qilin
HIGH22
Victims disclosed (120d)
99 total Canada victims
Manufacturing, Transportation/Logistics, Energy
Latest disclosure • Jun 5, 2026
Live Intelligence
Ransomware Tracker
Fresh intelligence sourced from ransomware.live, prioritising Canadian disclosures and extortion campaigns.
Last refresh: Jul 7, 2026 • Serving last successful capture while upstream recovers
Canadian Threat Pulse
🇨🇦 Live ransomware intelligence feed.
Powered by ransomware.live Pro. We prioritise Ontario, GTA, British Columbia, and Quebec victims to drive rapid outreach across our Canadian client base.
Last refresh
Jul 7, 2026
Cached snapshot displayed
Canada
Canadian victim disclosures and exposure indicators
Ransomware IOC
112
Victims disclosed in latest 120-day snapshot
−26% 120dCloud Drift
1
Misconfiguration paths blocked this week
+100% WoWIdentity Attacks
1
Credential-stuffing bursts contained
−67% WoWdragonforce
ELEVATED11
Victims disclosed (120d)
20 total Canada victims
Technology, Construction, Consumer Services
Latest disclosure • May 27, 2026
play
ELEVATED11
Victims disclosed (120d)
100 total Canada victims
Manufacturing, Technology, Construction
Latest disclosure • May 11, 2026
akira
ELEVATED9
Victims disclosed (120d)
85 total Canada victims
Business Services, Consumer Services, Manufacturing
Latest disclosure • Apr 20, 2026
thegentlemen
ELEVATED8
Victims disclosed (120d)
11 total Canada victims
Manufacturing, Healthcare, Technology
Latest disclosure • Jun 1, 2026
United States
U.S. victim disclosures and exposure indicators
Ransomware IOC
76
Victims disclosed in latest 120-day snapshot
−37% 120dCloud Drift
0
Misconfiguration paths blocked this week
0% WoWIdentity Attacks
7
Credential-stuffing bursts contained
+100% WoWqilin
ELEVATED12
Victims disclosed (120d)
22 total USA victims
Healthcare, Manufacturing, Public Sector
Latest disclosure • Jun 8, 2026
thegentlemen
ELEVATED9
Victims disclosed (120d)
10 total USA victims
Healthcare, Not Found, Financial Services
Latest disclosure • Jun 8, 2026
incransom
ELEVATED6
Victims disclosed (120d)
17 total USA victims
Business Services, Construction, Public Sector
Latest disclosure • Jun 6, 2026
akira
ELEVATED6
Victims disclosed (120d)
16 total USA victims
Business Services, Consumer Services, Transportation/Logistics
Latest disclosure • Jun 5, 2026
play
ELEVATED4
Victims disclosed (120d)
10 total USA victims
Agriculture and Food Production, Business Services, Not Found
Latest disclosure • Jun 4, 2026
Canadian victims
112
Canadian disclosures in the past 30 days.
Global spotlight
2338
Victims tracked worldwide in the rolling archive.
Active crews
25
Top 20 ransomware crews ranked by victim disclosures in this archive.
worldleaks: 38 logged
North America Heat Map
Canada, the United States, and Mexico weighted by confirmed disclosures across the rolling ransomware archive.
Global Extortion Surface
Victim geography & supply-chain exposure
Hover bubbles for detail
Regional Spotlight
Ontario, GTA, British Columbia, and Quebec accounts comprise the majority of Canadian disclosures today. We surface the most recent activity in each market.
GTA and Ottawa focus
Ontario
- Ontario Home Builders' AssociationqilinJun 5, 2026
- compactmould.comsafepayJun 1, 2026
- squamish.netBrainCipherJun 1, 2026
- FibrenoirethegentlemenJun 1, 2026
- ksmart.cadragonforceMay 27, 2026
- ennsco.cadragonforceMay 25, 2026
Toronto metro
GTA
- SymcoreverestMay 2, 2026
- mattandsteve.comsafepayMar 17, 2026
- STRATEGICOBJECTIVES.COMclopFeb 7, 2026
Lower Mainland & Island
British Columbia
- No recent disclosures
Montréal & provincial
Quebec
- No recent disclosures
Most Active Ransomware Crews (90 days)
TAG momentum report
Most active crews observed by TAG over the last quarter with last-seen timestamps.
- TAG
01. worldleaks
38 victims logged · Last seen Jun 9, 2026
- TAG
02. nova
35 victims logged · Last seen Jun 9, 2026
- TAG
03. akira
300 victims logged · Last seen Jun 9, 2026
- TAG
04. qilin
539 victims logged · Last seen Jun 8, 2026
- TAG
05. thegentlemen
90 victims logged · Last seen Jun 8, 2026
- TAG
06. nightspire
50 victims logged · Last seen Jun 7, 2026
- TAG
07. play
181 victims logged · Last seen Jun 6, 2026
- TAG
08. incransom
172 victims logged · Last seen Jun 6, 2026
- TAG
09. coinbasecartel
50 victims logged · Last seen Jun 5, 2026
- TAG
10. dragonforce
82 victims logged · Last seen Jun 5, 2026
- TAG
11. anubis
31 victims logged · Last seen Jun 5, 2026
- TAG
12. genesis
30 victims logged · Last seen Jun 5, 2026
Global exposure
Country distribution for victims captured within the combined archive.
