Group profile8 claimed in last 30d15 total tracked

spacebears

Forward this

Space Bears has claimed eight victims in the past 30 days, a sharp pace against a 12-victim total since the group was first tracked in late May 2026, with technology firms making up the largest share of targets and a geographic pattern concentrated in Italy and Brazil alongside scattered hits in the US, South Korea, and Switzerland. The group claims double-extortion, pairing data theft with encryption, and its leak site is described as maintaining a polished "corporate" presentation distinct from typical extortion pages. Its infrastructure is reported to derive from the Phobos ransomware-as-a-service codebase, consistent with catalogued behavior of disabling security tooling prior to file encryption and using intermittent encryption to speed operations. Victim selection so far skews toward small-to-medium technology, professional services, and business services firms rather than large enterprises, with occasional forays into healthcare and manufacturing. The current run rate, roughly two victims claimed per week, marks a notable acceleration from the group's first months of activity.

Brief by The Nexus · Aug 15 · 15:04 UTC

Space Bears is a double-extortion ransomware group that emerged in April 2024, distinguished by a professional "corporate" aesthetic on its leak site, leveraging Phobos RaaS infrastructure and targeting small-to-medium organizations in manufacturing, technology, and healthcare across the US and Europe.

First seen: May 25 · 00:00 UTCLast seen: Aug 22 · 07:59 UTCTracked since: 2024-04-29

Sectors hit

Technology4
Retail & E-Commerce2
Professional Services2
Unspecified2
Business Services2
Manufacturing1
Healthcare1
Agriculture and Food Production1

Countries hit

Italy4
Brazil3
United States1
Turks & Caicos Islands1
Mexico1
South Korea1
Germany1
Czechia1
Colombia1
Switzerland1

Recent claimed victims

Retail & E-CommerceGermanyAug 22 · 08:00 UTC

holzmarkt chemnitz

holzmarkt-chemnitz.de

holzmarkt chemnitz

Freelom

SEARS (Grupo Sanborns)

Basso Fedele & Figli S.r.l. (Olio Basso) / Villa Raiano

Elixi International SA

Hitech Distribuzione Informatica S.r.l. (HTDI)

PontoBR Sistemas

StellarRAD Systems

DoAllTech

Anpra SAS

BiesSse Group

Chebib Control

Sicol

Stellar

BASE SPA