{"edition":26,"date":"2026-10-23","url":"https://ninjalabz.io/daily/2026-10-23/#tempo","tempo":{"as_of":"2026-10-23","claims_7d":178,"groups_active_7d":40,"groups_total":130,"status_counts":{"dormant":13,"new":12,"quiet":19,"steady":56,"sporadic":23,"surging":7},"alerts":[{"group":"Helix","status":"surging","posts_7d":9,"expected_7d":0.79,"p_value":0.0,"days_since_last":2,"gap_before_last":0,"all_time":17,"first_post":"2026-08-07"},{"group":"BrainCipher","status":"surging","posts_7d":8,"expected_7d":1.58,"p_value":0.0002,"days_since_last":2,"gap_before_last":0,"all_time":44,"first_post":"2026-05-11"},{"group":"N0n","status":"surging","posts_7d":44,"expected_7d":24.86,"p_value":0.0003,"days_since_last":1,"gap_before_last":0,"all_time":147,"first_post":"2026-09-18"},{"group":"SilentRansomGroup","status":"surging","posts_7d":9,"expected_7d":2.3,"p_value":0.0006,"days_since_last":1,"gap_before_last":0,"all_time":61,"first_post":"2026-05-12"},{"group":"lamashtu","status":"surging","posts_7d":6,"expected_7d":1.17,"p_value":0.0013,"days_since_last":1,"gap_before_last":0,"all_time":33,"first_post":"2026-05-08"},{"group":"everest","status":"surging","posts_7d":9,"expected_7d":2.76,"p_value":0.0022,"days_since_last":1,"gap_before_last":0,"all_time":65,"first_post":"2026-05-28"}],"dormant":[{"group":"blackwater","days_since_last":60,"all_time":6,"last_post":"2026-08-24"},{"group":"coinbasecartel","days_since_last":61,"all_time":44,"last_post":"2026-08-23"},{"group":"xpl0itrs","days_since_last":64,"all_time":8,"last_post":"2026-08-20"},{"group":"CRPxO","days_since_last":82,"all_time":37,"last_post":"2026-08-02"}],"top_active":[{"group":"N0n","posts_7d":44,"expected_7d":24.86,"status":"surging"},{"group":"qilin","posts_7d":20,"expected_7d":25.36,"status":"steady"},{"group":"Helix","posts_7d":9,"expected_7d":0.79,"status":"surging"},{"group":"SilentRansomGroup","posts_7d":9,"expected_7d":2.3,"status":"surging"},{"group":"everest","posts_7d":9,"expected_7d":2.76,"status":"surging"}],"pressure":{"total_window":1008,"unknown_share":0.231,"up":[{"name":"Transportation","observed":69,"expected":32.2,"lift":2.14,"p_up":0.0},{"name":"Education","observed":47,"expected":25.4,"lift":1.85,"p_up":0.0001},{"name":"Healthcare","observed":115,"expected":77.1,"lift":1.49,"p_up":0.0}],"down":[{"name":"Retail & E-Commerce","observed":47,"expected":60.5,"lift":0.78,"p_down":0.0437}]},"lifecycle":{"feed_start":"2026-05-11","cohort_from":"2026-06-01","dead_days":60,"cohort":{"n":79,"active":62,"quiet":17},"survival":{"n":79,"censored":62,"median_days":null,"survival":{"30":0.7732,"60":0.7732,"90":null,"120":null},"follow_up_days":84},"one_day":{"judged":56,"n":10,"share":0.1786},"front_loaded":{"judged":56,"n":23,"share":0.4107},"new_per_month":[{"month":"2026-06","n":22},{"month":"2026-07","n":11},{"month":"2026-08","n":27},{"month":"2026-09","n":9},{"month":"2026-10","n":10}],"caveat":"A brand is the leak-site name trackers report; a rebrand counts as one brand going quiet and another being born. Lifetime = days between a brand's first and last claim; quiet = no claim for 60 days. Brands first seen in the feed's first 21 days are excluded from the survival figures (their true start predates coverage). Leak-site claims, not confirmed breaches.","newest":[{"group":"Mimori","first_post":"2026-10-20","claims":2,"active_days":1,"status":"active"},{"group":"THE SEVEN DEADLY SINS","first_post":"2026-10-16","claims":8,"active_days":1,"status":"active"},{"group":"0x00","first_post":"2026-10-15","claims":1,"active_days":1,"status":"active"},{"group":"HYFLOCK","first_post":"2026-10-13","claims":10,"active_days":2,"status":"active"}]},"targeting":{"since":"2026-04-26","window_days":180,"min_group":20,"judged":{"sector":46,"country":55},"labels":{"specialist":2,"focused":13,"generalist":31},"specialists":[{"group":"safepay","dim":"country","name":"DE","lift":6.84,"n":43,"share":0.3496,"p_adj":0.0,"label":"focused"},{"group":"N0n","dim":"sector","name":"Transportation","lift":8.56,"n":35,"share":0.3933,"p_adj":0.0,"label":"focused"},{"group":"Storm","dim":"country","name":"US","lift":2.14,"n":69,"share":0.7753,"p_adj":0.0,"label":"specialist"},{"group":"Orova","dim":"country","name":"HK","lift":53.26,"n":11,"share":0.234,"p_adj":0.0,"label":"focused"},{"group":"genesis","dim":"country","name":"US","lift":2.62,"n":44,"share":0.9565,"p_adj":0.0,"label":"specialist"},{"group":"incransom","dim":"country","name":"US","lift":1.5,"n":100,"share":0.5435,"p_adj":0.0,"label":"specialist"}],"generalists":[{"group":"qilin","effective_n":10.0,"categories":12,"n":441},{"group":"krybit","effective_n":10.0,"categories":12,"n":98}],"caveat":"Leak-site claims as discovered by trackers, not confirmed breaches. Lift = the group's share of a sector (or country) over every other group's share in the same window; p-values are exact binomial tails, Bonferroni-adjusted for the categories tested. Claims with no sector or an Unknown/Other label are excluded."