// THREAT ACTOR
NIGHTSPIRE_
ActiveNightSpire is a ransomware operation that emerged in 2024, running a public data-leak site to pressure victims under the double-extortion model. The group claims victims across multiple sectors and continues to add fresh listings on a regular cadence.
For Ransomnews editorial coverage of NIGHTSPIRE — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
Victims by year
- 2026 241
- 2025 139
Leak site mirrors
8 mirrors tracked, 1 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd.onionNightSpire snapshot · 2025-04-27 12:14 -
nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd.onionNightSpire snapshot · 2025-04-27 16:15 -
a2lyiiaq4n74tlgz4fk3ft4akolapfrzk772dk24iq32cznjsmzpanqd.onionNightSpire snapshot · 2026-08-19 20:27 -
nspiremkiq44zcxjbgvab4mdedyh2pzj5kzbmvftcugq3mczx3dqogid.onionRaaS Service Started | NightSpire snapshot · 2026-01-29 15:10 -
nspirebcv4sy3yydtaercuut34hwc4fsxqqv4b4ye4xmo6qp3vxhulqd.onionRaaS Service Started | NightSpire snapshot · 2026-01-29 15:03 -
nspirebcv4sy3yydtaercuut34hwc4fsxqqv4b4ye4xmo6qp3vxhulqd.onionDatabase | NightSpire snapshot · 2026-01-29 15:19 -
nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onionRaaS Service Started snapshot · 2026-08-19 19:29 -
p3reixfwlpjtein4yta3kiwyijxdktypcipz6jjq4wgbyi73e3fsmeyd.onionLogin - File Browser snapshot · 2026-07-09 12:37
Recent victims
The 50 most recent victims claimed by NIGHTSPIRE. Total in the index: 380.
| Date listed | Victim | Description |
|---|---|---|
| 2026-08-19 | Vi***** Pe****** C***, Inc | |
| 2026-08-18 | T****w**x | |
| 2026-08-13 | eas**** | |
| 2026-08-12 | Tianji Auto Care Service Company | |
| 2026-08-07 | T***w**x | |
| 2026-07-27 | The Mountain | |
| 2026-07-27 | Kates Nussman Ellis Earle & Landolfi LLP | |
| 2026-07-27 | Akribis Systems Pte Ltd | |
| 2026-07-27 | Thai Seng International Co. Ltd | |
| 2026-07-27 | MKS Transformator | |
| 2026-07-27 | OPTIDEA GmbH | |
| 2026-07-27 | Furama Bukit Bintang | |
| 2026-07-27 | K. Venkatesh, Co | |
| 2026-07-27 | Wings Argo Private Limited | |
| 2026-07-27 | KSL Dirtworks LLC | |
| 2026-07-27 | Diffusion de Produits Inoxydables | |
| 2026-07-27 | TFG Benefits, Inc. | |
| 2026-07-23 | Auto Royal Company | |
| 2026-07-14 | Cedar Crest College | |
| 2026-07-13 | Webosphere | |
| 2026-07-08 | PCCC Realty LLC | |
| 2026-06-25 | Grupo Riquelme | |
| 2026-06-21 | Artistic Smiles | |
| 2026-06-18 | legendsmn(Blue Ox, Paul Bunyan, Lumberjack Electric) | |
| 2026-06-18 | dean cosmetic dentistry | |
| 2026-06-16 | Central Texas ***** ***** | |
| 2026-06-16 | Ri***** Co**** Europe S.r.l. | |
| 2026-06-16 | Guy E******* & F*******, P.A | |
| 2026-06-15 | B****S I******t***l | |
| 2026-06-15 | Sheraton Miramar Resort El Gouna | |
| 2026-06-15 | G**** R****l*e | |
| 2026-06-14 | Silsbee Police Department | |
| 2026-06-14 | K****** County. Mi**e**ta | |
| 2026-06-14 | WaxWorks Inc | |
| 2026-06-14 | Blue Nile Medical Center | |
| 2026-06-12 | Pattono S.r.l | |
| 2026-06-12 | Sierra West Jewelers | |
| 2026-06-08 | GRIP Outreach For Youth | |
| 2026-06-08 | Unique Litho, Inc | |
| 2026-06-08 | A*** G*** A*S* | |
| 2026-06-08 | ASIA STRATEGIC | |
| 2026-06-05 | First Mutual Holdings | |
| 2026-06-05 | Krum Public Library | |
| 2026-05-26 | basatamfi | |
| 2026-05-24 | Bresme Madrid S.L. | |
| 2026-05-24 | Papa John's Egypt | |
| 2026-05-24 | Red-Line | |
| 2026-05-24 | Qua****Pro | |
| 2026-05-24 | la familia adualt day center | |
| 2026-05-24 | Pat**** S.r.l |
// CONFIRMED ATTACKS
NightSpire confirmed attacks: 15 verified incidents
Ransomnews has verified 15 NightSpire incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from March 2025 to July 2026. United States accounts for 4 of them (27%), with victims recorded in 9 countries in total. The most affected sector is government, at 6 confirmed victims. Where a figure was disclosed (3 cases), these incidents account for 39,768 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified NightSpire incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| July 2026 | Cedar Crest College | Education | Pennsylvania, United States | — | Unknown | Source |
| June 2026 | Auto Royal Company | Retail | Rome, Italy | — | Unknown | Source |
| May 2026 | Krum Public Library | Government | Texas, United States | — | Unknown | Source |
| January 2026 | Makimura Co., Ltd. | Manufacturing | Osaka, Japan | — | Unknown | Source |
| December 2025 | International Door, Inc. | Manufacturing | Michigan, United States | 268 | Unknown | Source |
| December 2025 | Center of Association Management, Inc. (CAMI) | Service | Massachusetts, United States | 1,000 | Unknown | Source |
| November 2025 | Balkrishna Paper Mills Limited | Manufacturing | Mumbai, India | — | Unknown | Source |
| November 2025 | Eastern Cape Department of Human Settlements | Government | Chiselhurst, South Africa | — | Unknown | Source |
| June 2025 | Ingonyama Trust Board | Government | Pietermaritzburg, South Africa | — | Unknown | Source |
| April 2025 | Commune d'Ardon | Government | Ardon, France | — | Unknown | Source |
| April 2025 | ChangShen Hospital | Healthcare | Taoyuan City, Taiwan | — | Unknown | Source |
| April 2025 | Nippon Ceramic Co., Ltd. | Manufacturing | Tottori, Japan | 38,500 | Unknown | Source |
| March 2025 | Powiatowy Urząd Pracy w Żorach (District Labor Office in Żorach) | Government | Żorach, Poland | — | Unknown | Source |
| March 2025 | Secretaría de Educación de Veracruz | Government | Xalapa, Mexico | — | Unknown | Source |
| March 2025 | Tanaka Electronics Taiwan Co. Ltd. | Manufacturing | Taoyuan City, Taiwan | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from NightSpire's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design — most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.