New post from #Nightspire : C*Ro *Nty *Es
More at : https://www.ransomlook.io/group/Nightspire #Ransomware
More at : https://www.ransomlook.io/group/Nightspire #Ransomware
October 1, 2026 at 1:49 PM
New post from #Nightspire : C*Ro *Nty *Es
More at : https://www.ransomlook.io/group/Nightspire #Ransomware
More at : https://www.ransomlook.io/group/Nightspire #Ransomware
🔴 C*ro *nty *es added to Nightspire's leak site
📍 1 Oct 2026
🏴 Nightspire has listed 322 victims since February 2025.
https://cyberthreatintelligence.net/ransomware-victim/c-ro-nty-es-nightspire-2026
#ransomware #nightspire #threatintel
📍 1 Oct 2026
🏴 Nightspire has listed 322 victims since February 2025.
https://cyberthreatintelligence.net/ransomware-victim/c-ro-nty-es-nightspire-2026
#ransomware #nightspire #threatintel
C*ro *nty *es — Ransomware Attack by Nightspire
Disclosed 1 Oct 2026. Incident profile, threat group background and sector analysis.
cyberthreatintelligence.net
October 1, 2026 at 3:03 PM
🔴 C*ro *nty *es added to Nightspire's leak site
📍 1 Oct 2026
🏴 Nightspire has listed 322 victims since February 2025.
https://cyberthreatintelligence.net/ransomware-victim/c-ro-nty-es-nightspire-2026
#ransomware #nightspire #threatintel
📍 1 Oct 2026
🏴 Nightspire has listed 322 victims since February 2025.
https://cyberthreatintelligence.net/ransomware-victim/c-ro-nty-es-nightspire-2026
#ransomware #nightspire #threatintel
🧭 How Nightspire is documented to operate
· Valid Accounts
· Brute Force
· Exploit Public-Facing Application
· Phishing
MITRE ATT&CK techniques attributed to Nightspire overall — not a finding about how this organisation was reached.
· Valid Accounts
· Brute Force
· Exploit Public-Facing Application
· Phishing
MITRE ATT&CK techniques attributed to Nightspire overall — not a finding about how this organisation was reached.
October 1, 2026 at 3:03 PM
🧭 How Nightspire is documented to operate
· Valid Accounts
· Brute Force
· Exploit Public-Facing Application
· Phishing
MITRE ATT&CK techniques attributed to Nightspire overall — not a finding about how this organisation was reached.
· Valid Accounts
· Brute Force
· Exploit Public-Facing Application
· Phishing
MITRE ATT&CK techniques attributed to Nightspire overall — not a finding about how this organisation was reached.
New post from #Nightspire : Forma Therapeutics Holdings, Inc.
More at : https://www.ransomlook.io/group/Nightspire #Ransomware
More at : https://www.ransomlook.io/group/Nightspire #Ransomware
October 3, 2026 at 1:46 AM
New post from #Nightspire : Forma Therapeutics Holdings, Inc.
More at : https://www.ransomlook.io/group/Nightspire #Ransomware
More at : https://www.ransomlook.io/group/Nightspire #Ransomware
According to Ransomware.live, nightspire ransomware group has added C*ro *nty *es to its victims.
October 1, 2026 at 1:35 PM
According to Ransomware.live, nightspire ransomware group has added C*ro *nty *es to its victims.
📢 Ransomware Alert: 🚨
The NightSpire ransomware group has added an unidentified victim (C*ro *nty *es) to its dark-web portal.
NB: The group intends to publish the data within 3–4 days.
🔍 Key Details:
🛡️ Threat actor: NightSpire
📅 Reported on: 01/10/26
The NightSpire ransomware group has added an unidentified victim (C*ro *nty *es) to its dark-web portal.
NB: The group intends to publish the data within 3–4 days.
🔍 Key Details:
🛡️ Threat actor: NightSpire
📅 Reported on: 01/10/26
October 1, 2026 at 1:43 PM
📢 Ransomware Alert: 🚨
The NightSpire ransomware group has added an unidentified victim (C*ro *nty *es) to its dark-web portal.
NB: The group intends to publish the data within 3–4 days.
🔍 Key Details:
🛡️ Threat actor: NightSpire
📅 Reported on: 01/10/26
The NightSpire ransomware group has added an unidentified victim (C*ro *nty *es) to its dark-web portal.
NB: The group intends to publish the data within 3–4 days.
