1. Executive summary
A ransomware leak-site listing posted on 2026-10-12 names Cognosis Limited, a UK-registered entity, as a victim of the group tracked as "nightspire". The listing carries no victim website, no data samples, and no stated ransom demand; the indexed page returns no content beyond the group and victim names. No CVE, no exploited component, and no initial-access vector is identified in the source material, so the intrusion mechanism is unknown. The actor "nightspire" has no MITRE ATT&CK profile in our reference data, so the attribution is unconfirmed and the group's tradecraft, tooling, and targeting pattern cannot be characterised from this item. For EMEA financial services clients, the direct exposure is limited to any third-party or counterparty relationship with Cognosis Limited; the operational risk is the absence of technical detail, which prevents targeted detection and forces reliance on generic ransomware controls.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 18 | A UK entity is publicly named on a ransomware leak site; if a client holds an ICT third-party or intra-group dependency on Cognosis Limited, the incident may meet the classification threshold for an ICT-related incident. | The client must run its own classification against Art. 18 criteria; the listing alone does not establish a major incident, and no data-theft or availability impact is confirmed in the source. |
| DORA Art. 28 | The only fact available is a named third party; if Cognosis Limited is an ICT third-party provider in the client's register, the incident engages third-party risk principles. | The client must confirm whether Cognosis Limited appears in its ICT third-party register and, if so, initiate the contractual notification and assessment path. |
| NIS2 Art. 21(2)(d) | A supply-chain entity is named as a ransomware victim; where the client is an essential or important entity relying on that supplier, supply chain security measures are engaged. | The client must assess whether the dependency creates a supply chain exposure and whether existing supplier security measures cover it. |
No DORA Art. 17, 19, 24, 29 or 30 trigger, and no NIS2 Art. 23 or UK NIS 2018 trigger, is established by the facts in this item. The listing does not confirm a reportable incident, a concentration risk, or a contractual breach.
3. Technical analysis & attack chain
The source material does not support a confirmed attack chain. The only verified facts are the group name ("nightspire"), the victim name (Cognosis Limited), the country (GB), and the publication timestamp (2026-10-12T13:29:00Z). The indexed page states "Data is not available now", which means no leaked files, no sample data, and no proof-of-compromise artefact are exposed on the listing at the time of writing.
Because no initial-access vector, exploited component, CVE, payload, persistence mechanism, command-and-control channel, lateral movement path, or exfiltration detail is present in the source, we cannot describe the intrusion. Any statement about how the actor gained access, what malware was deployed, or what data was taken would be fabrication and is not made here.
Two points of uncertainty must be stated plainly. First, the actor "nightspire" has no MITRE ATT&CK profile in our reference data; the group's identity, sponsorship, and prior campaigns are unconfirmed, and the name may be a rebrand, a splinter, or a low-volume operation with no established track record. Second, the listing is single-sourced to ransomware.live, an aggregator that indexes publicly visible operator posts; the aggregator explicitly states it does not access or obtain the underlying stolen content. A leak-site listing is a claim by the operator, not independently verified evidence that data was exfiltrated or that systems were encrypted. Treat the listing as an unconfirmed assertion until corroborated by the victim, a regulator, or a second independent source.
4. Mitigation & containment
P1 (within 24h)
- Confirm whether Cognosis Limited appears in your ICT third-party register, your supplier list, or any active contract. If it does, notify your third-party risk and procurement owners and request a status statement from the supplier.
- If you hold a direct technical dependency on Cognosis Limited (hosted service, API, data feed, shared credentials), treat the dependency as untrusted until the supplier confirms otherwise. Rotate any shared secrets, API keys, or service accounts that touch that relationship.
- Search your email gateway, EDR, and proxy logs for any inbound communication or callback referencing Cognosis Limited domains or the nightspire group name. Do not action the group name as a detection string on its own; it is an actor label, not a threat artefact.
P2 (within 72h)
- If the supplier relationship is material, invoke the contractual security-incident notification clause and request the supplier's incident timeline, scope, and containment status in writing.
- Review backup integrity and restore-test records for any system that shares infrastructure or identity with the Cognosis Limited dependency. Confirm at least one offline or immutable copy exists and that a restore has been tested in the last 90 days.
- Verify that EDR coverage is complete on any endpoint or server that communicates with the supplier, and that ransomware-canary files or equivalent tripwires are in place on file shares.
P3 (within 7 days)
- Re-run your DORA Art. 18 classification against the facts once the supplier responds. If the supplier confirms a major incident affecting your data or availability, escalate to the Art. 19 reporting path.
- If the supplier cannot confirm or deny within 7 days, escalate the relationship to your third-party risk committee and consider whether the dependency should be reduced or exited under your Art. 28/29 concentration review.
- No vendor fix, patch, or version pin is available from this item because no product or CVE is identified. Do not invent one.
5. Indicators of compromise
No indicators of compromise available in the source material. The listing contains no hashes, domains, IP addresses, file paths, registry keys, or email addresses. The only named entities are the actor label "nightspire" and the victim "Cognosis Limited", neither of which is a machine-pivotable indicator.
Behavioural indicators: none available. The source describes no authentication pattern, device registration, process activity, or network behaviour.
6. Detection
Insufficient indicators to author detection rules.
The source contains no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names, registry keys, ransom-note text, or hard-coded values. The actor name and victim name are not threat artefacts; a rule built on them would detect reporting about the incident, not the incident itself.
7. Sources
- ransomware.live, "Victim: Cognosis Limited – nightspire", https://www.ransomware.live/id/Q29nbm9zaXMgTGltaXRlZEBuaWdodHNwaXJl, published 2026-10-12.
Single source. The listing is an aggregator index of an operator post; no independent corroboration of the compromise, the data theft, or the actor's identity is available in the material provided.
8. Adverse Trace position
Adverse Trace assesses this item as low technical confidence and unconfirmed attribution. The actor "nightspire" has no MITRE ATT&CK profile in our reference data, so we do not attribute the intrusion to any known group, and we do not treat the leak-site listing as verified evidence of data exfiltration or encryption. The severity to EMEA financial services clients is contingent entirely on whether Cognosis Limited is a material ICT third-party dependency; absent that relationship, the direct exposure is negligible. We will monitor for a second independent source, a victim statement, or a regulator notice that corroborates the listing, and we will re-issue this advisory with technical detail if the operator publishes data samples or the victim confirms the incident. Clients with a Cognosis Limited dependency should treat the relationship as unverified until the supplier responds, and should not wait for corroboration before confirming whether the dependency exists in their register.
Published via PulseTrace — Adverse Trace threat intelligence.