THREAT OPS › Threat News › [play] S&H Express — ransomware leak-site post
[play] S&H Express — ransomware leak-site post
Ransomware group: play Victim (as posted on leak site): S&H Express Discovered: 2025-06-15 00:43:06.916033 Source: ransomwatch leak-site monitor Note: leak-site listings typically precede public disclosure.
Attributed threat actors
- PlayG1040
Original source: https://github.com/joshhighet/ransomwatch