🔍 Key Details:
🛡️ Threat actor: NightSpire
📅 Reported on: 01/10/26
🔴 Forma Therapeutics Holdings, Inc. — listed by Nightspire
📍 United States · Healthcare · 3 Oct 2026
🏴 Nightspire has listed 322 victims since February 2025.
#ransomware #nightspire #threatintel
📍 United States · Healthcare · 3 Oct 2026
🏴 Nightspire has listed 322 victims since February 2025.
#ransomware #nightspire #threatintel
Forma Therapeutics Holdings, Inc. — Ransomware Attack by Nightspire
Based in United States. Healthcare sector. Disclosed 3 Oct 2026. Incident profile, threat group background and sector analysis.
cyberthreatintelligence.net
October 3, 2026 at 3:00 AM
🔴 Forma Therapeutics Holdings, Inc. — listed by Nightspire
📍 United States · Healthcare · 3 Oct 2026
🏴 Nightspire has listed 322 victims since February 2025.
#ransomware #nightspire #threatintel
📍 United States · Healthcare · 3 Oct 2026
🏴 Nightspire has listed 322 victims since February 2025.
#ransomware #nightspire #threatintel
Nightspire ransomware hit Forma Therapeutics in the US, exposing clinical trial data, lab notebooks, research IP, drug discovery, and genomic records. #UnitedStates #Ransomware #PharmaData
Ransom! Forma Therapeutics Holdings, Inc. (OCT-2026)
Nightspire ransomware targeted Forma Therapeutics Holdings, Inc. in the US, compromising clinical trial and statistical data along with electronic lab notebooks, research IP, drug discovery and pipeline information, and biological/genomic data. Impacted country: #UnitedStates
www.hendryadrian.com
October 3, 2026 at 5:15 AM
Nightspire ransomware hit Forma Therapeutics in the US, exposing clinical trial data, lab notebooks, research IP, drug discovery, and genomic records. #UnitedStates #Ransomware #PharmaData
🚨New ransom group blog post!🚨
Group name: nightspire
Post title: Forma Therapeutics Holdings, Inc.
Location: 🇺🇸 US
Sector: Healthcare
#ransomware #cti #threatintelligence #cybersecurity #infosec
Group name: nightspire
Post title: Forma Therapeutics Holdings, Inc.
Location: 🇺🇸 US
Sector: Healthcare
#ransomware #cti #threatintelligence #cybersecurity #infosec
October 3, 2026 at 1:03 AM
🚨New ransom group blog post!🚨
Group name: nightspire
Post title: Forma Therapeutics Holdings, Inc.
Location: 🇺🇸 US
Sector: Healthcare
#ransomware #cti #threatintelligence #cybersecurity #infosec
Group name: nightspire
Post title: Forma Therapeutics Holdings, Inc.
Location: 🇺🇸 US
Sector: Healthcare
#ransomware #cti #threatintelligence #cybersecurity #infosec
🧭 How Nightspire is documented to operate
· Valid Accounts
· Brute Force
· Exploit Public-Facing Application
· Phishing
MITRE ATT&CK techniques attributed to Nightspire overall — not a finding about how this organisation was reached.
· Valid Accounts
· Brute Force
· Exploit Public-Facing Application
· Phishing
MITRE ATT&CK techniques attributed to Nightspire overall — not a finding about how this organisation was reached.
October 3, 2026 at 3:00 AM
🧭 How Nightspire is documented to operate
· Valid Accounts
· Brute Force
· Exploit Public-Facing Application
· Phishing
MITRE ATT&CK techniques attributed to Nightspire overall — not a finding about how this organisation was reached.
· Valid Accounts
· Brute Force
· Exploit Public-Facing Application
· Phishing
MITRE ATT&CK techniques attributed to Nightspire overall — not a finding about how this organisation was reached.
🚨 Ransomware Alert: 🇺🇸
Forma Therapeutics, a USA-based Biotechnology Research company, has reportedly fallen victim to the NightSpire ransomware
🔎 Key Details:
👥 Threat Actor: NightSpire
📅 Reported on: 03/10/26
📦 Data Compromised: 7 GB
Forma Therapeutics, a USA-based Biotechnology Research company, has reportedly fallen victim to the NightSpire ransomware
🔎 Key Details:
👥 Threat Actor: NightSpire
📅 Reported on: 03/10/26
📦 Data Compromised: 7 GB
October 3, 2026 at 2:02 AM
🚨 Ransomware Alert: 🇺🇸
Forma Therapeutics, a USA-based Biotechnology Research company, has reportedly fallen victim to the NightSpire ransomware
🔎 Key Details:
👥 Threat Actor: NightSpire
📅 Reported on: 03/10/26
📦 Data Compromised: 7 GB
Forma Therapeutics, a USA-based Biotechnology Research company, has reportedly fallen victim to the NightSpire ransomware
🔎 Key Details:
👥 Threat Actor: NightSpire
📅 Reported on: 03/10/26
📦 Data Compromised: 7 GB
According to Ransomware.live, nightspire ransomware group has added Forma Therapeutics Holdings, Inc. (🇺🇸) to its victims.
