THREAT WATCH · September 28, 2026 · RANSOMWARE LISTING

THREEAM Lists apexus.com on Ransomware Tracker

Intel128 has recorded a new listing on the ransomware tracker operated by the group known as THREEAM. The entry, dated September 28, 2026, references the organization behind the domain apexus.com. The company operates in the Services sector and is based in the United States. Its workforce falls within the 101 to 1,000 employee range. As of this writing, the organization has not publicly acknowledged the listing or confirmed any data compromise. Intel128 is treating this as an unverified signal pending further corroboration.

Key takeaways

• apexus.com appears on a tracker maintained by ransom group THREEAM, listed September 28, 2026
• The organization is a US-based Services company with 101 to 1,000 employees
• No public disclosure or breach confirmation has been observed from the organization
• Treat the listing as an unverified signal until corroborated by technical evidence

What the listing tells us

• The domain apexus.com appears on a tracker maintained by the ransom group THREEAM.
• The listing was recorded on September 28, 2026.
• The organization is headquartered in the United States and operates in the Services sector.
• Company size is estimated between 101 and 1,000 employees.
• No public disclosure from the organization has been observed at this time.
• Intel128 has not identified any additional technical indicators tied to this entry beyond the listing itself.

What this does not confirm

A listing on an attacker-side tracker is a strong signal that a ransomware group claims to have taken data or disrupted operations. It is not, by itself, proof of a breach. Groups sometimes list organizations to apply pressure, to inflate their perceived capability, or to create noise around unrelated campaigns. Until the organization or a credible third party confirms compromise, the situation should be treated as unverified. Intel128 does not publish breach confirmations based solely on tracker entries.

Context on THREEAM

THREEAM is a ransomware group that maintains a public-facing tracker where it posts victim names and domains. Its naming convention and posting cadence are consistent with commercially motivated ransomware operations that use public shaming as a negotiation lever. Intel128 continues to monitor THREEAM activity for patterns that may indicate targeting preferences or escalation in tactics.

What organizations in this sector should consider

• Review whether your own domain or brand appears on any attacker-side tracker. Intel128 monitors these feeds continuously and flags new entries within its reporting window.
• If you operate in the Services sector in the United States with a similar headcount, assess your exposure to the tactics THREEAM has been observed using.
• Confirm that your incident response plan includes a public communications step for situations where a ransomware group lists your name before you have confirmed a breach internally.
• Ensure your legal and compliance teams are prepared to evaluate notification obligations under state and federal rules if a listing is later corroborated by technical evidence.
• Consider whether your third-party risk program covers mid-sized service providers in the 101 to 1,000 employee band, as this range appears frequently in recent listings.

Intel128 assessment

The listing is credible as a signal but unconfirmed as a breach. Intel128 will update this entry if the organization issues a statement, if additional technical evidence surfaces, or if the listing is removed from the tracker. Organizations with a dependency on apexus.com for any part of their supply chain should monitor for follow-on disclosures and prepare contingency plans for service disruption scenarios.

SOURCE: INTEL128 THREAT INTELLIGENCE FEED (UPDATED OCT 01, 2026). A listing is a record on an attacker-side ransomware tracker - strong signal, not a confirmed breach. Intel128 publishes what the feed shows and no more.