NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, India, Taiwan, and Japan, using aggressive double-extortion with ransom deadlines as short as two days. Known victims: 260 11 negotiation log(s) available, 3 ransom note(s) on file
Objectives
Executive Summary
NightSpire is a medium-sophistication ransomware group that has rapidly claimed over 250 victims across multiple sectors in several countries. The group uses aggressive double-extortion tactics with short ransom deadlines, posing a significant threat to organizational security. Their primary motivation is financial gain, and they have been active since February 2025.
Goals & Targeting
NightSpire's strategic objectives are focused on achieving financial gain through ransomware attacks, targeting various sectors and countries. They typically attack organizations that they believe will pay the ransom, and their aggressive double-extortion tactics are designed to increase the pressure on the victims to pay. The group's targeting profile suggests that they are opportunistic and will attack any organization that they believe will yield a significant financial return, regardless of the sector or country.
Enhanced Description
The NightSpire group's activities have significant implications for organizational security, as their tactics can cause significant disruption to business operations and result in substantial financial losses. The group's ability to adapt and evolve their tactics to evade detection and stay ahead of their victims' defenses is a major concern, and organizations must be proactive in implementing robust security measures to protect themselves against such threats.
Key Capabilities
MITRE ATT&CK Tactics
ATT&CK Techniques
Software / Tooling
Campaigns & Victims
NightSpire's campaign patterns suggest that they are highly organized and efficient, with the ability to rapidly claim a large number of victims. Their operational tempo is high, with short ransom deadlines and aggressive double-extortion tactics. The group's victim types include organizations across multiple sectors, and they have been involved in several notable past operations, including large-scale ransomware attacks on manufacturing and healthcare organizations.
IOC Patterns
Recommended Actions
Suggested Tags
Confidence Assessment
The confidence level in the available data is medium, as there is limited information available on the group's inner workings and motivations. However, the data that is available suggests that NightSpire is a highly sophisticated and organized group, and their tactics and techniques are well-documented. Further research and analysis are needed to fully understand the group's capabilities and intentions.
No techniques linked yet.
No tools linked yet.
nightspire: T***w**x
Ransomware attack attributed to nightspire. | Sector: Not Found | Data is not available now. | Source: https://www.ransomware.live/id/VCoqKncqKnhAbmlnaHRzcGlyZQ==
Aug 5, 2026
TLP:CLEARnightspire: G**** R****l*e
Ransomware attack attributed to nightspire. | Sector: Not Found | Data is not available now. | Source: https://www.ransomware.live/id/RyoqKiogUioqKipsKmVAbmlnaHRzcGlyZQ==
Jun 13, 2026
TLP:CLEARnightspire: A*** G*** A*S*
Ransomware attack attributed to nightspire. | Sector: Not Found | Data is not available now. | Source: https://www.ransomware.live/id/QSoqKiBHKioqIEEqUypAbmlnaHRzcGlyZQ==
Jun 7, 2026
TLP:CLEARnightspire: basatamfi
Ransomware attack attributed to nightspire. | Country: EG | Sector: Not Found | Data is not available now. | Source: https://www.ransomware.live/id/YmFzYXRhbWZpQG5pZ2h0c3BpcmU=
May 25, 2026
TLP:CLEARnightspire: Pattono S.r.l
Ransomware attack attributed to nightspire. | Country: IT | Sector: Business Services | [AI generated] N/A | Source: https://www.ransomware.live/id/UGF0dG9ubyBTLnIubEBuaWdodHNwaXJl
May 22, 2026
TLP:CLEARnightspire: Pat**** S.r.l
Ransomware attack attributed to nightspire. | Sector: Not Found | Data is not available now. | Source: https://www.ransomware.live/id/UGF0KioqKiBTLnIubEBuaWdodHNwaXJl