October 3, 2026 at 1:33 AM
According to Ransomware.live, nightspire ransomware group has added Forma Therapeutics Holdings, Inc. (🇺🇸) to its victims.
🏴 NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, India, Taiwan, and Japan, using aggressive double-extortion with ransom deadlines as…
October 1, 2026 at 3:03 PM
🏴 NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, India, Taiwan, and Japan, using aggressive double-extortion with ransom deadlines as…
Nightspire Ransomware Targets French Pyrotechnics Firm CES Pyro - DeXpose www.dexpose.io/nightspire-r...
Nightspire Ransomware Targets French Pyrotechnics Firm CES Pyro - DeXpose
Nightspire ransomware attacks CES Pyro, targeting the French pyrotechnics industry with data threats.
www.dexpose.io
April 8, 2026 at 7:22 AM
Nightspire Ransomware Targets French Pyrotechnics Firm CES Pyro - DeXpose www.dexpose.io/nightspire-r...
New claim on the shame-site for #ransomware / #datatheft group #NightSpire.
Organization: Forma Therapeutics Holdings, Inc. / Novo Nordisk A/S
Location: #UnitedStates
Industry: #BiotechnologyResearch
Staff: 51-200 employees
Learn more: https://ecrime.ch/
Organization: Forma Therapeutics Holdings, Inc. / Novo Nordisk A/S
Location: #UnitedStates
Industry: #BiotechnologyResearch
Staff: 51-200 employees
Learn more: https://ecrime.ch/
October 3, 2026 at 5:45 AM
New claim on the shame-site for #ransomware / #datatheft group #NightSpire.
Organization: Forma Therapeutics Holdings, Inc. / Novo Nordisk A/S
Location: #UnitedStates
Industry: #BiotechnologyResearch
Staff: 51-200 employees
Learn more: https://ecrime.ch/
Organization: Forma Therapeutics Holdings, Inc. / Novo Nordisk A/S
Location: #UnitedStates
Industry: #BiotechnologyResearch
Staff: 51-200 employees
Learn more: https://ecrime.ch/
Ransomware Arrives, Prague Checks Its Calendar Before Existence
PANIC 67% | Lag 0.0h | Nightspire is claiming a ransomware attack against Forma Therapeutics Holdings, Inc., and GrayZone i
#AfterShockIndex
READ MORE
PANIC 67% | Lag 0.0h | Nightspire is claiming a ransomware attack against Forma Therapeutics Holdings, Inc., and GrayZone i
#AfterShockIndex
READ MORE
October 3, 2026 at 6:54 AM
Ransomware Arrives, Prague Checks Its Calendar Before Existence
PANIC 67% | Lag 0.0h | Nightspire is claiming a ransomware attack against Forma Therapeutics Holdings, Inc., and GrayZone i
#AfterShockIndex
READ MORE
PANIC 67% | Lag 0.0h | Nightspire is claiming a ransomware attack against Forma Therapeutics Holdings, Inc., and GrayZone i
#AfterShockIndex
READ MORE
🚨New ransom group blog post!🚨
Group name: nightspire
Post title: Papa John's Egypt
#ransomware #cti #threatintelligence #cybersecurity #infosec
Group name: nightspire
Post title: Papa John's Egypt
#ransomware #cti #threatintelligence #cybersecurity #infosec
May 24, 2026 at 5:05 PM
🚨New ransom group blog post!🚨
Group name: nightspire
Post title: Papa John's Egypt
#ransomware #cti #threatintelligence #cybersecurity #infosec
Group name: nightspire
Post title: Papa John's Egypt
#ransomware #cti #threatintelligence #cybersecurity #infosec
🚨 NightSpire Ransomware Alert 🚨
Sisnet Consultores 🇨🇷
📢 Sisnet Consultores (sisnet.co.cr), has fallen victim to NightSpire ransomware.
