Search Ransomware Intelligence
Jump to a group, country, industry or search victims.
Netrunner
As of Oct 19, 2026, Netrunner has listed 9 confirmed victims on its leak site since Apr 3, 2026, 0.0% of all victims tracked by Brandefense. Its most targeted country is Japan (22.2% of its victims) and its most targeted sector is Healthcare.
NetRunner is a ransomware group active from at least 2025 targeting diverse sectors including healthcare, telecommunications, manufacturing, and agriculture across Japan, Italy, the US, and Jordan, notably demanding a $100M ransom from Nippon Medical School Musashi Kosugi Hospital.
Follow and IOC feeds are part of the Brandefense platform.
- Confirmed Victims
- 9
- Rank By Victims
- #226
- Last Leak-Site Post
- Oct 8, 2026
- Top Country
- Japan
- Top Sector
- Healthcare
Victims Posted Per Month.
| Month | Confirmed victims |
|---|---|
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 3 |
| Month | Confirmed victims |
|---|---|
| April 2026 | 6 |
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 3 |
| Month | Confirmed victims |
|---|---|
| April 2026 | 6 |
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 3 |
Latest Netrunner Victims.
Search all 9 →| Victim | Country | Industry | Data claimed | Posted |
|---|---|---|---|---|
| Mid Atlantic Gynecologic Oncology and Pelvic Surgery Associates magopsa.com | TRTürkiye | Healthcare | Not stated | |
| Precon Marine Inc preconmarine.com | USUnited States | Construction | Not stated | |
| Main Place Mall westfield.com | FRFrance | Retail | Not stated | |
| Jordan India Fertilizer Company jifco.co | JOJordan | Agriculture | Not stated | |
| Harman Fitness crunchfitness.com | USUnited States | Consulting | 1.4 TB | |
| Nippon Medical School Musashi Kosugi Hospital nms.ac.jp | JPJapan | Healthcare | Not stated |
How They Operate.
Netrunner's threat actor profile lists 1 malware and tools, with its targets and related actors.
TTPs, CVEs and malware →Who Netrunner Targets.
History.
Busiest month on record: 6 confirmed victims
First seen in Brandefense data
First confirmed victim listed on its leak site
Most recent leak-site post
Get Real-Time Alerts, IOC Feeds And Takedowns.
The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.