ | Jul 28, 2026 |
| Deadlock | Takis srl | Jul 28, 2026 |
| termite | JD Young | Jul 27, 2026 |
| safepay | zinorm.de | Jul 27, 2026 |
| safepay | moebelmayer.de | Jul 27, 2026 |
| safepay | paritaet-nrw.org | Jul 27, 2026 |
| safepay | haugbuersten.de | Jul 27, 2026 |
| safepay | landesmuseum.de | Jul 27, 2026 |
| safepay | hst.eu | Jul 27, 2026 |
| safepay | braywoodschool.co.uk | Jul 27, 2026 |
| safepay | weier.org | Jul 27, 2026 |
| safepay | bnpdist.com | Jul 27, 2026 |
| chaos | vit-best.com | Jul 27, 2026 |
| qilin | Wilbert's | Jul 27, 2026 |