🔍 Key Details:
🛡 Threat Actor: NightSpire Ransomware
⚠ Compromised data: 30 GB
📅Published date : 27-04-2025
Sisnet Consultores 🇨🇷
📢 Sisnet Consultores (sisnet.co.cr), has fallen victim to NightSpire ransomware.
🔍 Key Details:
🛡 Threat Actor: NightSpire Ransomware
⚠ Compromised data: 30 GB
📅Published date : 27-04-2025
April 27, 2025 at 12:17 AM
🚨 NightSpire Ransomware Alert 🚨
Sisnet Consultores 🇨🇷
📢 Sisnet Consultores (sisnet.co.cr), has fallen victim to NightSpire ransomware.
🔍 Key Details:
🛡 Threat Actor: NightSpire Ransomware
⚠ Compromised data: 30 GB
📅Published date : 27-04-2025
Sisnet Consultores 🇨🇷
📢 Sisnet Consultores (sisnet.co.cr), has fallen victim to NightSpire ransomware.
🔍 Key Details:
🛡 Threat Actor: NightSpire Ransomware
⚠ Compromised data: 30 GB
📅Published date : 27-04-2025
🚨New Ransomware group: NightSpire
Link: http://nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd[.]onion/
Link: http://nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd[.]onion/
March 12, 2025 at 7:40 PM
🚨New Ransomware group: NightSpire
Link: http://nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd[.]onion/
Link: http://nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd[.]onion/
🏴 NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, India, Taiwan, and Japan, using aggressive double-extortion with ransom deadlines as…
October 3, 2026 at 3:00 AM
🏴 NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, India, Taiwan, and Japan, using aggressive double-extortion with ransom deadlines as…
Your local (EU) nightborne is looking to help you out with decor! Want a Nightspire Fountain or a Suramar Containment Cell? Send the crafting order to Menandres-Argent Dawn. Atm the prices for these are about 30k gold on the ah, so this way you can get them about 10 times cheaper with your mats!
December 8, 2025 at 1:28 PM
Your local (EU) nightborne is looking to help you out with decor! Want a Nightspire Fountain or a Suramar Containment Cell? Send the crafting order to Menandres-Argent Dawn. Atm the prices for these are about 30k gold on the ah, so this way you can get them about 10 times cheaper with your mats!
Decoding NightSpire: Ransomware IOCs Aren't Set in Stone | Huntress www.huntress.com/blog/nightsp...
Decoding NightSpire: Ransomware IOCs Aren't Set in Stone | Huntress
A recent incident linked to the NightSpire ransomware workflow gives insight into why the RaaS structure and model, or lack thereof, are important – especially when it comes to scoping and recovering ...
www.huntress.com
April 8, 2026 at 7:20 AM
Decoding NightSpire: Ransomware IOCs Aren't Set in Stone | Huntress www.huntress.com/blog/nightsp...
Feed: "HookPhish"
By: mdo on Thursday, January 22, 2026
By: mdo on Thursday, January 22, 2026
Ransomware Group nightspire Hits: Service Lane eAdvisor
Ransomware Group nightspire Hits: Service Lane eAdvisor. Enterprise cybersecurity solutions including phishing simulation, security training, and threat monitoring from HookPhish.
www.hookphish.com
January 22, 2026 at 4:42 PM
Feed: "HookPhish"
By: mdo on Thursday, January 22, 2026
By: mdo on Thursday, January 22, 2026
🚨 Ransomware Alert
NightSpire ransomware group has added 2 new victims to their darkweb portal
* Valentin Hotels & Resorts 🇪🇸
A family-owned hotel group, based in Spain, has fallen victim to NightSpire ransomware.
NB: The group claims to have obtained 700 GB of organization's data.
NightSpire ransomware group has added 2 new victims to their darkweb portal
* Valentin Hotels & Resorts 🇪🇸
A family-owned hotel group, based in Spain, has fallen victim to NightSpire ransomware.
NB: The group claims to have obtained 700 GB of organization's data.
May 20, 2025 at 11:00 PM
🚨 Ransomware Alert
NightSpire ransomware group has added 2 new victims to their darkweb portal
* Valentin Hotels & Resorts 🇪🇸
A family-owned hotel group, based in Spain, has fallen victim to NightSpire ransomware.
NB: The group claims to have obtained 700 GB of organization's data.
NightSpire ransomware group has added 2 new victims to their darkweb portal
* Valentin Hotels & Resorts 🇪🇸
A family-owned hotel group, based in Spain, has fallen victim to NightSpire ransomware.
NB: The group claims to have obtained 700 GB of organization's data.