Vypr
🆕 New group Vypr presenta su primera publicación en el sitio de filtración el 27 de septiembre de 2026, hace apenas 10 días, sin registros previos en bases de datos de amenazas como MISP Galaxy o MITRE ATT&CK. No hay evidencia de parentesco con grupos conocidos ni indicios de que sea un cambio de nombre de otro grupo ransomware existente.
Profile
Vypr is a ransomware or extortion group for which no public information from threat-intelligence vendors, official agencies or specialised press was found as of October 2026; this profile relies solely on Orbitaley's own data. Its leak site was detected in late September 2026 and its first victim posts date from early October 2026. According to leak-site claims tracked by Orbitaley, it has listed three victims, all in the United States, in the construction, education and manufacturing sectors. Its initial access vectors, tooling, whether it encrypts systems or only steals data, and any links to other groups are unknown. It should not be confused with the similarly named commercial VPN service. It is considered an emerging, active actor whose claims are not yet confirmed.
Active since: 2026-09
What defenders should watch
- Require MFA on VPN, remote desktop and administrator accounts, the access paths most abused by emerging groups of this kind.
- Prioritise patching of Internet-facing edge devices (VPNs, firewalls, remote access gateways).
- Keep offline backups and regularly test restoration.
- Monitor for anomalous data egress and for unauthorised file-transfer or remote administration tools.
Most affected countries
- United States3
Most affected sectors
- Construction1
- Education1
- Manufacturing1
News and reports on Orbitaley
Recent victims
| Organisation | Country | Sector | Claimed | Status |
|---|---|---|---|---|
| Sims Vibration Laboratory | United States | Manufacturing | 10/7/2026 | ◌ Claimed (unverified) |
| Gen3 | United States | Construction | 10/7/2026 | ◌ Claimed (unverified) |
| Champaign Unit 4 School District | United States | Education | 10/7/2026 | ◌ Claimed (unverified) |
Claims are published by the criminal groups themselves and are unverified until the organisation or the press confirms them. Names of natural persons (sole traders, individual professionals) are anonymised under the GDPR. We never link to leak sites or stolen data. To request the removal or anonymisation of an entry, contact the site administrator.
Sources: RansomLook (CC BY 4.0), MITRE ATT&CK®, MISP Galaxy, Google News.