Search Ransomware Intelligence
Jump to a group, country, industry or search victims.
Lamashtu
As of Oct 19, 2026, Lamashtu has listed 48 confirmed victims on its leak site since Apr 11, 2026, 0.1% of all victims tracked by Brandefense. Its most targeted country is Germany (16.7% of its victims) and its most targeted sector is Consulting.
Lamashtu is an extortion group that first appeared in April 2026, claiming attacks against organizations in France, Romania, and Thailand across energy, pharmaceutical, and film sectors; it has not yet been confirmed as operating actual file-encrypting ransomware rather than pure data-theft extortion.
Follow and IOC feeds are part of the Brandefense platform.
- Confirmed Victims
- 48
- Rank By Victims
- #107
- Last Leak-Site Post
- Oct 5, 2026
- Top Country
- Germany
- Top Sector
- Consulting
Victims Posted Per Month.
| Month | Confirmed victims |
|---|---|
| May 2026 | 15 |
| June 2026 | 2 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 10 |
| October 2026 (month in progress) | 4 |
| Month | Confirmed victims |
|---|---|
| April 2026 | 17 |
| May 2026 | 15 |
| June 2026 | 2 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 10 |
| October 2026 (month in progress) | 4 |
| Month | Confirmed victims |
|---|---|
| April 2026 | 17 |
| May 2026 | 15 |
| June 2026 | 2 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 10 |
| October 2026 (month in progress) | 4 |
Latest Lamashtu Victims.
Search all 48 →| Victim | Country | Industry | Data claimed | Posted |
|---|---|---|---|---|
| Fluge Audiovisuales fluge.es | ESSpain | Transportation and Logistics | Not stated | |
| Bender Tribunenbau bender-tribuenen.de | DEGermany | Manufacturing | Not stated | |
| TRANS LOGROÑO SOCIEDAD ANONIMA translo.es | ESSpain | Transportation and Logistics | Not stated | |
| Grupo Industrial Tauro grupotauro.com | MXMexico | Construction | Not stated | |
| Dr Damiel Pugliese | Unknown | Unknown | Not stated | |
| Astidental di Sabbione bquadro.it | ITItaly | Consulting | Not stated |
How They Operate.
Lamashtu's threat actor profile lists 1 malware and tools, with its targets and related actors.
TTPs, CVEs and malware →Who Lamashtu Targets.
Sectors
History.
Busiest month on record: 17 confirmed victims
First confirmed victim listed on its leak site
First seen in Brandefense data
Most recent leak-site post
Get Real-Time Alerts, IOC Feeds And Takedowns.
The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.