Incident response · Lamashtu extortion
Found a note from Lamashtu? You have about three days before the price goes up.
Lamashtu, named after a Mesopotamian demon, put up its leak site in April 2026 and named 17 organisations in its first three weeks. It went quiet in the middle of the year, then started listing again in September. By October it had named about 47 victims, most of them manufacturers. Its note sets a three-day deadline to make contact and a ten-day deadline before publication. Those two clocks shape everything you do first.
Recognise it
How to confirm it is Lamashtu.
Keep WHAT_HAPPENED.readme.txt, any encrypted files and every message from the operator exactly as they are. Do not delete, restore over or rebuild anything until the evidence is captured.
- Ransom note
- WHAT_HAPPENED.readme.txt, which carries the Lamashtu name, says files have been encrypted and data stolen, and lists financial, employee and client records as taken
- File extension
- Not publicly documented. No public analysis has yet published a Lamashtu encryptor or a fixed extension. If files next to the note have an unfamiliar extension, keep them exactly as they are, because they identify the build
- The listing
- A post on Lamashtu Blog, a Tor site, with a countdown, file counts, data volumes, proof samples and a per-victim "Breach Impact Report". Contact runs through an anonymous onionmail address with a PGP key, or a separate chat portal
- Typical entry
- Not confirmed case by case in public reporting. The working assessment is stolen credentials against internet-facing remote access, such as RDP or a VPN without multi-factor authentication. One tracker found leaked employee credentials for 7 of the first 47 victims in the year before they were named
Behaviour
What Lamashtu does to your systems.
Two clocks in the note
The note gives three days to make contact before the price rises, and ten days before the data is published. The leak-site countdown runs alongside it. The first clock is there to rush you into a conversation before you have counsel or an insurer on the line.
Data first, at volume
Red Piranha counted more than 760 gigabytes claimed across twelve victims in the first weeks, the largest about 250 gigabytes. Bulk theft at that scale means the attacker had time inside the network, so assume dwell time of weeks, not hours.
Pressure through regulators
The note invokes GDPR, CCPA and HIPAA penalties, and it tells victims not to contact police, not to restore from backup and not to hire incident responders. All three are what you should do. The instruction is the tell.
It publishes in stages
Listings name the victim and post samples first. More follows if nobody pays. The site also exposes a machine-readable list of victims, so trackers and other criminals pick up a new listing within hours.
Manufacturers first
Of the victims with a known sector, manufacturing is the clear leader, followed by healthcare, construction, technology and food production. France, Germany, Spain, Malaysia, Thailand and Mexico account for most listings.
Encryption claimed, not yet documented
The note says files were encrypted with a "military-grade algorithm". No encryptor sample has been published, so public profiles treat Lamashtu mainly as a data-theft crew. Plan for both: some victims will see locked files and some will not.
The honest answer
What can be recovered?
It depends on which of two situations you are in. If nothing is locked, there is nothing to decrypt, and the work is about the data that left: what it was, whose it was and when it went. If files are encrypted, keep every one of them and every copy of the note. No public decryptor exists, and how much comes back depends on the encryptor, which a sample of the files tells us within hours.
Either way, start with the claim. Check the proof samples and file counts against your own systems, then work out what left and when from your firewall, VPN and remote access logs before they roll over. Your obligations run from that point. An eligible data breach assessment under the Privacy Act has 30 days, and if a ransom is ever paid by a business with more than three million dollars in turnover, the payment must be reported within 72 hours.
Keep the note, any encrypted files, the leak-site listing and every message from the operator exactly as they are, and export your firewall and remote access logs today. That is the evidence that scopes the incident and answers the regulator.
Common questions
Lamashtu, in plain terms.
Mid-incident and need a straight answer? Call 1300 004 766. A person answers, 24 hours a day.
What is WHAT_HAPPENED.readme.txt?
