qilin
ELEVATED6
Victims disclosed (30d)
103 total Canada victims
Manufacturing, Professional Services, Not Found
Snapshot • Aug 9, 2026
Live Intelligence
Ransomware Tracker
Fresh intelligence sourced from ransomware.live, prioritising Canadian disclosures and extortion campaigns.
Last refresh: Aug 14, 2026
Canadian Threat Pulse
🇨🇦 Live ransomware intelligence feed.
Powered by ransomware.live Pro. We prioritise Ontario, GTA, British Columbia, and Quebec victims to drive rapid outreach across our Canadian client base.
Last refresh
Aug 14, 2026
Live polling active
Ransomware IOC
28
Victims disclosed in the past 30 days
+12% MoMCloud Drift
1
Misconfiguration paths blocked this week
+100% WoWIdentity Attacks
1
Credential-stuffing bursts contained
+100% WoWStorm
ELEVATED3
Victims disclosed (30d)
3 total Canada victims
Healthcare, Professional Services, Manufacturing
Snapshot • Aug 11, 2026
incransom
ELEVATED2
Victims disclosed (30d)
48 total Canada victims
Professional Services, Education
Snapshot • Aug 13, 2026
Canadian victims
28
Canadian disclosures in the past 30 days.
Global spotlight
100
Victims tracked worldwide in the rolling archive.
Active crews
25
Top 20 ransomware crews ranked by victim disclosures in this archive.
qilin: 6 logged
North America Heat Map
Canada, the United States, and Mexico weighted by confirmed disclosures across the rolling ransomware archive.
Global Extortion Surface
Victim geography & supply-chain exposure
Hover bubbles for detail
- Cook Medical LLCUnited States
shinyhunters
Published Aug 14, 2026
- Baxter International, Inc.United States
shinyhunters
Published Aug 14, 2026
- Community ConnectionsUnited States
thegentlemen
Published Aug 14, 2026
- Plaza Auto MallMexico
thegentlemen
Published Aug 14, 2026
- First Coast Heart Vascular CenterUnited States
thegentlemen
Published Aug 14, 2026
- Gravity CoffeeUnited States
thegentlemen
Published Aug 14, 2026
Regional Spotlight
Ontario, GTA, British Columbia, and Quebec accounts comprise the majority of Canadian disclosures today. We surface the most recent activity in each market.
GTA and Ottawa focus
Ontario
- cambrialawfirm.comincransomAug 13, 2026
- Jack Rutherford Customs Brokers Ltd / The Rutherford Group www.therg.ca serviced by an IT ...blacknevasAug 12, 2026
- Canadian Mental Health AssociationStormAug 11, 2026
- Tapper Cuddy LLPStormAug 11, 2026
- Integra CastingsStormAug 11, 2026
- Canopy Support ServicesthegentlemenAug 9, 2026
Toronto metro
GTA
- Canadian Mental Health AssociationStormAug 11, 2026
- European DesignthegentlemenJul 23, 2026
- SymcoreverestMay 2, 2026
Lower Mainland & Island
British Columbia
- No recent disclosures
Montréal & provincial
Quebec
- No recent disclosures
Most Active Ransomware Crews (90 days)
TAG momentum report
Most active crews observed by TAG over the last quarter with last-seen timestamps.
- TAG
01. thegentlemen
36 victims logged · Last seen Aug 14, 2026
- TAG
02. incransom
55 victims logged · Last seen Aug 13, 2026
- TAG
03. rhysida
21 victims logged · Last seen Aug 13, 2026
- TAG
04. qilin
113 victims logged · Last seen Aug 13, 2026
- TAG
05. akira
82 victims logged · Last seen Aug 13, 2026
- TAG
06. clop
57 victims logged · Last seen Aug 12, 2026
- TAG
07. interlock
10 victims logged · Last seen Aug 11, 2026
- TAG
08. dragonforce
22 victims logged · Last seen Aug 11, 2026
- TAG
09. direwolf
13 victims logged · Last seen Aug 11, 2026
- TAG
10. safepay
31 victims logged · Last seen Jul 20, 2026
- TAG
11. play
94 victims logged · Last seen May 11, 2026
- TAG
12. lynx
22 victims logged · Last seen Feb 3, 2026
Global exposure
Country distribution for victims captured within the combined archive.
Global Extortion Surface
Victim geography & supply-chain exposure
Hover bubbles for detail
| Rank | Country/Region | Victims |
|---|---|---|
| 1 | Canada | 1,058 |
| 2 | United States | 36 |
| 3 | Italy | 6 |
| 4 | United Kingdom | 5 |
| 5 | Germany | 4 |
| 6 | Japan | 4 |
| 7 | Brazil | 3 |
| 8 | Australia | 3 |
| 9 | Switzerland | 3 |
| 10 | Greece | 2 |
| 11 | Philippines | 2 |
| 12 | Morocco | 1 |
Intelligence headlines
Curated advisories surfaced alongside ransomware activity.
