[METAENCRYPTOR] Ransomware Attacks Target AECOM, Beckman Coulter, and Promantra

Redpacketsecurity

[METAENCRYPTOR] Ransomware Attacks Target AECOM, Beckman Coulter, and Promantra

First seen 17 Sep 2026, 16:30 UTC • •33.9

Article Content

1 / 12

Browse articles

ThreatCluster •September 18, 2026 at 15:58 UTC

•Three U.S. companies listed as ransomware victims on the same day.
•No specific details on data encryption or ransom demands provided.
•Claims remain unverified and should be treated with caution.

On September 17, 2026, three U.S.-based companies—AECOM, Beckman Coulter, Inc., and Promantra, Inc.—were listed as victims on the METAENCRYPTOR ransomware group's leak site. AECOM is involved in infrastructure consulting and engineering, while Beckman Coulter specializes in medical diagnostics, and Promantra provides healthcare technology services. The listings do not specify the nature of the attacks, whether data was encrypted or stolen, or any ransom demands. No details regarding the volume of compromised data or specific categories of information were disclosed. The lack of corroborating evidence means these claims should be treated as unverified until confirmed by independent sources. The incident highlights ongoing threats to organizations in critical sectors, particularly healthcare and engineering.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 49d ago How this analysis works

Timeline

2026-09-17

AECOM listed as ransomware victim

AECOM was identified on the METAENCRYPTOR leak site, with no details on the attack's nature or data involved.

Redpacketsecurity

2026-09-17

Beckman Coulter, Inc. listed as victim

Beckman Coulter, a medical diagnostics firm, was also listed without details on data theft or ransom.

Redpacketsecurity

2026-09-17

Promantra, Inc. listed as victim

Promantra, a healthcare technology provider, was listed as a victim with no specifics on the incident provided.

Redpacketsecurity

More articles in this cluster (11)

Threat Graph

3 entities, 2 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Ransomware

Organization (1)

Aecom

Threat Actor (1)

MetaEncryptor

Relationships

MetaEncryptor uses Ransomware
MetaEncryptor targets Aecom

Following this threat?

Track MetaEncryptor and Aecom in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical RCE Vulnerability in Prefab UI Disclosed A critical remote code execution vulnerability, CVE-2026-120338, was disclosed on November 1, 2026, affecting Prefab UI's Generative UI sandbox. The flaw allows attackers to execute arbitrary Python code by exploiting Deno's permissions, enabling file read/write access on the host server. This vulnerability affects…

China-Linked Hackers Exploit PHP2Shell Vulnerabilities to Breach U.S. Government Systems On October 21, 2026, the PHP development team released patches for two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated remote code execution. These vulnerabilities were actively exploited by a suspected China-linked threat actor who compromised 25…