Close Menu
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
  • About Us
Facebook X (Twitter) Instagram Threads
Ransomnews
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
  • About Us
Facebook X (Twitter) LinkedIn
Ransomnews

NIGHTSPIRE · Threat actor profile

// THREAT ACTOR

NIGHTSPIRE_

Active

NightSpire is a ransomware operation that emerged in 2024, running a public data-leak site to pressure victims under the double-extortion model. The group claims victims across multiple sectors and continues to add fresh listings on a regular cadence.

For Ransomnews editorial coverage of NIGHTSPIRE — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.

375 Victims tracked
1 / 8 Active mirrors
2025-03-12 First listing
2026-07-27 Most recent

Victims by year

  • 2026 236
  • 2025 139

Leak site mirrors

8 mirrors tracked, 1 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.

  • nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd.onion NightSpire snapshot · 2025-04-27 12:14
  • nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd.onion NightSpire snapshot · 2025-04-27 16:15
  • a2lyiiaq4n74tlgz4fk3ft4akolapfrzk772dk24iq32cznjsmzpanqd.onion NightSpire snapshot · 2026-08-06 21:09
  • nspiremkiq44zcxjbgvab4mdedyh2pzj5kzbmvftcugq3mczx3dqogid.onion RaaS Service Started | NightSpire snapshot · 2026-01-29 15:10
  • nspirebcv4sy3yydtaercuut34hwc4fsxqqv4b4ye4xmo6qp3vxhulqd.onion RaaS Service Started | NightSpire snapshot · 2026-01-29 15:03
  • nspirebcv4sy3yydtaercuut34hwc4fsxqqv4b4ye4xmo6qp3vxhulqd.onion Database | NightSpire snapshot · 2026-01-29 15:19
  • nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion RaaS Service Started snapshot · 2026-08-04 01:08
  • p3reixfwlpjtein4yta3kiwyijxdktypcipz6jjq4wgbyi73e3fsmeyd.onion Login - File Browser snapshot · 2026-07-09 12:37

Recent victims

The 50 most recent victims claimed by NIGHTSPIRE. Total in the index: 375.

Date listed Victim Description
2026-07-27 The Mountain
2026-07-27 Kates Nussman Ellis Earle & Landolfi LLP
2026-07-27 Akribis Systems Pte Ltd
2026-07-27 Thai Seng International Co. Ltd
2026-07-27 MKS Transformator
2026-07-27 OPTIDEA GmbH
2026-07-27 Furama Bukit Bintang
2026-07-27 K. Venkatesh, Co
2026-07-27 Wings Argo Private Limited
2026-07-27 KSL Dirtworks LLC
2026-07-27 Diffusion de Produits Inoxydables
2026-07-27 TFG Benefits, Inc.
2026-07-23 Auto Royal Company
2026-07-14 Cedar Crest College
2026-07-13 Webosphere
2026-07-08 PCCC Realty LLC
2026-06-25 Grupo Riquelme
2026-06-21 Artistic Smiles
2026-06-18 legendsmn(Blue Ox, Paul Bunyan, Lumberjack Electric)
2026-06-18 dean cosmetic dentistry
2026-06-16 Central Texas ***** *****
2026-06-16 Ri***** Co**** Europe S.r.l.
2026-06-16 Guy E******* & F*******, P.A
2026-06-15 B****S I******t***l
2026-06-15 Sheraton Miramar Resort El Gouna
2026-06-15 G**** R****l*e
2026-06-14 Silsbee Police Department
2026-06-14 K****** County. Mi**e**ta
2026-06-14 WaxWorks Inc
2026-06-14 Blue Nile Medical Center
2026-06-12 Pattono S.r.l
2026-06-12 Sierra West Jewelers
2026-06-08 GRIP Outreach For Youth
2026-06-08 Unique Litho, Inc
2026-06-08 A*** G*** A*S*
2026-06-08 ASIA STRATEGIC
2026-06-05 First Mutual Holdings
2026-06-05 Krum Public Library
2026-05-26 basatamfi
2026-05-24 Bresme Madrid S.L.
2026-05-24 Papa John's Egypt
2026-05-24 Red-Line
2026-05-24 Qua****Pro
2026-05-24 la familia adualt day center
2026-05-24 Pat**** S.r.l
2026-05-24 Si**** West J*******
2026-05-24 Rawaj Consumer Finance
2026-05-24 Ueno Fine Chemicals Industry
2026-05-18 Huse Incorporated
2026-05-18 TAKOSAN OTOMOBIL

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.

Facebook X (Twitter) LinkedIn
© 2026 Ransomnews.com

Type above and press Enter to search. Press Esc to cancel.

Cookies on Ransomnews

We use strictly-necessary cookies to run the site and may use first-party analytics to understand which articles are read. Some pages contain affiliate links — when you click one, the affiliate network sets cookies on the merchant's domain to attribute the referral. See the Cookie Policy and Affiliate Disclosure for detail.

RANSOMNEWS.COM

Tracking the criminal infrastructure of the internet.

Independent coverage of ransomware, breach economics, threat actors, privacy, AI security, and the open-source investigation toolkit.

// Topics

  • News
  • Security
  • Privacy
  • Cybercrime
  • AI
  • OSINT
  • Threat Groups
  • Stealer Logs
  • Ransomtracker
  • Stealercheck
  • FortiBleed Checker

// Site

  • About Us
  • Editorial Team
  • Contact
  • Tip Line
  • Editorial

// Legal

  • Privacy Policy
  • Terms of Service
  • Cookie Policy
  • Funding & Independence
  • RSS Feed
© 2026 Ransomnews.com · Tracking the criminal infrastructure of the internet.