nightspire
Known ransomware group ACTIVE Currently active
NightSpire is a ransomware-as-a-service operation that appeared in 2025, conducting double-extortion attacks across manufacturing, healthcare, and professional-services sectors and publishing victims on a dark-web leak site.
8
Total Claims
4
Critical
—
Records Claimed
6
Industries Hit
Active span: May 14, 2026 – Oct 3, 2026 · 8 organizations targeted
Currently active
Actor Threat Profile
Activity Timeline
Peak: May 2026 (3)May 2026
LessMore
Oct 2026Share this profile
Top Targeted Industries
Education 2
Healthcare 2
Energy & Utilities 1
Manufacturing 1
Financial Services 1
Energy 1
Tradecraft & Infrastructure
0
Documented tools
13 / 35
MITRE tactics / techniques
6
Known leak sites
Targeted Organizations
Claims by nightspire
Low
Ransomware Claim: S*o**n* Public Schools
S*o**n* Public Schools
nightspire
Ransomware Education
Oct 15, 2026 Low
Ransomware Claim: Colorado Texas
Colorado Texas
nightspire
Ransomware Energy & Utilities
Oct 14, 2026 Low
Ransomware Claim: Mäntelhaus Kaiser GmbH & Co. KG
Mäntelhaus Kaiser GmbH & Co. KG
nightspire
Ransomware Manufacturing
Oct 9, 2026 Critical
Ransomware Claim: Forma Therapeutics Holdings, Inc.
Forma Therapeutics Holdings, Inc.
nightspire
Ransomware Healthcare
Oct 4, 2026 Low
Ransomware Claim: Spo**** Schools
Spo**** Schools
nightspire
Ransomware Education
Sep 22, 2026 Critical
Ransomware Claim: la familia adualt day center
la familia adualt day center
nightspire
Ransomware Healthcare
May 25, 2026 Critical
Ransomware Claim: Rawaj Consumer Finance
Rawaj Consumer Finance
nightspire
Ransomware Financial Services
May 25, 2026 Critical
Ransomware Claim: Vantage Energy LLC
Vantage Energy LLC
nightspire
Ransomware Energy
May 19, 2026