kyber.today

daily cyber × ai intelligence

← threat actors

threat actor · not yet in the cluster map

play

also tracked as the gentlemen 1, qilin 1, ralord 1, redact 1, safepay 1, settra 1

3 stories · 2 in the wild · June 29, 2026 – July 24, 2026

evidence: 2 observed · 1 claimed

sectors

  • retail 2 · Jul 24
  • healthcare 1 · Jul 24
  • technology 1 · Jul 24

geography

  • austria 1 · Jul 24
  • spain 1 · Jul 24
  • usa 1 · Jul 24
  • sweden 1 · Jul 17
  • germany 1 · Jun 29
  • united states 1 · Jun 29

malware and tools

  • play 1 · Jul 17

techniques

  • ransomware 1 · Jul 17

attack phases seen

  • Impact 3 · Jul 24

what we reported, newest first, grouped by story

Jun 17 – July 24, 2026

  • Ransomware roundup: The Gentlemen listed 31 victims including a Vienna IVF clinic (Wunschkind Klinik Dr. Brunbauer) and US biotech MatTek (DarkWebInformer); PLAY claimed Restaurant Depot and Spanish rental firm Record Go (DarkWebInformer). · Jul 24 · observed · as the gentlemen · Threat Activity

June 29, 2026

  • Ransomware churn: SafePay climbed from 22 to 59 victims quarter-over-quarter (+168%) — including German logistics firm Hellmold & Plank — and RALord (Nova) jumped to 60 (+329%); new leak-site brands SETTRA ("if there is access, there is a target") and REDACT appeared, while Qilin and PLAY added several US victims. (Ido Cohen, Dark Web Informer) · Jun 29 · observed · as safepay, ralord, settra, redact, qilin · Threat Activity