LIVE Threat Watch 36 actively exploited vulnerabilities added in the last 30 days. Latest: CVE-2026-118527 in Ivanti Connect Secure See all live vulnerabilities
+44 1865 950 828 Secure Your Business
ActiveLimited Reporting

Space Bears

A ransomware brand with a corporate-styled leak site, first seen in April 2024 and linked by several sources to Phobos. Sophos says which ransomware it now uses is unclear.

Threat actor profile. Last reviewed 3 November 2026.

Overview

Why It Matters

Limited Public Reporting

Few credible public sources cover this name. This page states only what they support, so gaps here do not mean the group lacks those capabilities.

The exact relationship with Phobos is unsettled. Infosecurity Magazine reports S-RM's view that Phobos teams use the site to host stolen data, and that it is unclear whether it is the only such site.2 Sophos lists Space Bears among name-and-shame sites set up by affiliates of GOLD EQUINOX, its name for the group behind Phobos, and says Space Bears' ransomware variant is now unclear.3

Claims on leak sites are not proof. In January 2025 a large IT services firm publicly rejected a Space Bears claim, saying the affected infrastructure was a third party's and was not managed by the firm.2

The sources we reviewed do not establish a UK link.

Our View

Anything we say about tactics is inherited from Phobos reporting, not from this brand. We would treat exposed RDP as the first thing to fix, as Sophos says Phobos affiliates often relied on it.

Vulnerabilities

The sources we reviewed do not tie a CVE to Space Bears.

History

Key Events

  1. The leak site first appears.2

  2. Phobos's operator is extradited to the US and 8BASE operators are charged.3

  3. An IT services firm publicly denies a claim by the group.2

  4. Sophos records Space Bears as still operating.3

  5. AhnLab lists the group among established ransomware groups.4

What To Do

Defences That Matter

Close Remote Access Gaps

  • Take RDP off the internet, as Phobos affiliates often used it.3
  • Use unique passwords and multi-factor authentication.1
Identity security and PAM

Limit the Damage

  • Segment the network.1
  • Keep secure offsite backups.1
Business continuity and disaster recovery

Check Claims Before Reacting

  • Prepare to verify a leak site claim quickly, including data held by third parties.
  • Agree who makes public statements.
Incident response

Is RDP Still Exposed on Your Network?

We can help you find exposed remote access and prepare for a leak site claim.

Talk to Our Team
Evidence

Sources

  1. Tripwire (guest article): Space Bears Ransomware: What You Need To Know, undated
  2. Infosecurity Magazine: report on an IT services firm's denial of Space Bears claims, 3 January 2025
  3. Sophos: GOLD EQUINOX threat profile, undated, refers to March 2026
  4. AhnLab ASEC: May 2026 Threat Trend Report on Ransomware, 19 June 2026