May 22, 2026
TLP:CLEARnightspire: Qua****Pro
Ransomware attack attributed to nightspire. | Sector: Not Found | Data is not available now. | Source: https://www.ransomware.live/id/UXVhKioqKlByb0BuaWdodHNwaXJl
May 18, 2026
TLP:CLEARnightspire: m***o*ul
Ransomware attack attributed to nightspire. | Sector: Not Found | Data is not available now. | Source: https://www.ransomware.live/id/bSoqKm8qdWxAbmlnaHRzcGlyZQ==
May 18, 2026
TLP:CLEARnightspire: C***r*o T**uc**n*
Ransomware attack attributed to nightspire. | Sector: Not Found | Data is not available now. | Source: https://www.ransomware.live/id/QyoqKnIqbyBUKip1YyoqbipAbmlnaHRzcGlyZQ==
May 18, 2026
TLP:CLEARnightspire: J**es **l*o
Ransomware attack attributed to nightspire. | Sector: Consumer Services | Data is not available now. | Source: https://www.ransomware.live/id/SioqZXMgKipsKm9AbmlnaHRzcGlyZQ==
Apr 27, 2026
TLP:CLEARnightspire: *W* **L LLC
Ransomware attack attributed to nightspire. | Sector: Not Found | Data is not available now. | Source: https://www.ransomware.live/id/KlcqICoqTCBMTENAbmlnaHRzcGlyZQ==
Apr 7, 2026
TLP:CLEARnightspire: S***a V**a***s
Ransomware attack attributed to nightspire. | Sector: Not Found | Data is not available now. | Source: https://www.ransomware.live/id/UyoqKmEgVioqYSoqKnNAbmlnaHRzcGlyZQ==
Apr 3, 2026
TLP:CLEARnightspire: P**S****E
Ransomware attack attributed to nightspire. | Sector: Not Found | Data is not available now. | Source: https://www.ransomware.live/id/UCoqUyoqKipFQG5pZ2h0c3BpcmU=
Mar 31, 2026
TLP:CLEARnightspire: T*** Defense
Ransomware attack attributed to nightspire. | Sector: Manufacturing | Data is not available now. | Source: https://www.ransomware.live/id/VCoqKiBEZWZlbnNlQG5pZ2h0c3BpcmU=
Mar 30, 2026
TLP:CLEARnightspire: D**o*s** Fr**e* *A
Ransomware attack attributed to nightspire. | Sector: Not Found | Data is not available now. | Source: https://www.ransomware.live/id/RCoqbypzKiogRnIqKmUqICpBQG5pZ2h0c3BpcmU=
Mar 29, 2026
TLP:CLEARnightspire: *H* G** **O**
Ransomware attack attributed to nightspire. | Sector: Not Found | Data is not available now. | Source: https://www.ransomware.live/id/KkgqIEcqKiAqKk8qKkBuaWdodHNwaXJl
Mar 28, 2026
TLP:CLEARnightspire: *h**i **o**e**
Ransomware attack attributed to nightspire. | Sector: Not Found | Data is not available now. | Source: https://www.ransomware.live/id/KmgqKmkgKipvKiplKipAbmlnaHRzcGlyZQ==
Mar 28, 2026
TLP:CLEARnightspire: J***T*P, **C
Ransomware attack attributed to nightspire. | Sector: Not Found | Data is not available now. | Source: https://www.ransomware.live/id/SioqKlQqUCwgKipDQG5pZ2h0c3BpcmU=
Mar 25, 2026
TLP:CLEARnightspire: O**e*
Ransomware attack attributed to nightspire. | Sector: Not Found | Data is not available now. | Source: https://www.ransomware.live/id/TyoqZSpAbmlnaHRzcGlyZQ==
Mar 21, 2026
TLP:CLEARnightspire: G* *r**n*e
Ransomware attack attributed to nightspire. | Sector: Not Found | Data is not available now. | Source: https://www.ransomware.live/id/RyogKnIqKm4qZUBuaWdodHNwaXJl
Mar 16, 2026
TLP:CLEARnightspire: G* *r**c*
Ransomware attack attributed to nightspire. | Sector: Not Found | Data is not available now. | Source: https://www.ransomware.live/id/RyogKnIqKmMqQG5pZ2h0c3BpcmU=
Mar 13, 2026
TLP:CLEARnightspire: S** *A* ***E* **T*L
Ransomware attack attributed to nightspire. | Sector: Not Found | Data is not available now. | Source: https://www.ransomware.live/id/UyoqICpBKiAqKipFKiAqKlQqTEBuaWdodHNwaXJl
Mar 13, 2026
TLP:CLEARnightspire: I**M**
Ransomware attack attributed to nightspire. | Sector: Technology | Data is not available now. | Source: https://www.ransomware.live/id/SSoqTSoqQG5pZ2h0c3BpcmU=
Mar 12, 2026
TLP:CLEARnightspire: E-Fci
Ransomware attack attributed to nightspire. | Country: US | Sector: Not Found | Data is not available now. | Source: https://www.ransomware.live/id/RS1GY2lAbmlnaHRzcGlyZQ==
Mar 1, 2026
TLP:CLEARNo observed data linked yet.
No references recorded yet.
0
Techniques
0
Tools
168
Campaigns
6
IOCs
0
Observed Data
0
Tactics