lamashtu
Known ransomware group ACTIVE Currently active
Lamashtu is an extortion group that first appeared in April 2026, claiming attacks against organizations in France, Romania, and Thailand across energy, pharmaceutical, and film sectors; it has not yet been confirmed as operating actual file-encrypting ransomware rather than pure data-theft extortion.
9
Total Claims
3
Critical
—
Records Claimed
8
Industries Hit
Active span: Apr 14, 2026 – Sep 30, 2026 · 9 organizations targeted
Currently active
Actor Threat Profile
Activity Timeline
Peak: Apr 2026 (3)Apr 2026
LessMore
Sep 2026Share this profile
Top Targeted Industries
Healthcare 2
Financial Services 1
Energy & Utilities 1
Transportation/Logistics 1
Hospitality and Tourism 1
Consumer Services 1
Tradecraft & Infrastructure
0
Documented tools
0 / 0
MITRE tactics / techniques
2
Known leak sites
Targeted Organizations
Claims by lamashtu
Critical
Ransomware Claim: Dr Damiel Pugliese
Dr Damiel Pugliese
lamashtu
Ransomware Healthcare
Sep 30, 2026 Critical
Ransomware Claim: FIDUCIAL
FIDUCIAL
lamashtu
Ransomware Financial Services
Sep 30, 2026 Low
Ransomware Claim: Vinco Energy
Vinco Energy
lamashtu
Ransomware Energy & Utilities
Sep 30, 2026 Low
Ransomware Claim: MSC Group
MSC Group
lamashtu
Ransomware Transportation/Logistics
May 18, 2026 Critical
Ransomware Claim: Depósito Dental Universitario
Depósito Dental Universitario
lamashtu
Ransomware Healthcare
May 12, 2026 Low
Ransomware Claim: WOHA
WOHA
lamashtu
Ransomware Hospitality and Tourism
May 6, 2026 Low
Ransomware Claim: Apple Film Group
Apple Film Group
lamashtu
Ransomware Consumer Services
Apr 26, 2026 Low
Ransomware Claim: LACROIX
LACROIX
lamashtu
Ransomware Manufacturing
Apr 15, 2026 Low
Ransomware Claim: GRUPO RONDA
GRUPO RONDA
lamashtu
Ransomware Business Services
Apr 14, 2026