ThreatVectr
Australian cybersecurity news site run by Imicus Group that publishes monthly ransomware leak-site counts.
ThreatVectr's tracker counted 861 ransomware leak-site claims for September 2026 in a report published on 1 October, down 23 per cent on a revised August total of 1,120, using claims it observes through ransomware.live.
Last refreshed: 12 October 2026 · Appears in 1 active topic
Whose numbers sit behind ThreatVectr's monthly ransomware count?
Timeline for ThreatVectr
Mentioned in: Ransomware crews' claims fall to 815
Cybersecurity: Threats and DefencesRecorded 1,088 August claims against 976 in July
Cybersecurity: Threats and Defences: Ransomware claims rose 11 per cent in AugustBackground
ThreatVectr is a cybersecurity news site operated by Imicus Group, whose editor is based in Brisbane, Australia. The site calls itself "an automated, AI-assisted newsroom"; human operators choose its sources and handle corrections.
ThreatVectr also publishes a monthly ransomware tracker, which counts claims posted to criminal leak sites as observed through ransomware.live. Every ThreatVectr report states that "a listing is an extortion tactic, not a confirmed breach". Monthly totals rise after first publication as late postings are scraped, and ThreatVectr revises earlier reports to match.
Because the tracker draws on ransomware.live, ThreatVectr's totals are not an Independent second count of ransomware activity. Citing a ThreatVectr total alongside a ransomware.live total for the same month does not corroborate either.
Late postings revise ThreatVectr's monthly tallies
ThreatVectr first put August 2026 at 1,088 claims against 976 in July, with posting groups up from 68 to 83. Qilin led on 165 and Italy climbed to third with 50. After late postings were scraped, the same report now shows 1,120 against 993.
Its September report counted 861 claims from 78 groups, with The Gentlemen first on 106 and Qilin down to 74. On 30 September ransomware.live itself showed 815, so the two figures are snapshots of one source taken at different times, not two independent counts. ThreatVectr's July and August revisions both went upward, which makes any first monthly total a floor.
