Lamashtu

Active

Lamashtu is an extortion group that first appeared in April 2026, claiming attacks against organizations in France, Romania, and Thailand across energy, pharmaceutical, and film sectors; it has not yet been confirmed as operating actual file-encrypting ransomware rather than pure data-theft extortion.

54 Victims

Apr 11, 2026 First Discovered

Oct 24, 2026 Last Discovered

7 Days Inactive

0% Infostealer

1/2 Sites Online

Known Locations (2)

7jhbjbyb3zp5ziqqn6kikfrgyjapd4wusseuu753ddknr37apqrxnpid.onion

Lamashtu.Blog

lamashtux5j74mcm7lwwgn5yrvuwtrpxjoyendif3v3hrztjesfoyayd.onion

Intelligence

📄 1 Ransom Notes
View the actual ransom notes used by this group →

Victims (54)

Detailed victim list temporarily unavailable

This group has 54 victims. The victim list API is currently responding slowly for this dataset. Country, sector, and infostealer breakdowns are not available at this time. Basic stats (victim count, first/last seen) are shown above from a faster data source.