Lamashtu

No sourced public emblem in this profile.

reference profile · reported nexus: Unknown (not nationality)

Lamashtu is a financially motivated data-theft and extortion group that emerged in mid-April 2026, operating a Tor-hosted leak site (Lamashtu[.]Blog) with countdown timers, structured Breach Impact Reports, and proof-of-life thumbnails to pressure victims. The group has claimed 17+ victims across France, Romania, Thailand, Malaysia, Egypt, and the UAE within its first weeks of activity, targeting energy, pharmaceutical, retail, hospitality, and film sectors, with confirmed exfiltration totaling 760+ GB.

Source-reported aliases: . Associations do not prove equivalence.

Target geography

Catalog-listed countries (associations, not attack counts): No country-level metadata

20 observed public claim posts in the collection window 2025-11-21 through 2026-10-25. Accumulated bounded samples: newest 1,000 records from each of the current and previous source years, refreshed every six hours. Historical gaps are not filled. These are not confirmed attacks or unique victims. Dates are provider record dates; countries are provider classifications; unknown is retained. Source: Ransomfeed — Dario Fadda · CC BY 4.0. Adapted into anonymous counts by Kinwilder; no endorsement implied.

Germany: 10 posts
France: 3 posts
Spain: 2 posts
Mexico: 2 posts
Argentina: 1 posts
Italy: 1 posts
Australia: 1 posts