RunSomeWares is an emerging ransomware group that first documented activity in June 2024, although public reporting indicates its surfacing in February 2025. The group's primary motivation is financial, achieved through extortion. A distinguishing characteristic of RunSomeWares is the often unclear deployment of a traditional encryptor versus a pure data-theft extortion model, suggesting a focus on data exfiltration as a primary leverage point. The group targets sectors such as supply-chain services, financial services, accounting, and manufacturing, impacting organizations in regions including the United States, Thailand, and France.