A brewery in Freising, a timber house builder, a tax advisory firm in Münster and an IT systems house in North Rhine-Westphalia all appeared on the same leak site within two days last week. The crew behind it, Lamashtu, spent its first months hitting companies in Thailand, Mexico, India and Egypt. Since it came back from a three-month silence on September 30, roughly half of everything it has posted has been German.
These are extortion claims the crew published itself. None has been independently confirmed, and none of the named companies has, as far as we can see, said publicly that it was breached.
Ten German names in four weeks
In IntelFusions' incident data, Lamashtu posted 34 victims between April and June 2026, of which three were German. It then went almost silent: two listings in June, nothing in July or August. On September 30 it returned with a batch of ten names in a single day, and it has posted 21 victims since.
Ten of those 21 are German companies, going by the company descriptions on the ransomware.live tracker entry for the group. They are mostly small and mid-sized firms: Becker Logistik, facility services company Wilhelm Kühne, tool maker PROJAHN and security installer Altmannshofer Sicherheits-Videotechnik on September 30; grandstand builder Bender Tribunenbau on October 5; and FuG-Gruppe, WEPOS Chemie, Gräfliches Hofbrauhaus Freising, VERGI Muenster and Hecker Holzsystembau on October 21 and 22. The rest of the recent list is French, Spanish, Mexican, Italian, Argentine and Australian.
The tracker describes Lamashtu as an extortion group first seen in April 2026, and notes that it has not been confirmed to run file-encrypting ransomware rather than pure data-theft extortion. It counts 54 victims in total, with manufacturing the largest sector by a wide margin. Our own profile is at Lamashtu.
Germany's week on the leak sites
Lamashtu is not the whole picture. Across all crews, Germany drew 20 of the 230 leak-site claims in our data for the seven days to October 26, about 8.7 percent. Over the previous twelve weeks its share averaged 4.5 percent. Those 20 claims came from nine different crews, including Qilin, Akira, Payload, Emperador, Rhysida and Everest, so this is not one campaign. Five of the 20 were Lamashtu's.
The pattern has a precedent. In August a different newcomer, covered in New ransomware crew Za Woo opens with 10 German victims, also built its debut around German mid-sized firms.
An IT systems house is the listing to watch
Most of the names are single companies whose exposure ends at their own data. FuG-Gruppe is different: the tracker describes it as an IT systems integrator and general contractor in Halver. If that claim is genuine, the firm's own customers are the ones who should be checking their remote access paths and any credentials or management tools the integrator holds for them. A tax advisory firm's client files raise a similar second-order concern for the clients whose returns it prepares.
For German small and mid-sized businesses, and especially their IT service providers:
- Audit remote access, VPN and remote management accounts held by outside providers, and remove any that are not in active use.
- Enforce multi-factor authentication on email, VPN and remote desktop, and reset credentials that infostealer monitoring flags as exposed.
- Keep at least one backup set offline and test that it restores.
- Report suspected incidents to the BSI or the relevant state cybercrime contact point, and to customers whose data you process.
A crew that posts in batches of five and ten, after a quiet summer, with a sudden national focus, may simply have bought or found a new route into one kind of German network. The claims prove nothing on their own. The shape of the list is worth watching anyway.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.