- Open source · cyber.gc.ca ↗CCCS warns of increased ransomware targeting Canadian municipalitiesJan 15, 2025
Canadian Centre for Cyber Security
The Cyber Centre observed coordinated credential-stuffing attempts preceding LockBit compromises in Ontario.
- Open source · ransomware.live ↗Healthcare sector sees spike in extortion incidentsJan 12, 2025
Ransomware.live
Ransomware.live telemetry shows healthcare victim listings rising 18% week-over-week.
Five-Year Canadian Threat Trend
Comparative look at ransomware disclosures versus phishing, smishing, vishing, and business email compromise (BEC) reports across Canada.
Next data feeds
Broaden coverage with phishing, vulnerability, and IoC sources wired into the backend.
Phishing & Malware
Canadian Centre for Cyber Security Advisories
Official bulletins covering critical vulnerabilities, phishing campaigns, and ransomware guidance tailored to Canadian operators.
/api/threats/cyber-centreDocumentation ↗Vulnerability Intelligence
CISA Known Exploited Vulnerabilities (KEV)
Authoritative catalogue of vulnerabilities actively exploited in the wild with remediation deadlines to drive patch prioritisation.
/api/threats/kevDocumentation ↗IoC Feeds
Abuse.ch ThreatFox
Community-driven repository of fresh indicators of compromise spanning malware, C2 infrastructure, and phishing kits.
/api/threats/threatfoxDocumentation ↗Phishing Intelligence
OpenPhish Commercial API
Continuously updated feed of verified phishing URLs suitable for mail and web gateway enforcement.
/api/threats/phishingDocumentation ↗Malware & Botnet Activity
Shadowserver Daily Reports
Global sensor telemetry on malware callbacks, exposed services, and botnet drones to support containment playbooks.
/api/threats/shadowserverDocumentation ↗
Live Ransomware Disclosures
Tracking leagues sourced from ransomware.live and Cybersystem telemetry.
| Threat Group | Victim | Date Published |
|---|---|---|
| shinyhunters | Cook Medical LLC | Aug 14, 2026 |
| shinyhunters | Baxter International, Inc. | Aug 14, 2026 |
| thegentlemen | Vector Two Technology | Aug 14, 2026 |
| thegentlemen | Acli | Aug 14, 2026 |
| thegentlemen | Community Connections | Aug 14, 2026 |
| thegentlemen | Megalaser Industria Metalurgica LTDA | Aug 14, 2026 |
| thegentlemen | EKEPIS | Aug 14, 2026 |
| thegentlemen | Avanta Maroc Ex Adecco | Aug 14, 2026 |
| thegentlemen | Plaza Auto Mall | Aug 14, 2026 |
| thegentlemen | Tempel | Aug 14, 2026 |
| thegentlemen | TOA | Aug 14, 2026 |
| thegentlemen | Retail Business Management Systems | Aug 14, 2026 |
| thegentlemen | Cityside Homes | Aug 14, 2026 |
| thegentlemen | First Coast Heart Vascular Center | Aug 14, 2026 |
| thegentlemen | KFC Kosova | Aug 14, 2026 |
| thegentlemen | The Coffee Bean | Aug 14, 2026 |
| thegentlemen | Ollies Place Kidswear | Aug 14, 2026 |
| thegentlemen | Gravity Coffee | Aug 14, 2026 |
| SilentRansomGroup | Reminger | Aug 13, 2026 |
| incransom | https://pacific-construction.com/ | Aug 13, 2026 |
| incransom | cambrialawfirm.com | Aug 13, 2026 |
| coinbasecartel | Hitachi High-Tech | Aug 13, 2026 |
| rhysida | SIA Medical Centre | Aug 13, 2026 |
| qilin | D & J Beverage Service | Aug 13, 2026 |
| payload | Zara Investment Holding | Aug 13, 2026 |
| AiLock | DAISEN | Aug 13, 2026 |
| AiLock | Yaomasa | Aug 13, 2026 |
| thegentlemen | Gfeller Treuhand und Verwaltungs | Aug 13, 2026 |
| thegentlemen | IPS | Aug 13, 2026 |
| shinyhunters | Carhartt, Inc. | Aug 13, 2026 |
| blacknevas | Portable Intelligence Inc www.portable-intelligence.com serviced by an IT company Computer... | Aug 13, 2026 |
| akira | CF Supply | Aug 13, 2026 |
| SilentRansomGroup | Riker Danzig Scherer Hyland & Perretti | Aug 12, 2026 |
| SilentRansomGroup | Riker Danzig LLP | Aug 12, 2026 |
| incransom | gamaus.com | Aug 12, 2026 |
| incransom | clgroup | Aug 12, 2026 |
| thegentlemen | Safeware | Aug 12, 2026 |
| blacknevas | Jack Rutherford Customs Brokers Ltd / The Rutherford Group www.therg.ca serviced by an IT ... | Aug 12, 2026 |
| qilin | United Association Local Union 345 | Aug 12, 2026 |
| blacknevas | Enteroptyx Ophthalmology Products www.enteroptyx.com serviced by an IT company Computer Co... | Aug 12, 2026 |