Skira

Skira, also referred to as Skira Team, is a ransomware threat actor first observed as a new entrant in the 2024 ransomware ecosystem and later tracked among emerging groups active into 2025. Public reporting places it among the wave of newly emerged ransomware brands that contributed to the fragmentation and rapid turnover of the extortion landscape. High-confidence information on Skira remains limited. The group has been identified in ransomware victim-claim tracking and in monitoring of emerging ransomware actors affecting industrial organizations. Available reporting supports classifying Skira as a ransomware/extortion actor, but does not provide sufficient corroborated detail on its malware family design, intrusion playbook, access vectors, affiliate structure, or whether it operates as a standalone crew or a ransomware-as-a-service program. Specific technical behaviors such as credential theft, lateral movement, persistence, or defense evasion are not established at high confidence from the available facts. Known aliases include Skira Team. Publicly attributed victim claims indicate activity against organizations in sectors including real estate-related services, legal services, information technology services, consumer products, and local government. The actor should be treated as an emerging ransomware cluster with sparse confirmed attribution and limited publicly corroborated TTP reporting.