Ransomware Group
Spacebears
Space Bears is a double-extortion ransomware group that emerged in April 2024, distinguished by a professional "corporate" aesthetic on its leak site, leveraging Phobos RaaS infrastructure and targeting small-to-medium organizations in manufacturing, technology, and healthcare across the US and Europe.
Known victims159
Threat level
HIGH
Get an alert if one of your domains is named on a ransomware leak site.
Monitor your domainsFree account · up to 5 monitored targets
Tactics, Techniques & Procedures (TTPs)
DefenseEvasion
- Defender Control
LOLBAS
- BCDEdit
- VmConnect
- WMIC
- fsutil
- netsh
- +1 more
Known infrastructure
The following Tor hidden services have been associated with this group:
Space Bears
These sites are malicious. Open them only from an isolated environment.
Check if you’re affected
Look up your domain to see whether it appears on Spacebears’s victim list.
Try it nowFree⌘K
Try
risk score · threat categories · sources · age · confidence — in one request