---
title: "Threat Intel Content Update: 5/20/25"
description: Tidal Cyber's threat intelligence content updates for the week of 5/20/25- NightSpire Extortion Group
---

[Threat Intelligence Content Updates ](https://www.tidalcyber.com/threat-updates)

# [Threat Intel Content Update: 5/20/25](https://www.tidalcyber.com/threat-updates/threat-intel-content-updated-5/20/25)

 Written by [Tidal Cyber](https://www.tidalcyber.com/threat-updates/author/tidal-cyber) | May 20, 2025 6:05:05 PM

#### NightSpire Extortion Group

**Threat Content Highlights**

**Threat Profiles**

- “Trending & Emerging Threats” weekly update: **NightSpire Extortion Group** 
    - [NightSpire](https://app.tidalcyber.com/groups/35aa3c2a-eea0-480a-b338-c82808643026?tab=3) is a new extortion group active in the ransomware ecosystem since early March 2025.
    - It is associated with the Rbfs ransomware group and is known for targeting various sectors opportunistically, primarily seeking to exfiltrate sensitive information and monetize through extortion or by selling the victim’s data.
    - In April 2025, NightSpire ranked among the top extortion groups that publicly claim victims, a newcomer to this list of top groups.
    - NightSpire is notable for emphasizing victim data exfiltration and uses multiple free/publicly available tools to accomplish this objective.
    - This Threat Profile includes the TTPs associated with NightSpire operators as well as those supporting tools, including the newly added [“Everything” discovery tool](https://app.tidalcyber.com/software/f7980d81-acd0-4e3e-b224-3d8424b72397).
- Monthly updates to Tidal-curated Threat Profiles: Major & Emerging Ransomware and Extortion Threats, Tidal Trending Techniques, Sector Threat Profiles, Capability Types, & Technology Tags

[View full post](https://www.tidalcyber.com/threat-updates/threat-intel-content-updated-5/20/25)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Tidal Cyber"
  },
  "dateModified" : "2025-05-20T18:16:05.044Z",
  "datePublished" : "2025-05-20T18:05:05Z",
  "headline" : "Threat Intel Content Update: 5/20/25",
  "image" : {
    "@type" : "ImageObject",
    "height" : 500,
    "url" : "https://21164103.fs1.hubspotusercontent-na1.net/hubfs/21164103/Threat%20Intelligence%20Content%20Update%20Social.jpg",
    "width" : 900
  },
  "mainEntityOfPage" : "https://www.tidalcyber.com/threat-updates/threat-intel-content-updated-5/20/25",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Threat Intelligence Content Updates"
  }
}
```