thegentlemen
ELEVATED6
Victims disclosed (30d)
25 total Canada victims
Manufacturing, Education, Hospitality
Snapshot • Oct 6, 2026
Live Intelligence
Ransomware Tracker
Fresh intelligence sourced from ransomware.live, prioritising Canadian disclosures and extortion campaigns.
Last refresh: Oct 14, 2026
Canadian Threat Pulse
🇨🇦 Live ransomware intelligence feed.
Powered by ransomware.live Pro. We prioritise Ontario, GTA, British Columbia, and Quebec victims to drive rapid outreach across our Canadian client base.
Last refresh
Oct 14, 2026
Live polling active
Ransomware IOC
27
Victims disclosed in the past 30 days
0% MoMCloud Drift
1
Misconfiguration paths blocked this week
+100% WoWIdentity Attacks
1
Credential-stuffing bursts contained
0% WoWN0n
ELEVATED3
Victims disclosed (30d)
3 total Canada victims
Financial Services, Not Found
Snapshot • Oct 11, 2026
Storm
ELEVATED3
Victims disclosed (30d)
10 total Canada victims
Healthcare, Other
Snapshot • Oct 7, 2026
Canadian victims
27
Canadian disclosures in the past 30 days.
Global spotlight
100
Victims tracked worldwide in the rolling archive.
Active crews
25
Top 20 ransomware crews ranked by victim disclosures in this archive.
thegentlemen: 6 logged
North America Heat Map
Canada, the United States, and Mexico weighted by confirmed disclosures across the rolling ransomware archive.
Global Extortion Surface
Victim geography & supply-chain exposure
Hover bubbles for detail
- MarieBelle New YorkUnited States
N0n
Published Oct 13, 2026
- The Innovation GroupUnited States
play
Published Oct 13, 2026
- Culinary SpecialtiesUnited States
play
Published Oct 13, 2026
- The Buckner Company, Inc.United States
aurora
Published Oct 13, 2026
- hiqbio.comUnited States
safepay
Published Oct 12, 2026
- RingSide CreativeUnited States
qilin
Published Oct 12, 2026
Regional Spotlight
Ontario, GTA, British Columbia, and Quebec accounts comprise the majority of Canadian disclosures today. We surface the most recent activity in each market.
GTA and Ottawa focus
Ontario
- Canadian Mennonite University (CMU)dragonforceOct 12, 2026
- Company #14N0nOct 11, 2026
- hsc.mb.caincransomOct 10, 2026
- mblllparcusmediaOct 9, 2026
- Cooperative Des Techniciens Ambulanciers De La MonteStormOct 7, 2026
- Northwestern PolytechnicthegentlemenOct 6, 2026
Toronto metro
GTA
- FlexmasterStormSep 7, 2026
- Canadian Mental Health AssociationStormAug 11, 2026
- European DesignthegentlemenJul 23, 2026
Lower Mainland & Island
British Columbia
- IslandqilinSep 27, 2026
Montréal & provincial
Quebec
- No recent disclosures
Most Active Ransomware Crews (90 days)
TAG momentum report
Most active crews observed by TAG over the last quarter with last-seen timestamps.
- TAG
01. N0n
52 victims logged · Last seen Oct 13, 2026
- TAG
02. play
103 victims logged · Last seen Oct 13, 2026
- TAG
03. safepay
33 victims logged · Last seen Oct 12, 2026
- TAG
04. qilin
117 victims logged · Last seen Oct 12, 2026
- TAG
05. interlock
15 victims logged · Last seen Oct 12, 2026
- TAG
06. incransom
52 victims logged · Last seen Oct 12, 2026
- TAG
07. dragonforce
24 victims logged · Last seen Oct 12, 2026
- TAG
08. akira
85 victims logged · Last seen Oct 12, 2026
- TAG
09. rhysida
22 victims logged · Last seen Oct 11, 2026
- TAG
10. Storm
10 victims logged · Last seen Oct 7, 2026
- TAG
11. thegentlemen
25 victims logged · Last seen Oct 6, 2026
- TAG
12. clop
55 victims logged · Last seen Aug 5, 2026
Global exposure
Country distribution for victims captured within the combined archive.
Global Extortion Surface
Victim geography & supply-chain exposure
Hover bubbles for detail
| Rank | Country/Region | Victims |
|---|---|---|
| 1 | Canada | 1,115 |
| 2 | United States | 24 |
| 3 | South Korea | 12 |
| 4 | Brazil | 5 |
| 5 | United Kingdom | 5 |
| 6 | Indonesia | 4 |
| 7 | Germany | 3 |
| 8 | India | 3 |
| 9 | Peru | 2 |
| 10 | Spain | 2 |
| 11 | Singapore | 2 |
| 12 | China | 2 |
Intelligence headlines
Curated advisories surfaced alongside ransomware activity.
