The MedusaLocker ransomware group has reportedly added two organizations to its victim list on November 5, 2026. The latest ThreatMon monitoring updates identify JATL and Interativa Plásticos (Interplast) as newly claimed victims. The claims indicate continued targeting across potentially different business sectors, although the available reports do not establish whether data was stolen, encrypted, or published. the Report According to ThreatMon, MedusaLocker listed the following organizations:

Reported Ransomware Activity ThreatMon has reported two new victim claims involving the PLAY and DarkProject ransomware groups, highlighting continued ransomware activity targeting organizations in Canada and the United States. The reported victims are Misura, an information technology organization in Canada, and Homestead Creamery, a dairy and food-production business in the United States. Both entries were published by ThreatMon on November 5, 2026, although the DarkProject claim is dated November 4.

The ransomware group BoobaProject has reportedly added Boardman Park, a United Kingdom-based organization, to its victim listings on November 3, 2026. The announcement was reported by the ThreatMon Threat Intelligence Team. At this stage, the listing represents an attacker-side claim rather than independently verified evidence of a successful cyberattack or data breach. 1. Incident Overview According to ThreatMon, BoobaProject identified Boardman Park as a newly claimed victim.

Published: November 3, 2026 Source: ThreatMon Threat Intelligence Team PixelLeaks Claims an Unnamed Organization in Italy A newly emerging ransomware operation known as PixelLeaks has reportedly listed another victim on its leak-site activity tracker, claiming an attack against an unnamed organization located in Italy. According to threat intelligence monitoring published by ThreatMon on November 3, 2026, PixelLeaks identified an unnamed Italian entity as a new victim.

The N0n cybercrime group has listed two additional organizations as victims on November 3, 2026, according to threat-intelligence monitoring by ThreatMon. The latest entries bring the group's reported victim numbering to Company 120, although the identities and circumstances of the alleged incidents remain undisclosed. the Report ThreatMon reported two new victim claims attributed to the N0n group: Company 120: United States.

Two organizations in Argentina and Spain have appeared in ransomware-related victim listings published by the ThreatMon Threat Intelligence Team on November 2, 2026. The claims involve NightSpire and AuditTeam, targeting organizations operating in government and public administration and the industrial packaging sector. the Report According to ThreatMon, two new victim claims have been reported: NightSpire – REFSA S.A. Country: Argentina…

The Qilin ransomware group has listed Richland Resources Corporation as a newly claimed victim on its alleged victim list, with the incident dated October 30, 2026. The announcement was circulated by ThreatMon on October 31. Incident Summary Threat actor: Qilin Reported victim: Richland Resources Corporation Claim date: October 30, 2026 Disclosure date: October 31, 2026 Source: ThreatMon Threat Intelligence Team…

The Qilin ransomware group has listed Richland Resources Corporation as a newly claimed victim, according to a threat-intelligence alert published by ThreatMon on October 31, 2026. The listing identifies October 30 as the reported incident date. However, the available information does not establish whether the organization experienced a confirmed intrusion, data theft, or ransomware encryption. Incident Overview ThreatMon reported that Qilin had added Richland Resources Corporation to its list of alleged victims.

The Qilin ransomware operation has listed Richland Resources Corporation as a newly claimed victim, adding another organization to its publicly advertised victim list. The claim was reported by ThreatMon on October 31, 2026, with the alleged incident dated October 30. Incident Summary Threat actor: Qilin Reported victim: Richland Resources Corporation Claim date: October 30, 2026 Reporting source: ThreatMon Threat Intelligence Team…

Threat actor: Aoqin Victim: Nextron Technology Country: China Sector: Information Technology Claim date: November 4, 2026 Source: ThreatMon Threat Intelligence Team Incident Overview The Aoqin ransomware group has listed Nextron Technology, an information technology company in China, as a newly claimed victim on November 4, 2026. The listing adds another organization to Aoqin's reported victim portfolio. However, the available intelligence does not establish whether the attackers successfully compromised Nextron Technology's internal systems or exfiltrated sensitive information.

the Report The MedusaLocker ransomware group has reportedly added two organizations to its victim list, according to threat intelligence monitoring published by ThreatMon on November 5, 2026. The organizations named in the claims are Jobmongers in the United Kingdom and Interativa Plasticos (Interplast) in Brazil. The two listings indicate potential ransomware-related incidents affecting organizations in different countries and business sectors.

the Report The MedusaLocker ransomware group has claimed two additional organizations as victims in separate countries, according to threat intelligence monitoring published by ThreatMon on November 5, 2026. The newly listed organizations are The Courier Guy, a South African transportation and logistics company, and Interativa Plasticos (Interplast), a Brazilian manufacturing company. Both organizations appeared in the group's reported victim listings on the same date.

