Threat Intelligence Report March 3 - March 9 2026

XP95 Ransomware

Red Piranha's threat intelligence team identified XP95 as a newly emerged data-extortion actor, first observed on 4 March 2026. Unlike conventional ransomware operators, XP95 does not deploy encryption malware. The group operates a pure exfiltration-and-extortion model: sensitive data is stolen from the victim environment, a proof-of-compromise sample is published on a Tor-hosted Data Leak Site (DLS) and cross-posted to BreachForums, and a ransom demand is issued with a hard payment deadline. Failure to pay results in full public release or sale of the stolen dataset. XP95's sole confirmed victim within the 28 February – 6 March 2026 reporting window is Eholo Health, a Spanish mental-health SaaS platform serving over 10,000 psychologists across Spain and Andorra. The actor's BreachForums profile was freshly created at the time of first appearance, with no prior references in threat intelligence reporting linking XP95 to any known organised group or prior campaigns.

Tactics, Techniques & Procedures (TTPs)

No validated technical TTPs have been published by any threat intelligence source. No security vendor, incident-response firm, or government agency has released a technical analysis of XP95's intrusion methods, tooling, or infrastructure. The TTPs below are limited to what is directly observable from DLS posts, BreachForums activity, and public breach reporting.

No validated MITRE ATT&CK mapping exists for XP95. No published threat intelligence source has attributed specific MITRE technique IDs to this actor. A mapping will only be possible if/when a technical incident response report or malware sample analysis is published. Speculative mappings have been intentionally omitted.

Indicators of Compromise (IoCs)

Tor Data Leak Site

Communication Channels

Data Sample Hosting (biteblob.com)

CE 5.5 Mitigation Recommendations

The following mitigations are mapped to Cyber Essentials (CE) 5.5 controls and are directly applicable to the XP95 threat profile. Given that XP95 operates as a pure data-exfiltration actor - with no encryption component -  defences must prioritise preventing unauthorised access to sensitive data repositories, detecting large-volume outbound data transfers, and securing privileged account pathways. Healthcare and SaaS providers are the current primary target profile.

• Enforce role-based access control (RBAC) across all data repositories and SaaS management interfaces. Limit access to clinical records and PII to verified, business-justified users only. Audit and revoke excess permissions quarterly.
• Mandate phishing-resistant MFA (FIDO2/hardware token) for all privileged accounts, VPN gateways, and SaaS admin portals. SMS-based MFA is insufficient; replace with authenticator apps or hardware keys for high-risk roles.
• Deploy DLP (Data Loss Prevention) controls to monitor and alert bulk transfers of sensitive data. Establish baselines for normal egress traffic volume and alert on anomalous outbound transfers exceeding threshold, particularly to file-sharing platforms (e.g. biteblob.com).
• Ensure documented IR playbooks cover pure data-exfiltration scenarios (not only ransomware encryption). Confirm GDPR/NIS2 notification timelines are met (72 hours to supervisory authority). Engage DPA (e.g. AEPD for Spain) and relevant national police immediately upon confirmed exfiltration.

Ransomware Victims by Geography

The United States remained the dominant target this period with 53.5% (130 incidents) of all recorded ransomware victims. This means more than half of all known attacks occurred against US-based organisations, continuing the long-standing pattern of North America being the primary focus of ransomware operations.

A second tier of countries accounted for much smaller but still notable shares. Germany represented 5.76%, followed by Canada (4.94%), United Kingdom (4.53%), and France (4.12%). Australia also recorded a significant presence with 3.7% of victims. Together, these countries make up the majority of activity outside the United States and reflect regions with large digital economies and extensive enterprise infrastructure.

A mid-range group included South Korea, India, and Spain (each 2.06%), along with Italy, Israel, and Turkey (each 1.65%). These figures indicate continued ransomware exposure across both European and Asia-Pacific markets.

Several countries recorded smaller but recurring activity at 0.82%, including Singapore, Malaysia, Brazil, Netherlands, United Arab Emirates, and Thailand.

The remainder of the dataset forms a long tail of single-incident countries at 0.41% each, including Greece, Russia, Portugal, Japan, Mexico, Switzerland, Austria, China, Norway, Philippines, Belgium, Georgia, Romania, Lebanon, Pakistan, Egypt, and Madagascar.