Threat Group Profile
lamashtu
● Active — last 30 days
Victim claims
34
First seen
Apr 2026
Last activity
17 Jun 2026
Tracked since
Apr 2026
Group overview
Lamashtu is an extortion group that first appeared in April 2026, claiming attacks against organizations in France, Romania, and Thailand across energy, pharmaceutical, and film sectors; it has not yet been confirmed as operating actual file-encrypting ransomware rather than pure data-theft extortion.
Preferred targets
Manufacturing · 7
Business Services · 5
Agriculture and Food Production · 4
Consumer Services · 3
Hospitality and Tourism · 3
Transportation/Logistics · 2
Most targeted countries
MY · 5
FR · 4
TH · 3
DE · 3
MX · 3
IN · 2