},"rhythm":{"since":"2026-04-26","window_days":180,"min_group":30,"judged":46,"labels":{"clockwork":22,"batcher":6,"weekday-only":11,"spread":21},"overall":{"n":4890,"weekend_share":0.192,"half":{"start":12,"width":8,"share":0.527},"hours":[102,66,65,86,51,81,109,191,216,330,189,199,360,461,339,353,211,257,321,275,241,160,151,76],"days":[862,701,821,744,823,440,499]},"batchers":[{"group":"clop","n":92,"R":0.717,"mean_hour":17.5,"rayleigh_p":0.0,"half":{"start":13,"width":3,"share":0.5},"weekend_share":0.0,"weekend_n":0,"peak_day":{"name":"Wed","long":"Wednesdays","n":86,"share":0.935,"lift":6.1,"p_adj":0.0,"evidence":155.54},"labels":["clockwork","batcher","weekday-only"]},{"group":"safepay","n":123,"R":0.807,"mean_hour":19.3,"rayleigh_p":0.0,"half":{"start":19,"width":1,"share":0.537},"weekend_share":0.008,"weekend_n":1,"peak_day":{"name":"Mon","long":"Mondays","n":83,"share":0.675,"lift":4.13,"p_adj":0.0,"evidence":117.7},"labels":["clockwork","batcher","weekday-only"]},{"group":"Deadlock","n":104,"R":0.693,"mean_hour":14.4,"rayleigh_p":0.0,"half":{"start":12,"width":2,"share":0.635},"weekend_share":0.135,"weekend_n":14,"peak_day":{"name":"Fri","long":"Fridays","n":69,"share":0.663,"lift":4.21,"p_adj":0.0,"evidence":99.21},"labels":["clockwork","batcher"]}],"clockwork":[{"group":"akira","n":178,"R":0.946,"mean_hour":13.5,"rayleigh_p":0.0,"half":{"start":12,"width":2,"share":0.652},"weekend_share":0.006,"weekend_n":1,"peak_day":{"name":"Tue","long":"Tuesdays","n":42,"share":0.236,"lift":1.69,"p_adj":0.00282,"evidence":21.97},"labels":["clockwork","weekday-only"]},{"group":"safepay","n":123,"R":0.807,"mean_hour":19.3,"rayleigh_p":0.0,"half":{"start":19,"width":1,"share":0.537},"weekend_share":0.008,"weekend_n":1,"peak_day":{"name":"Mon","long":"Mondays","n":83,"share":0.675,"lift":4.13,"p_adj":0.0,"evidence":117.7},"labels":["clockwork","batcher","weekday-only"]},{"group":"Deadlock","n":104,"R":0.693,"mean_hour":14.4,"rayleigh_p":0.0,"half":{"start":12,"width":2,"share":0.635},"weekend_share":0.135,"weekend_n":14,"peak_day":{"name":"Fri","long":"Fridays","n":69,"share":0.663,"lift":4.21,"p_adj":0.0,"evidence":99.21},"labels":["clockwork","batcher"]},{"group":"play","n":89,"R":0.747,"mean_hour":19.2,"rayleigh_p":0.0,"half":{"start":18,"width":3,"share":0.551},"weekend_share":0.146,"weekend_n":13,"peak_day":{"name":"Tue","long":"Tuesdays","n":23,"share":0.258,"lift":1.83,"p_adj":0.017633,"evidence":13.9},"labels":["clockwork"]}],"weekday_only":[{"group":"akira","n":178,"R":0.946,"mean_hour":13.5,"rayleigh_p":0.0,"half":{"start":12,"width":2,"share":0.652},"weekend_share":0.006,"weekend_n":1,"peak_day":{"name":"Tue","long":"Tuesdays","n":42,"share":0.236,"lift":1.69,"p_adj":0.00282,"evidence":21.97},"labels":["clockwork","weekday-only"]},{"group":"safepay","n":123,"R":0.807,"mean_hour":19.3,"rayleigh_p":0.0,"half":{"start":19,"width":1,"share":0.537},"weekend_share":0.008,"weekend_n":1,"peak_day":{"name":"Mon","long":"Mondays","n":83,"share":0.675,"lift":4.13,"p_adj":0.0,"evidence":117.7},"labels":["clockwork","batcher","weekday-only"]},{"group":"clop","n":92,"R":0.717,"mean_hour":17.5,"rayleigh_p":0.0,"half":{"start":13,"width":3,"share":0.5},"weekend_share":0.0,"weekend_n":0,"peak_day":{"name":"Wed","long":"Wednesdays","n":86,"share":0.935,"lift":6.1,"p_adj":0.0,"evidence":155.54},"labels":["clockwork","batcher","weekday-only"]}],"caveat":"Times are when trackers first saw each claim on the leak site, in UTC: not the attack time, not the operator's clock, and a site that is only reachable at certain hours shows the same pattern. Batch releases show as spikes. Weekday and weekend shares are tested against every other brand's share (exact binomial tails; the busiest day Bonferroni-adjusted for the 7 days tried); hour-of-day concentration is the mean resultant length with a Rayleigh test. Leak-site claims as discovered by trackers, not confirmed breaches."},"caveat":"Leak-site claims as discovered by trackers, not confirmed breaches. Surprise compares the last 7 days with the group's own prior 173 days (Poisson).","attribution":"Victim claims: ransomware.live and leak-site trackers"},"licence":"CC BY 4.0 — cite Probably Fine Daily / Ninja Signal"}