Lamashtu
Lamashtu is a financially motivated data-theft and extortion group that emerged in mid-April 2026, operating a Tor-hosted leak site (Lamashtu[.]Blog) with countdown timers, structured Breach Impact Reports, and proof-of-life thumbnails to pressure victims. The group has claimed 17+ victims across France, Romania, Thailand, Malaysia, Egypt, and the UAE within its first weeks of activity, targeting energy, pharmaceutical, retail, hospitality, and film sectors, with confirmed exfiltration totaling 760+ GB.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
- Vins VialletOct 24, 2026
- Hecker HolzsystembauOct 22, 2026
- FuG-GruppeOct 22, 2026
- MECA-PRECISOct 22, 2026
- WEPOS ChemieOct 22, 2026
- VERGI MuensterOct 22, 2026
- Gräfliches Hofbrauhaus FreisingOct 22, 2026
A leak-site post is the group's claim, not confirmed by the victim.
Recent activity
- Sydney Design Firm Virtual Ideas Targeted in Lamashtu Ransomware Extortion Attack Sydney-based 3D visualization firm Virtual Ideas suffered a data theft attack mastodon · Oct 23, 2026
References
- https://redpiranha.net/news/threat-intelligence-report-april-21-april-27-2026
- https://www.ransomlook.io/group/lamashtu
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.