Space Bears Review this actor's tracked leak-site claims, published reporting, and attributed threat evidence.
ransomware 170 leak-site claims, all timeLatest observed leak-site post 2026-10-22
aka spacebears
Names and spellings merged by the site editor: space-bears, spacebears.
PDF export is unavailable. The threat brief remains available below; use your browser's Print command.
PDF export is unavailable. The threat brief remains available below; use your browser's Print command.
Executive facts
Actor Space Bears
Kind ransomware
Aliases spacebears
Actor record created 2026-07-06
Latest observed 2026-10-22
Leak-site claims 170
Catalogued techniques 0 Scope
Tracked sectors Manufacturing, Healthcare, Business & Professional Services, Construction & Engineering, Technology
Claim records 2024-04-29 to 2026-10-22 Vulnerability events linked to this group No dated vulnerability events are attached to this group's linked vulnerabilities.
Verified techniques No verified ATT&CK mapping for this group.
Defensive actions No defensive actions are attached to this profile.
Most-claimed sectors Manufacturing Healthcare Business & Professional Services Construction & Engineering Technology
Activity window in this site's data
This is only the dates observed by this site. It is not this actor's lifetime or evidence of dormancy outside these dates.
Claim records First observed 2024-04-29 Latest observed 2026-10-22 Claims posted under this group's name or leak-site brand 170 Verified ATT&CK phases represented
No verified ATT&CK mapping for this group
Origin and motivation
Origin and motivation not attributed.
No MITRE ATT&CK group mapping exists for this actor yet. Mappings here are strict: an actor links to a MITRE group only when the group's own name, aliases, or MITRE-published description match, and MITRE has not catalogued this group. Technique and defensive action data will appear automatically if a verified mapping lands.
Claims posted under this group's name or leak-site brand
170 on this site SGLA (Schwartz, Giannini, Lantsberger & Adamson) Business & Professional Services 2026-10-22 source ↗ Alma Center Servizi Medicali S.r.l. Healthcare 2026-10-15 source ↗ Holistic Health Group, Inc. (d/b/a Suncrafted) Agriculture 2026-10-15 source ↗ Tomix / Grupo JOPER Manufacturing 2026-09-23 source ↗ D-MAX Engineering, Inc Construction & Engineering 2026-09-05 source ↗ Sports Endeavors Retail 2026-09-04 source ↗ Schwartz, Giannini, Lantsberger & Adamson (SGLA) Business & Professional Services 2026-09-04 source ↗ Studio Oculistico Ciraci Healthcare 2026-09-03 source ↗ Schwartz, Giannini, Lantsberger & Adamson (SGLA) Business & Professional Services 2026-09-03 source ↗ holzmarkt chemnitz Retail 2026-08-22 source ↗ View all on Breaches → Leak-site claim activity
Claims per month, 2024-04 to 2026-10. Peak 16 in 2026-07.
8 2 11 11 3 1 1 5 4 11 4 2 5 5 3 2 4 6 6 3 10 0 10 2 3 8 8 16 7 6 3
2024-04 2026-10
Show monthly counts as a table 0 additional claims without a disclosure date
Ransomware claim data is unverified: RansomLook (CC BY 4.0) and ransomware.live (Terms of use: credit and link required).