THREAT WATCH · October 18, 2026 · RANSOMWARE LISTING
Ascom appears on ransomware tracker
On October 18, 2026, the organization recorded as www.ascom appeared on a ransomware tracker. The listing names a ransom group and notes the organization is based in Italy in the IT sector. The company size is listed as 51-100. Disclosure status is not disclosed yet. This is a signal, not a confirmed breach.
- Attack group
- ITALY.IT SERVICED BY WWW.EMILCOM.IT — BLACKNEVAS
- Listed domain
- www.ascom
- Record date
- October 18, 2026
- Location on record
- Italy
- Sector
- IT
- Reported size
- 51-100 employees
- Disclosure on record
- Not disclosed yet
Key takeaways
- Ascom appears on a ransomware tracker as of October 18, 2026.
- The listed organization is based in Italy and operates in the IT sector.
- Company size is recorded as 51-100 employees.
- Disclosure status is not disclosed yet; this is a signal, not a confirmed breach.
What was recorded
- Organization: www.ascom
- Domain: www.ascom
- Ransom group: ITALY.IT SERVICED BY WWW.EMILCOM.IT BLACKNEVAS
- Listing date: October 18, 2026
- Country: Italy
- Sector: IT
- Company size: 51-100
- Disclosure status: Not disclosed yet
What this means
A listing means the organization appears on an attacker-side ransomware tracker. It is strong signal, not a confirmed breach. No confirmed data loss or system compromise is established by the listing alone. Treat the entry as an early warning that warrants verification and readiness checks.
Recommended actions
- Verify backups and incident response readiness.
- Monitor for any official disclosure from the organization.
- Review access controls, patching, and endpoint monitoring.
- Prepare a communications plan in case details emerge.
Key details
The recorded entry identifies www.ascom with domain www.ascom. The associated ransom group is listed as ITALY.IT SERVICED BY WWW.EMILCOM.IT BLACKNEVAS. The organization is recorded in Italy within the IT sector with a company size of 51-100. As of the listing date, disclosure status remains not disclosed yet.
SOURCE: INTEL128 THREAT INTELLIGENCE FEED (UPDATED OCT 19, 2026). A listing is a record on an attacker-side ransomware tracker - strong signal, not a confirmed breach. Intel128 publishes what the feed shows and no more.