- Open source · cyber.gc.ca ↗CCCS warns of increased ransomware targeting Canadian municipalitiesJan 15, 2025
Canadian Centre for Cyber Security
The Cyber Centre observed coordinated credential-stuffing attempts preceding LockBit compromises in Ontario.
- Open source · ransomware.live ↗Healthcare sector sees spike in extortion incidentsJan 12, 2025
Ransomware.live
Ransomware.live telemetry shows healthcare victim listings rising 18% week-over-week.
Five-Year Canadian Threat Trend
Comparative look at ransomware disclosures versus phishing, smishing, vishing, and business email compromise (BEC) reports across Canada.
Next data feeds
Broaden coverage with phishing, vulnerability, and IoC sources wired into the backend.
Phishing & Malware
Canadian Centre for Cyber Security Advisories
Official bulletins covering critical vulnerabilities, phishing campaigns, and ransomware guidance tailored to Canadian operators.
/api/threats/cyber-centreDocumentation ↗Vulnerability Intelligence
CISA Known Exploited Vulnerabilities (KEV)
Authoritative catalogue of vulnerabilities actively exploited in the wild with remediation deadlines to drive patch prioritisation.
/api/threats/kevDocumentation ↗IoC Feeds
Abuse.ch ThreatFox
Community-driven repository of fresh indicators of compromise spanning malware, C2 infrastructure, and phishing kits.
/api/threats/threatfoxDocumentation ↗Phishing Intelligence
OpenPhish Commercial API
Continuously updated feed of verified phishing URLs suitable for mail and web gateway enforcement.
/api/threats/phishingDocumentation ↗Malware & Botnet Activity
Shadowserver Daily Reports
Global sensor telemetry on malware callbacks, exposed services, and botnet drones to support containment playbooks.
/api/threats/shadowserverDocumentation ↗
Live Ransomware Disclosures
Tracking leagues sourced from ransomware.live and Cybersystem telemetry.
| Threat Group | Victim | Date Published |
|---|---|---|
| direwolf | Interseguro | Oct 13, 2026 |
| Vexy Ransomware | Guarufilme | Oct 13, 2026 |
| N0n | MarieBelle New York | Oct 13, 2026 |
| N0n | PG Group (Pure Options) | Oct 13, 2026 |
| Panzer | Valode & Pistre | Oct 13, 2026 |
| Panzer | Zenidoc | Oct 13, 2026 |
| emperador | CMC AUDITORES SRL | Oct 13, 2026 |
| play | The Innovation Group | Oct 13, 2026 |
| play | DFK Group | Oct 13, 2026 |
| play | Saddlers Court MFG | Oct 13, 2026 |
| play | Culinary Specialties | Oct 13, 2026 |
| play | Advanced Imaging Solutions | Oct 13, 2026 |
| AuditTeam | AD***ed | Oct 13, 2026 |
| AuditTeam | Ze***ce | Oct 13, 2026 |
| AuditTeam | Sa***ge | Oct 13, 2026 |
| BYOD | Decorolala | Oct 13, 2026 |
| aurora | The Buckner Company, Inc. | Oct 13, 2026 |
| safepay | hiqbio.com | Oct 12, 2026 |
| Deadlock | Aeroklas Duys / Duys Engineering Group | Oct 12, 2026 |
| qilin | RingSide Creative | Oct 12, 2026 |
| Dark Project | Claire's Inc. | Oct 12, 2026 |
| Dark Project | PennEastern Architects LCC | Oct 12, 2026 |
| Dark Project | Franklin Miller Inc. | Oct 12, 2026 |
| interlock | Pedigo Products, Inc. | Oct 12, 2026 |
| interlock | Valenti Management | Oct 12, 2026 |
| interlock | Concord Eye Center | Oct 12, 2026 |
| interlock | Greentech Environmental | Oct 12, 2026 |
| interlock | Engineers Contractors Fabricators Inc. (ECF) | Oct 12, 2026 |
| interlock | Nu-Quest Distribution Inc | Oct 12, 2026 |
| qilin | ConAuto | Oct 12, 2026 |
| qilin | Prodiel | Oct 12, 2026 |
| metaencryptor | MyMichigan Health | Oct 12, 2026 |
| metaencryptor | VIATechnik | Oct 12, 2026 |
| incransom | brookslawfirm.com | Oct 12, 2026 |
| N0n | GlobalNet LCL (port agency operations) | Oct 12, 2026 |
| N0n | Santos Brasil (port operations) | Oct 12, 2026 |
| N0n | Asyaport (container terminal operations) | Oct 12, 2026 |
| N0n | Ocean Network Express (container shipping) | Oct 12, 2026 |
| N0n | MGNP (port terminal operations) | Oct 12, 2026 |
| N0n | Portonave (container terminal operations) | Oct 12, 2026 |