Spacebears

Active
Space Bears is a double-extortion ransomware group that emerged in April 2024, distinguished by a professional "corporate" aesthetic on its leak site, leveraging Phobos RaaS infrastructure and targeting small-to-medium organizations in manufacturing, technology, and healthcare across the US and Europe.
156 Victims
Apr 24, 2024 First Discovered
Sep 5, 2026 Last Discovered
11 Days Inactive
0% Infostealer
1/1 Sites Online
Known Locations (1)
Space Bears
5butbkrljkaorg5maepuca25oma7eiwo6a2rlhvkblb4v6mf3ki2ovid.onion
Tools Used
DefenseEvasion
Defender Control
LOLBAS
BCDEdit, VmConnect, WMIC, fsutil, netsh, vssadmin
Victims (156)

Detailed victim list temporarily unavailable

This group has 156 victims. The victim list API is currently responding slowly for this dataset. Country, sector, and infostealer breakdowns are not available at this time. Basic stats (victim count, first/last seen) are shown above from a faster data source.