NightSpire is a financially driven ransomware group that first appeared in February 2025, primarily focusing on small to medium-sized enterprises across various industries for opportunistic exploitation. Initially centered on data theft and pure extortion, the group quickly shifted to a double extortion strategy, encrypting data after exfiltration, a tactic observed in recent incidents. Since March 12, 2025, NightSpire has operated a Dark Web leak site to threaten the release of stolen sensitive data. The group is widely considered a rebrand of the earlier Rbfs ransomware operation, which ceased activity concurrently with NightSpire's emergence, and has shown signs of transitioning from a closed, operator-driven model to an affiliate-based Ransomware-as-a-Service (RaaS) program.

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker