THREAT WATCH · September 28, 2026 · RANSOMWARE LISTING

THREEAM Lists UK Construction Firm safescaffolding.net

A domain linked to a UK construction and real estate firm has been recorded on a ransomware tracker operated by the THREEAM group. The listing, dated September 28, 2026, identifies safescaffolding.net as a target. No public disclosure has been made by the organization itself, and the listing should be treated as an indicator of possible compromise rather than a confirmed breach.

Key takeaways

• safescaffolding.net was recorded on a THREEAM ransomware tracker on September 28, 2026
• The firm is UK-based, small (0-50 staff), and operates in construction and real estate
• No public disclosure has been made by the organization
• Listings are strong indicators of attacker activity but do not independently confirm a breach

What the listing shows

• The domain safescaffolding.net appears on a tracker maintained by the THREEAM ransomware group.
• The listing date is September 28, 2026.
• The organization is based in the United Kingdom.
• It operates in the construction and real estate sector.
• Company size is estimated at 0 to 50 employees.
• No public disclosure has been made by the organization as of the listing date.

About the THREEAM group

THREEAM is a ransomware operation that publishes victim listings on its own tracker. Groups like this typically use the tracker as a pressure mechanism: if a victim does not pay or respond within a set window, the listing becomes public. The presence of a domain on such a tracker is a strong signal that the group claims to have obtained data, but it does not independently confirm that data was exfiltrated or that systems were compromised.

Risk context for small firms

Small and mid-sized firms in construction and real estate are increasingly targeted by ransomware groups. Several factors make them attractive to attackers:

• They often hold sensitive client data, including contracts, site plans, and financial records.
• They may lack dedicated security teams or formal incident response plans.
• Their operational continuity depends on access to project files and communication systems, making downtime costly.
• They may be connected to larger supply chains, giving attackers leverage beyond the immediate target.

A firm with 0 to 50 employees is unlikely to have a full-time security function. This does not mean the firm was negligent, but it does mean the capacity to detect, contain, and respond to an intrusion may be limited.

What organizations should do

If you operate in the construction or real estate sector, or if you have commercial relationships with the listed domain, consider the following steps:

• Verify whether your own systems or data were shared with or accessible by the listed organization.
• Review recent network logs for unusual outbound traffic or authentication anomalies.
• Confirm that backups are current, isolated, and tested.
• Ensure incident response plans are up to date and that staff know their roles.
• Monitor for any follow-up activity, including potential extortion communications or secondary listings.

Intel128 assessment

The listing is credible as a signal of attacker activity. However, without a public statement from the organization or independent forensic confirmation, the full scope of any incident remains unknown. Intel128 will update this entry if further information becomes available.

SOURCE: INTEL128 THREAT INTELLIGENCE FEED (UPDATED OCT 01, 2026). A listing is a record on an attacker-side ransomware tracker - strong signal, not a confirmed breach. Intel128 publishes what the feed shows and no more.