BRIEFRansomwarelowP43
Netrunner ransomware publishes a victim in Kuwait
Detected14 November 2026 · 02:13 UTC
The ransomware group 'netrunner' listed a new victim on its leak site with country attributed to Kuwait; the sector is not specified and the company name appears redacted. Although outside the Argentina/LatAm focus and lacking detail, a freshly published victim indicates an active extortion operation that defenders tracking the group should monitor. The limited metadata makes attribution to a specific organization difficult.
CategoryRansomware
Severitylow
Priority score43
Detected14 November 2026 · 02:13 UTC
RansomwarePriority 72
Ransomware Interlock publica a K&A Industries, proveedor de credenciales PIV del gobierno de EE. UU.Interlock ransomware listed K&A Industries, a US firm that manages authentication lifecycles and issues PIV credentials to government agencies such as Los Alamos National Laboratory. The group claims to have stolen biometric templates, personal data and government contract data, exposing a supply-chain risk for federal identity systems. Government clients should assume credential exposure and verify the integrity of issued PIV certificates.RansomwarePriority 56
El grupo ransomware Panzer publica datos de RE/MAX AlemaniaThe Panzer group listed RE/MAX Germany on ransomware.live with 86GB of internal data, including broker and customer purchase records, invoices, passwords and Outlook archives. Exposed remax.de staff addresses raise targeted phishing and business-email-compromise risk. The victim is German, so it is sector context rather than a Latin American alert.RansomwarePriority 50
Ransomware Play publica a la australiana ARRB GroupThe Play ransomware group has listed ARRB Group, an Australian road and transport research organisation tied to the government and defense sector, on its leak site. Play typically exfiltrates data before encrypting, so sensitive project and partner data may be at risk. Public-sector suppliers should watch for downstream exposure.RansomwarePriority 62
Ransomware WallStreet publica a la farmacéutica estadounidense WalgreensThe WallStreet ransomware group has listed Walgreen Co., the large US pharmacy and retail chain, on its leak site. Though outside Latin America, a breach of a major pharmacy operator can expose patient health data and disrupt prescription services. Defenders in healthcare and retail should treat this as a credible data-exposure and supply-chain signal.RansomwarePriority 42
Ransomware Dark Project publica a la gestora de comunidades CCMCThe ransomware group 'Dark Project' has published The CCMC, a US/Canada community (HOA) management firm, on its leak site via ransomware.live. Victim organizations of this type hold resident financial and personal data that attackers commonly exfiltrate before encryption. The publication is fresh but outside Latin America, so it is lower priority for regional defenders.RansomwarePriority 44
El ransomware Akira publica al contratista estadounidense Paragon MechanicalAkira listed Paragon Mechanical, a US HVAC and mechanical contractor, and warns it will leak 37GB of data including employee passports and medical information. Such personal data creates fraud and privacy exposure for staff. It is a fresh intrusion relevant to contractors handling sensitive HR records.