Nightspire

Active

NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, India, Taiwan, and Japan, using aggressive double-extortion with ransom deadlines as short as two days.

363 Victims

Feb 16, 2025 First Discovered

Oct 30, 2026 Last Discovered

1 Days Inactive

0% Infostealer

1/6 Sites Online

Known Locations (6)

Database | NightSpire

nspiremkiq44zcxjbgvab4mdedyh2pzj5kzbmvftcugq3mczx3dqogid.onion

NightSpire

nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd.onion

NightSpire

a2lyiiaq4n74tlgz4fk3ft4akolapfrzk772dk24iq32cznjsmzpanqd.onion

Database | NightSpire

nspirebcv4sy3yydtaercuut34hwc4fsxqqv4b4ye4xmo6qp3vxhulqd.onion

Verify human - NightSpire

nspire7lugml7ybqyjaaxtsgrs4qn3fcon3lrjbih6wamttvdm5ke4qd.onion

RaaS Service Started

nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion

Tools Used

DiscoveryEnum

Everything.exe

Exfiltration

MEGA, WinSCP

Intelligence

11 Negotiation Chats

📄 4 Ransom Notes
View the actual ransom notes used by this group →

Victims (363)

Detailed victim list temporarily unavailable

This group has 363 victims. The victim list API is currently responding slowly for this dataset. Country, sector, and infostealer breakdowns are not available at this time. Basic stats (victim count, first/last seen) are shown above from a faster data source.