An extortion crew called Wallstreet put ten Swedish organisations on its leak site on 13 October, the first Swedish names in our tracking of the group. Four are architecture practices, all of which the independent tracker ransomware.live describes as Stockholm firms. Another is Danvikshem, the foundation that runs elder care in Nacka, just east of the capital. According to the tracker's records, all ten listings appeared within about three minutes of each other, between 16:52 and 16:55 UTC.
None of the ten had publicly confirmed an incident that we could find at the time of writing. Every listing is a claim written by the gang itself, and the tracker records show no stolen data or leak size for any of them.
One afternoon, more than any week since July
Sweden is not usually a busy country on the leak sites. Our incident tracking recorded 27 claims against Swedish organisations in the 13 weeks before 12 October, and never more than four in a single week. The 10 posted on 13 October are all Wallstreet's, and no other crew has named a Swedish victim since.
The architecture practices named are Ahlqvist & Almqvist Arkitekter, Brunnberg & Forshed Arkitektkontor, Byrån för Arkitektur och Urbanism and Spectrum Arkitekter. The Danvikshem entry lists the foundation by its formal name, Stiftelsen Danviks Hospital. The other five are Vendus Sweden, which the tracker describes as a property owner focused on grocery-anchored retail; Mantum Holding, linked in the tracker to a transport and logistics group; Fab Support, described as a supplier of electronic components and telecoms equipment; and two firms the tracker could not profile at all, Englunds Konsultbyrå and Briab Group.
A crew that mostly hunts in the United States
Wallstreet surfaced on tracking platforms in late June, and we first covered it in July, when it claimed a US police department and a rural hospital. Our data now holds 43 Wallstreet claims, 24 of them against American organisations and 26 posted in the last 30 days alone. Its batch on 13 October also included a nonprofit senior-living home in Hildesheim, Germany, so Danvikshem was one of two elder-care operators it named that day.
The vendor research summarised on our Wallstreet actor page is worth bearing in mind. WatchGuard classes the group as a data broker that uses direct extortion, double extortion and re-leaks, and records that its earliest listing recycled a victim LockBit had already claimed. SOCRadar reports that it gets in through compromised credentials and remote-access services such as VPN and RDP.
What a same-day cluster can and cannot show
Four architecture practices in one city, posted minutes apart, is the kind of pattern that sometimes traces back to a shared supplier, such as a common IT provider or project platform. Nothing the crew or the tracker has published identifies one, though, and the same batch takes in property, logistics and electronics firms that have no obvious link to the architects. A bulk upload of unrelated intrusions would look exactly the same from the outside. Given the group's record of re-leaks, it is also possible that some entries recycle older data. We assess the supplier explanation as possible but unsupported for now.
Check remote access, and the 72-hour clock
Organisations on the list, and anyone who shares IT suppliers or project portals with them, should review VPN and remote desktop access logs and reset credentials for those services, given how SOCRadar says the group operates. Clients and residents' families should treat unexpected messages that cite real projects, invoices or care details with suspicion. Under the GDPR, an organisation that confirms a personal data breach must notify Sweden's data protection authority, IMY, within 72 hours, and CERT-SE handles national incident reporting. Wider context, including the Cybersecurity Act that took effect in January, sits on our Sweden page.
Ten names in three minutes tells us where Wallstreet chose to apply pressure this week. Until it publishes data, or one of the ten speaks, that is all it tells us.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.