BRIEFRansomwarelowP45
Umbra ransomware publishes South African miner Tharisa
Tharisa
Detected7 October 2026 · 09:07 UTC
The umbra ransomware group listed Tharisa, a Cyprus-based platinum-group-metals and chrome mining group with major operations in South Africa, as a victim. Mining is critical infrastructure, so a ransomware intrusion on corporate and operational systems can disrupt production and downstream supply chains. It is outside Latin America, but shows continuing targeting of extractive-industry operators.
CategoryRansomware
Severitylow
Priority score45
Detected7 October 2026 · 09:07 UTC
Ransomware● 48
Ransomware n0n expone datos del MSP estadounidense ChibitekThe n0n group published US managed service provider Chibitek, leaking client financial records, network credentials and internal documents. MSP compromises cascade to downstream customers, amplifying the blast radius. A fresh, named supply-chain leak relevant to risk monitoring even outside the region.Ransomware● 50
Aviso de extorsión a la bangladesí Pathao LimitedA threat actor posted a 'notice' to Pathao Limited, a major Bangladeshi delivery and ride-hailing firm, signalling a data-leak extortion attempt. Fresh extortion posts often precede public leaks or ransomware activity, so they are worth tracking for confirmation and TTPs.Ransomware● 55
Ransomware Termite publica a la aseguradora estadounidense AonThe Termite ransomware group posted Aon plc, a global insurance and risk-management broker, to its leak site. Aon handles large volumes of sensitive client risk, financial and HR data, so any exfiltration is significant for downstream corporate and public-sector clients. There is no regional-specific angle, but the victim's scale and data sensitivity make it worth monitoring.Ransomware● 70
Ransomware Qilin publica a la ingeniería española EPTISAThe Qilin ransomware group listed Spanish engineering and infrastructure consultancy EPTISA as a victim on its leak site. EPTISA works on water, transport and public-sector infrastructure projects across Spain and Latin America, so stolen engineering data and credentials could expose government clients. Defenders should treat this as a regional critical-infrastructure supply-chain risk.Ransomware● 40
Andersen Group publicada como víctima de ransomware por SilentRansomGroupThe SilentRansomGroup has listed Andersen Group, a professional-services firm, as a ransomware victim. The victim's country is unconfirmed, so regional relevance is unclear. If the company has LATAM or Argentine operations, this is a fresh extortion event worth tracking.Ransomware● 52
Ransomware Umbra publica a la universidad egipcia BTUThe Umbra ransomware group listed Beni Suef Technological University (BTU), Egypt's first technological university with programs in ICT, renewable energy and railway technology, on its leak site. This implies compromise of academic systems and theft of student and research data, with extortion underway. It matters as a fresh ransomware publication against an education institution, though outside the Latin America region.