UmBra — Ransomware Profile
UmBra is an extortion crew that WatchGuard's ransomware tracker classifies as an emerging data broker using direct and double extortion alongside free data leaks, first seen in October 2026. WatchGuard notes that UmBra's leak site looks exactly like that of the BYOD group, which began operating around the same time, and records only a general association between the two. Within its first week the crew listed ten organisations, weighted towards universities in Egypt and India, among them Cairo University, Helwan University, Beni Suef Technological University, IIT Roorkee and Manipal Academy of Higher Education, alongside the mining group Tharisa, the Saudi security firm Raqib and the US furniture company Four Hands. WatchGuard also lists a Telegram channel and a Session contact for the group. These listings are the group's own claims and have not been independently confirmed.
Recent claimed victims
Vendor research
Read the full analysis on IntelFusions