Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Lamashtu

Active
World map Statistics
Lamashtu is an extortion group that first appeared in April 2026, claiming attacks against organizations in France, Romania, and Thailand across energy, pharmaceutical, and film sectors; it has not yet been confirmed as operating actual file-encrypting ransomware rather than pure data-theft extortion.
Victims
54
none this month
Rank
#103 / 388
#45 over the last 12 months
First victim
2026-04-11
estimated attack date
Last victim
2026-10-24
22 days ago
Attack → claim
2 d
average delay
Countries
18
hit
Infostealer
35.2%
of victims with a domain
Leak-site uptime
46.0% average, 30 days

Victims per month

By estimated attack date when known, otherwise by discovery date.

Top sectors

  • Manufacturing 16 · 30%
  • Retail & E-Commerce 5 · 9%
  • Agriculture and Food Production 5 · 9%
  • Other 5 · 9%
  • Professional Services 5 · 9%
  • Energy & Utilities 4 · 7%
  • Transportation 4 · 7%
  • Healthcare 3 · 6%
  • Technology 3 · 6%
  • Hospitality 3 · 6%

Top countries

What ransomware.live knows about lamashtu