New Victim Listed on November 5, 2026 The ransomware group SilentRansomGroup has reportedly added K... R... to its list of alleged victims, according to threat intelligence monitoring published by the ThreatMon Threat Intelligence Team on November 5, 2026. The listing indicates that the organization has been identified by the group as a new target. However, the available intelligence does not provide additional details about the alleged incident.

Published: October 31, 2026 Threat Actor: Qilin Reported Victim: Richland Resources Corporation Claim Date: October 30, 2026 Source: ThreatMon Threat Intelligence Team Introduction: Qilin Adds Richland Resources Corporation to Its Victim List The Qilin ransomware group has reportedly listed Richland Resources Corporation as a newly claimed victim on its ransomware leak-site activity, according to a threat intelligence alert published by ThreatMon on October 31, 2026.

Introduction: Two Ransomware Groups Report New Victim Listings ThreatMon Threat Intelligence has reported two new victim claims involving the ransomware groups United Legion and SafePay, highlighting continued activity across underground threat ecosystems. The November 5, 2026, listing attributed to United Legion contains an unusual Chinese-to-English translation, while SafePay has listed a Belgian website, titres-services.net, as a newly claimed victim. Neither listing, by itself, establishes that a successful cyberattack or data breach has been independently confirmed.

Threat intelligence monitoring account ThreatMon reported two new ransomware victim claims on November 4, 2026. The Brain Cipher ransomware group listed HHJ CPA (hhjcpa.com), categorized under Information Technology, while SafePay claimed responsibility for an alleged attack against a German healthcare provider, Fuß- und Sprunggelenkzentrum Berlin (fuss-sprunggelenk.de). Neither listing independently confirms that the organizations suffered a breach or that their data was successfully exfiltrated.

Introduction: Ransomware Groups Expand Their Reported Victim Lists ThreatMon has reported two new victim claims involving ransomware groups DarkProject and SafePay, with organizations in the United States and Germany appearing on their respective lists on November 4, 2026. The reported victims are Homestead Creamery, a US-based dairy producer, and Fuss- und Sprunggelenkzentrum Berlin, a German medical center specializing in foot and ankle treatment.

The ransomware group N0n has listed two additional organizations as victims on November 3, 2026, according to threat intelligence monitoring by ThreatMon. One of the newly reported victims is identified as a company operating in the United Arab Emirates, potentially expanding the group's reported geographical footprint. The latest activity includes two separate victim listings: Company 118 — United Arab Emirates.

Introduction: Another Manufacturing Target Added to PLAY's Victim List The PLAY ransomware group has reportedly added Standard Sand & Silica, a United States-based manufacturing company, to its list of newly claimed victims. The listing was reported by ThreatMon on November 5, 2026. The claim adds another potential manufacturing-sector incident to the group's ongoing ransomware activity. Original Incident Report According to ThreatMon Threat Intelligence Team:

Introduction: Two Ransomware Groups Expand Their Victim Lists ThreatMon Threat Intelligence Team has reported two new victim claims associated with UnitedLegion and SafePay, published between November 4 and November 5, 2026. The listings identify two separate targets: an entity or online identity using the name SnowSoul, claimed by UnitedLegion, and the Belgian website titres-services.net, claimed by SafePay. Neither claim should automatically be interpreted as confirmation of a successful cyberattack or verified data theft.

United Legion Added to Ransomware Threat Landscape A new ransomware group identified as United Legion has appeared on the cyber threat intelligence radar, with ThreatMon reporting the addition of a dedicated onion-based leak-site address on November 4, 2026. Group: United Legion Discovery date: November 4, 2026 Dark web address: torpje7g4vkxiqgc473dro7onbpkgmryhj6jd67anwy5jh7jknsjuzid[.]onion:88 Status: Newly identified ransomware operation Victims: No confirmed victims provided in the available report.

Introduction: Two New Ransomware Claims Reported on November 4 ThreatMon has reported two additional victim claims involving different ransomware groups on November 4, 2026. The claims involve an unidentified German company attributed to N0n and Kontron North America, a manufacturing-sector organization in the United States, attributed to GlobalSecretGroup. Both entries appeared in ThreatMon's threat intelligence feed at approximately 4:32 PM. However, the available information does not establish whether either incident involved confirmed network intrusion, data theft, encryption, or publication of stolen information.

Two ransomware or cyber-extortion groups, N0n and GlobalSecretGroup, have listed new alleged victims in the United States, according to threat intelligence monitoring published by ThreatMon on November 4, 2026. One listing identifies an unnamed company as Company 130, while the second names Kontron North America, a manufacturing-sector organization. Although both entries indicate potential targeting, the available information does not establish whether either organization suffered a confirmed ransomware infection, data exfiltration, or operational disruption.

A newly tracked ransomware group, United Legion, has claimed another victim on its leak platform, according to a November 5, 2026, alert published by ThreatMon. The listing contains an unusual and incomplete victim description: "As long as you're willing to pay, we're very easy to deal with—the…" The wording appears to be part of a statement or message displayed by the threat group rather than a clearly identifiable organization name.