Search Ransomware Intelligence
Jump to a group, country, industry or search victims.
Blackwater
As of Oct 19, 2026, Blackwater has listed 12 confirmed victims on its leak site since Mar 20, 2026, 0.0% of all victims tracked by Brandefense. Its most targeted country is China (25.0% of its victims) and its most targeted sector is Healthcare.
Blackwater is a ransomware group that first surfaced in early 2026, combining file encryption with data theft and targeting healthcare organizations, with known victims including Minidoka Memorial Hospital in Idaho.
Follow and IOC feeds are part of the Brandefense platform.
- Confirmed Victims
- 12
- Rank By Victims
- #211
- Last Leak-Site Post
- Aug 24, 2026
- Top Country
- China
- Top Sector
- Healthcare
Victims Posted Per Month.
| Month | Confirmed victims |
|---|---|
| May 2026 | 1 |
| June 2026 | 1 |
| July 2026 | 2 |
| August 2026 | 3 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| March 2026 | 1 |
| April 2026 | 4 |
| May 2026 | 1 |
| June 2026 | 1 |
| July 2026 | 2 |
| August 2026 | 3 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| March 2026 | 1 |
| April 2026 | 4 |
| May 2026 | 1 |
| June 2026 | 1 |
| July 2026 | 2 |
| August 2026 | 3 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
Latest Blackwater Victims.
Search all 12 →| Victim | Country | Industry | Data claimed | Posted |
|---|---|---|---|---|
| ptesm.com ptesm.com | IDIndonesia | Manufacturing | Not stated | |
| shalina.com shalina.com | AEUnited Arab Emirates | Pharmaceuticals | Not stated | |
| amca.org.ar amca.org.ar | ARArgentina | Consulting | Not stated | |
| msgas.com.br msgas.com.br | BRBrazil | Retail | Not stated | |
| txdkj.com txdkj.com | CNChina | Technology | Not stated | |
| utourworld.com utourworld.com | CNChina | Hospitality and Tourism | Not stated |
How They Operate.
Blackwater's threat actor profile lists 1 malware and tools, with its targets and related actors.
TTPs, CVEs and malware →Who Blackwater Targets.
Sectors
History.
First confirmed victim listed on its leak site
Busiest month on record: 4 confirmed victims
First seen in Brandefense data
Most recent leak-site post
Get Real-Time Alerts, IOC Feeds And Takedowns.
The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.