Ransomware-as-a-service group active since 2023 that steals data, encrypts networks and auctions it on a leak site, often hitting public bodies.
Comparitech counted 2,627 ransomware attacks claimed in Q3 2026, a quarterly record up 27% on Q2 and 61% on a year earlier. Victims have confirmed 247 of those claims, so the record is mostly a count of what the gangs themselves assert.
Reality
Kai Wegner has ruled out paying, which leaves a seven-day clock running on 5.79 terabytes the group says it holds. Two Berlin department networks were already offline for days, and the city still cannot say what was in the files.
Perspective Coverage
3 publishersReality
Zscaler ThreatLabz logged 20.1% fewer ransomware payments in the year to March 2026, worth $327.8M in total, while the average payment rose 5.3% to $431,995. Leak-site listings fell just 3% over the same period, so the decline is in how many victims pay.
Reality
The Senate says it will not pay and has now dated a second outflow to August 7 through 12. Twenty-two days after that outflow was first reported, it has published nothing for the people whose records went.
Perspective Coverage
6 publishersReality
The Senate Chancellery itemised four task forces, a housing crisis team, outside counsel and a contact point for staff, which tells any public body what the refusal path needs in people even though the price of it never appears.
Reality