Home Threat actors SpaceBears Incidents attributed to:
SpaceBears SpaceBears is a ransomware group believed to be based in Moscow, Russia, that has taken credit for several high-profile cyberattacks while primarily operating as a Data Broker.
SpaceBears is a ransomware group believed to be based in Moscow, Russia, that has taken credit for several high-profile cyberattacks while primarily operating as a Data Broker. They currently list eight organizations on their Data Leak Site, focusing on medium to small-sized targets. Their methods suggest a reliance on basic extortion strategies rather than sophisticated malware tactics, with no advanced techniques or indicators of ransomware detected.
References
Actor metadata imported from Malpedia (Fraunhofer FKIE).
Related incidents
AP Lettering was named on the Spacebears ransomware data-leak (extortion) site on 2025-06-11.
Victim AP Lettering
Fujipoly Ltd was named on the Spacebears ransomware data-leak (extortion) site on 2025-05-28.
Victim Fujipoly Ltd
4Motive was named on the Spacebears ransomware data-leak (extortion) site on 2025-05-22.
Victim 4Motive
Curewell Pharmacy & Surgicals was named on the Spacebears ransomware data-leak (extortion) site on 2025-05-22.
Victim Curewell Pharmacy & Surgicals
First Choice Courier & Messenger was named on the Spacebears ransomware data-leak (extortion) site on 2025-05-13.
Victim First Choice Courier & Messenger
Nedved Architekti was named on the Spacebears ransomware data-leak (extortion) site on 2025-05-13.
Victim Nedved Architekti
EVERTECH INSTRUMENTAL CO., LTD was named on the Spacebears ransomware data-leak (extortion) site on 2025-04-17.
Victim EVERTECH INSTRUMENTAL CO., LTD
VIÑUELAS ABOGADOS was named on the Spacebears ransomware data-leak (extortion) site on 2025-04-17.
Victim VIÑUELAS ABOGADOS
3P Corporation was named on the Spacebears ransomware data-leak (extortion) site on 2025-04-10.
Victim 3P Corporation
Industrial Corona de México was named on the Spacebears ransomware data-leak (extortion) site on 2025-04-05.
Victim Industrial Corona de México
L&S Mechanical (Reuploaded) was named on the Spacebears ransomware data-leak (extortion) site on 2025-04-05.
Victim L&S Mechanical (Reuploaded)
L&S Mechanical was named on the Spacebears ransomware data-leak (extortion) site on 2025-03-20.
Victim L&S Mechanical
Whittaker & Company was named on the Spacebears ransomware data-leak (extortion) site on 2025-03-20.
Victim Whittaker & Company
South Georgia Accounting Services was named on the Spacebears ransomware data-leak (extortion) site on 2025-02-25.
Victim South Georgia Accounting Services
SmithDunn&Co was named on the Spacebears ransomware data-leak (extortion) site on 2025-02-06.
Victim SmithDunn&Co
Pineland community service board was named on the Spacebears ransomware data-leak (extortion) site on 2025-02-03.
Victim Pineland community service board
CAMRIDGEPORT was named on the Spacebears ransomware data-leak (extortion) site on 2025-02-01.
Victim CAMRIDGEPORT
Metro Wire & Cable was named on the Spacebears ransomware data-leak (extortion) site on 2025-01-26.
Victim Metro Wire & Cable
Arrow Motor Auctions was named on the Spacebears ransomware data-leak (extortion) site on 2025-01-24.
Victim Arrow Motor Auctions
PINELAND BHDD COMMUNITY SERVICES was named on the Spacebears ransomware data-leak (extortion) site on 2025-01-23.
Victim PINELAND BHDD COMMUNITY SERVICES
Christian Community Aid was named on the Spacebears ransomware data-leak (extortion) site on 2025-01-22.
Victim Christian Community Aid
SANTA MARIA LABORATORIO was named on the Spacebears ransomware data-leak (extortion) site on 2025-01-22.
Victim SANTA MARIA LABORATORIO
Bethany Hospital was named on the Spacebears ransomware data-leak (extortion) site on 2025-01-21.
Victim Bethany Hospital
Inaya Clinique was named on the Spacebears ransomware data-leak (extortion) site on 2025-01-21.
Victim Inaya Clinique