Space Bears is a double-extortion ransomware group that emerged in April 2024, distinguished by a professional "corporate" aesthetic on its leak site, leveraging Phobos RaaS infrastructure and targeting small-to-medium organizations in manufacturing, technology, and healthcare across the US and Europe.
Genera un perfil del actor con IA (defensivo) cuando lo pidas.
Este grupo no tiene TTPs curadas. Puedes generar un mapeo MITRE ESTIMADO por IA (no confirmado) a partir de su descripción/notas, solo cuando lo pidas.
Firma de detección defensiva para este grupo (úsala en tu EDR/SIEM). Fuente: ransomware.live.
/*
Space Bears ransomware
*/
rule SpaceBears_Ransomnote
{
meta:
author = "ransomware.live"
family = "ransomware.spacebears"
description = "Detects Space Bears ransomware ransom note"
date = "2026-05-04"
severity = 7
score = 70
strings:
$s1 = "Space Bears" ascii nocase
$s2 = "SpaceBears" ascii nocase
$s3 = "spacebears.onion" ascii nocase
condition:
any of them
}
Holzmarkt Chemnitz is a specialized retail store for building materials and wood products, operating two branches in Chemnitz (Fichtestraße and Kalkstraße). They serve as a competent partner for both professional builders and private customers.-Personal information of employees and clients -Financial documents-SQL DB [enlace omitido]
Freelom.net s.r.o. is a Czech internet service provider and IT company based in Lomnice nad Popelkou, which has been operating since 2009 . The company's primary focus is providing wireless internet access via its own network, with services available 24 hours a day, 7 days a week.The company is led by two managing directors, Jiří Plichta and Petr Malý. A priority for Freelom.net is the speed, reliability, and quality of its services , and it aims to resolve technical issues within a maximum of 24 hours-SQL Data (All client personal data) [enlace omitido]
| Organización | País | Sector | Grupo | Descubierta |
|---|---|---|---|---|
| holzmarkt chemnitz | DE | Retail & E-Commerce | — | 22 ago 2026 |
| Freelom | CZ | Not Found | — | 22 ago 2026 |
| SEARS (Grupo Sanborns) | MX | Retail & E-Commerce | — | 15 ago 2026 |
| Basso Fedele & Figli S.r.l. (Olio Basso) / Villa Raiano | IT | Agriculture and Food Production | — | 12 ago 2026 |
| Elixi International SA | CH | Healthcare | — | 10 ago 2026 |
| Hitech Distribuzione Informatica S.r.l. (HTDI) | IT | Technology | — | 7 ago 2026 |
| PontoBR Sistemas | BR | Technology | — | 5 ago 2026 |
| StellarRAD Systems | US | Technology | — | 29 jul 2026 |
| DoAllTech | KR | Technology | — | 21 jul 2026 |
| Anpra SAS | CO | Professional Services | — | 21 jul 2026 |
| BiesSse Group | IT | Professional Services | — | 21 jul 2026 |
| Chebib Control | BR | Professional Services | — | 17 jun 2026 |
| Gerencial | BR | Professional Services | — | 17 jun 2026 |
| Sicol | BR | Manufacturing | — | 4 jun 2026 |
| Stellar | TC | Not Found | — | 2 jun 2026 |
| Sitran MG | BR | Professional Services | — | 16 feb 2026 |
| Supercash (Alimentos Y Bebidas Premium) | MX | Agriculture and Food Production | — | 3 oct 2025 |
| SOP. Sistema Odontológico Privado | AR | Healthcare | — | 26 sept 2025 |
| Fattore Cosméticos Ltda | BR | Retail & E-Commerce | — | 25 sept 2025 |
| RAC Consultoria | DO | Professional Services | — | 17 sept 2025 |
| Industrial Corona de México | MX | Manufacturing | — | 5 abr 2025 |
| SANTA MARIA LABORATORIO | BR | Healthcare | — | 22 ene 2025 |
| Thinkadam | CO | Technology | — | 29 abr 2024 |
| todoagro | EC | Agriculture and Food Production | — | 29 abr 2024 |
Las direcciones de los sitios de filtración (.onion) se conocen pero no se publican ni se enlazan. Solo se muestran metadatos públicos. ética
SEARS (Grupo Sanborns, S.A. de C.V.) is a leading Mexican retail company and a key subsidiary of Grupo Carso, owned by the Slim family.Founded in 1903 by the Sanborn brothers, the company has grown into one of the country’s most iconic and successful retail groups.It owns and operates two of Mexico’s most famous brands: Sears (mid-range department stores) and Sanborns (the signature “store + restaurant/cafe” format).Today, Grupo Sanborns manages more than 41,000 employees and hundreds of stores nationwide, with a strong focus on e-commerce and digital transformation.Website: www.sears.com.mx and www.sanborns.com.mx.AttentionDemo files will appear here in the coming days, ahead of the full-scale release. [enlace omitido]
Basso Fedele & Figli S.r.l. is a historic Italian family company founded in 1904 in San Michele di Serino, in the Irpinia region of Campania. For over a century, the Basso family has been dedicated to the production and bottling of high-quality olive oil. Today, the company is a leading name in the Italian olive oil sector, exporting its products under the Basso® brand to more than 90 countries worldwide. Combining tradition with modern technology, Basso offers a wide range of oils, including extra virgin olive oil, seed oils, and specialty blends. The company also produces private-label oils for major retail chains, maintaining a strong commitment to quality, traceability, and authenticity.[enlace omitido] Raiano is the wine estate of the Basso family, established in 1996 as a natural extension of their agricultural heritage in Irpinia, Campania. The winery focuses on producing premium organic wines from indigenous grape varieties, particularly Fiano di Avellino, Greco di Tufo, and Aglianico. With approximately 27 hectares of certified organic vineyards, Villa Raiano combines traditional winemaking with modern techniques, including gravity-flow processing and minimal batonnage to preserve freshness and minerality. In 2018, the new generation of the Basso family took over management, and in 2024, a state-of-the-art underground cellar was opened for aging. Villa Raiano is now recognized as one of the most dynamic and respected wineries in southern Italy.-Personal information of employees and clients -Financial documents -Other files [enlace omitido]
Elixi International SA is a Swiss pharmaceutical distributor (headquartered in Chiasso, founded in 2016) specializing in the global supply of both licensed and unlicensed medicinal products, including expanded access programs for patients.The company operates on a B2B model, serving hospitals, clinics, and pharmacies, ensuring quality through its Swissmedic license and robotic authenticity control systems, while prioritizing the rapid delivery of life-saving medicines.In addition to Switzerland, it has offices in Singapore.-SQL Data-Personal information of employees and clients-Financial documents [enlace omitido]
HTDI is a leading Italian provider of comprehensive IT solutions based in Rome (Via Tempio del Cielo). It positions itself as a single technological partner that accompanies clients through every stage of the IT infrastructure lifecycle — from design and equipment selection to delivery, installation, integration, and ongoing operation (“turnkey” solutions).The company offers hardware solutions (servers, storage systems, workstations, mobility, and hyperconvergence — certified partner of Dell-EMC, HP, IBM, Lenovo and others), software (middleware, business applications, security solutions, data and business process management — partner of Microsoft, Oracle and other vendors), and full services including design, installation, helpdesk, technical support, system integration, and lifecycle management.Its slogan is “Making IT Happen.” HTDI operates as both a system integrator and IT infrastructure supplier for corporate clients, delivering the entire service cycle in one place. [enlace omitido]