Global Extortion Surface
Victim geography & supply-chain exposure
Hover bubbles for detail
| Rank | Country/Region | Victims |
|---|---|---|
| 1 | United States | 6,134 |
| 2 | Canada | 1,050 |
| 3 | Mexico | 168 |
| 4 | United Kingdom | 27 |
| 5 | Germany | 22 |
| 6 | Australia | 20 |
| 7 | India | 16 |
| 8 | France | 15 |
| 9 | Japan | 13 |
| 10 | Italy | 11 |
| 11 | Brazil | 11 |
| 12 | Switzerland | 10 |
Intelligence headlines
Curated advisories surfaced alongside ransomware activity.
- Open source · cyber.gc.ca ↗CCCS warns of increased ransomware targeting Canadian municipalitiesJan 15, 2025
Canadian Centre for Cyber Security
The Cyber Centre observed coordinated credential-stuffing attempts preceding LockBit compromises in Ontario.
- Open source · ransomware.live ↗Healthcare sector sees spike in extortion incidentsJan 12, 2025
Ransomware.live
Ransomware.live telemetry shows healthcare victim listings rising 18% week-over-week.
Five-Year Canadian Threat Trend
Comparative look at ransomware disclosures versus phishing, smishing, vishing, and business email compromise (BEC) reports across Canada.
Next data feeds
Broaden coverage with phishing, vulnerability, and IoC sources wired into the backend.
Phishing & Malware
Canadian Centre for Cyber Security Advisories
Official bulletins covering critical vulnerabilities, phishing campaigns, and ransomware guidance tailored to Canadian operators.
/api/threats/cyber-centreDocumentation ↗Vulnerability Intelligence
CISA Known Exploited Vulnerabilities (KEV)
Authoritative catalogue of vulnerabilities actively exploited in the wild with remediation deadlines to drive patch prioritisation.
/api/threats/kevDocumentation ↗IoC Feeds
Abuse.ch ThreatFox
Community-driven repository of fresh indicators of compromise spanning malware, C2 infrastructure, and phishing kits.
/api/threats/threatfoxDocumentation ↗Phishing Intelligence
OpenPhish Commercial API
Continuously updated feed of verified phishing URLs suitable for mail and web gateway enforcement.
/api/threats/phishingDocumentation ↗Malware & Botnet Activity
Shadowserver Daily Reports
Global sensor telemetry on malware callbacks, exposed services, and botnet drones to support containment playbooks.
/api/threats/shadowserverDocumentation ↗
Live Ransomware Disclosures
Tracking leagues sourced from ransomware.live and Solutioners telemetry.
| Threat Group | Victim | Date Published |
|---|---|---|
| worldleaks | M1xchange | Jun 9, 2026 |
| worldleaks | Apollo Pipes | Jun 9, 2026 |
| worldleaks | GDL Transport | Jun 9, 2026 |
| chaos | airespring.com | Jun 9, 2026 |
| nova | Trevi | Jun 9, 2026 |
| gunra | Cambridge Law Chambers | Jun 9, 2026 |
| akira | Spray Equipment & Service Center | Jun 9, 2026 |
| akira | Rockaway River Country Club | Jun 9, 2026 |
| akira | SMPC Architects | Jun 9, 2026 |
| akira | Centre Ellipse | Jun 9, 2026 |
| stormous | katholiekamersfoort.nl UPDATE-FOR SALE | Jun 9, 2026 |
| stormous | sa2000.com UPDATE-FULL DATA DUMP | Jun 9, 2026 |
| qilin | The Banyans Health and Wellness | Jun 8, 2026 |
| termite | Roland Machinery | Jun 8, 2026 |
| qilin | Kinetic Education | Jun 8, 2026 |
| qilin | SatCom CX | Jun 8, 2026 |
| qilin | Isuzu Motors | Jun 8, 2026 |
| qilin | Opera Comique | Jun 8, 2026 |
| qilin | Shipping Association of NY and NJ | Jun 8, 2026 |
| morpheus | 3I INFOTECH | Jun 8, 2026 |
| thegentlemen | WCM Remedium | Jun 8, 2026 |
| thegentlemen | Danzo Group | Jun 8, 2026 |
| thegentlemen | Goldlion | Jun 8, 2026 |
| thegentlemen | Yao Yuan Technology | Jun 8, 2026 |
| thegentlemen | Integrated Distribution | Jun 8, 2026 |
| thegentlemen | The Clinic | Jun 8, 2026 |
| thegentlemen | FESCO Adecco | Jun 8, 2026 |
| thegentlemen | Trigon America | Jun 8, 2026 |
| thegentlemen | Jyharn Electronic | Jun 8, 2026 |
| thegentlemen | Empty | Jun 8, 2026 |
| thegentlemen | Institucion Cervantes | Jun 8, 2026 |
| thegentlemen | Tress | Jun 8, 2026 |
| thegentlemen | Metroply | Jun 8, 2026 |
| thegentlemen | Central Arkansas Pediatrics | Jun 8, 2026 |
| thegentlemen | IP Rings | Jun 8, 2026 |
| payload | Plaza Lama | Jun 8, 2026 |
| payload | Hansoll Textile in Vietnam | Jun 8, 2026 |
| payload | Villea Hotels in AttanaHotels | Jun 8, 2026 |
| akira | HRC Sicherheitsdienste | Jun 8, 2026 |
| nightspire | A*** G*** A*S* | Jun 7, 2026 |