Threat group
Organisations Falcon has claimed on its leak site or that reporting links to it, newest first. A claim stays a claim until the organisation or a regulator says otherwise.
Organisations linked, last 12 months
Updated 14 Nov 2026, 11:09 UTC, 33 of 36 sources answering. History from 14 Nov 2025.
Where a group operates from is rarely sourced, so the map never draws a line from one.
Every item here rests on the group's own leak site. None has been confirmed by the organisation named or by a regulator yet.
Leak-site claims tracked by RansomLook (ransomlook.io), CC BY 4.0, enriched by Black Shard.
Spotted an error? Report a correction. Is your organisation listed? Send us a statement.
Black Shard's team can check your exposure, take a fix off your plate or step in on a live incident.