It is the ransom note left by Lamashtu, an extortion group that appeared in April 2026. It names the group, claims files were encrypted and data stolen, and sets a three-day deadline to make contact and a ten-day deadline before publication. Keep every copy where it is. It is evidence, and it ties the incident to the leak-site listing.
Does Lamashtu actually encrypt files?
The note says it does, but no public analysis has yet published a Lamashtu encryptor, file extension or decryptor, so most public profiles describe it as mainly a data-theft group. Do not rely on either story. Check your own systems: if files are renamed and will not open, treat it as encryption and keep them untouched. If nothing is locked, the incident is about the data.
Should we contact Lamashtu before the three-day deadline?
Not before counsel, your insurer and an incident responder are involved. The short deadline exists to make you talk before you know what was taken. Missing it raises their asking price. It does not change your legal position, and nobody can verify the operator's promises to delete data.
The note says not to contact police or restore backups. Should we listen?
No. Report to the ASD's ACSC on 1300 CYBER1 and keep your backups safe and offline. Restore only after the evidence has been captured and the way in has been closed. Every instruction in the note serves the attacker. Restoring too early destroys evidence, and staying silent only keeps you away from help.
What are our notification obligations?
If personal information was taken and serious harm is likely, the Notifiable Data Breaches scheme requires an assessment within 30 days and notice to the OAIC and affected people once you know. If a ransom is paid by a business with annual turnover above three million dollars, the Cyber Security Act 2024 requires a report within 72 hours. Insurers, contracts and sector regulators may add clocks of their own.
What should we do in the first hour?
Keep the note, any encrypted files and the listing, isolate affected machines but leave them powered on, take backups offline, export your firewall, VPN and remote access logs, and reset the credentials on any internet-facing access with multi-factor authentication turned on. Do not reply to the operator, do not restore over anything and do not pay in a panic. Our First-Response Guide covers this on one page, and 1300 004 766 is answered around the clock.
Not Lamashtu?
The extension on your files names the strain.
If the note or extension does not match what is on this page, one of these may fit. If none of them do, call anyway: the strain shapes the recovery, but identifying it is our job, not yours.
.akira
Akira →
Consistently among the most active strains in Australia. Partial encryption by design.
random extension
Qilin →
The most active operation of 2026. Every victim gets a unique file extension.
.inc
INC Ransom →
Subject of a 2026 ACSC joint advisory. Heavy targeting of Australian healthcare.
.LYNX
Lynx →
Built on the INC Ransom code. Encrypts 5, 15 or 25 percent of each file, so most of a large file survives.
.fog / .flocked
Fog →
Education-focused, enters via VPN credentials, attacks backups first.
.safepay
SafePay →
Encryption depth is a setting, and operators pick shallow. Enters on valid VPN and RDP credentials.
.dragonforce_encrypted
DragonForce →
Full, partial or header-only per file. Dedicated ESXi builds hit whole virtual estates.
README-GENTLEMEN.txt
The Gentlemen →
Busy in Australia through 2026. Comes in through FortiGate, kills endpoint security, then encrypts as little as 1 to 9 percent of each file.
no extension (via your IT provider)
Storm →
New in August 2026. Reaches Australian businesses through a compromised IT provider and lists them with long countdowns.
no extension (theft only)
Kairos →
Never encrypts. Steals data and runs a seven-day clock. Nine Australian victims since 2024.
Or start from ransomware recovery, which covers the method whatever the strain turns out to be.
After the incident
The same responders, before the next one.
Most Lamashtu recoveries end with the same short list: the remote access that had no MFA and the backup the attacker could reach. Fortify is our managed security plan, built from that list. Fortify clients get this incident response team as part of the plan, with no hourly cap on in-scope incidents.
Right now
The first hours decide what can be saved.
Preserve the note and logs, close the remote access they likely used, start the notification clock, and call before anyone contacts the operator. Australian incident response, answered by a real person.
Outcomes described are specific engagements. No recovery is guaranteed.