Ransomware Intelligence

What ransomware is doing this week

Which groups are active, which sectors they are claiming, and which vulnerabilities they are known to exploit. Refreshed nightly from public sources.

Leak-site listings are claims made by criminals, not confirmed incidents. We count them by group and sector. We never name a victim.

Most active groups

Leak-site claims per group. Counts, not names.

Last 7 days

  1. n0n 66
  2. qilin 31
  3. nightspire 20
  4. wallstreet 14
  5. akira 12
  6. orova 11
  7. lockbit5 10
  8. hyflock 8
  9. majinahanashi 8
  10. iah647 7

Last 30 days

  1. the gentlemen 100
  2. qilin 91
  3. n0n 87
  4. killsec3 46
  5. inc ransom 43
  6. akira 38
  7. nightspire 35
  8. storm 30
  9. wallstreet 27
  10. emperador 26

Claims by sector, last 30 days

Sector is inferred from the public listing with an LLM-assisted classifier and may be wrong; posts not yet classified are grouped as "Unclassified". See the methodology.

Vulnerabilities with known ransomware use

From CISA's Known Exploited Vulnerabilities catalog, newest first. If you run the product, patch it.

Added CVE Vendor / product Vulnerability
2026-08-18 CVE-2026-59310 Broadcom VMware vCenter Broadcom VMware vCenter Path Traversal Vulnerability
2026-08-05 CVE-2026-63077 JetBrains TeamCity JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
2026-07-29 CVE-2026-20316 Cisco Secure Firewall Management Center (FMC) Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
2026-07-14 CVE-2026-15410 SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Code Injection Vulnerability
2026-07-14 CVE-2026-15409 SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
2026-07-01 CVE-2026-45659 Microsoft SharePoint Server Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability
2026-06-25 CVE-2026-12569 PTC Windchill and FlexPLM PTC Windchill and FlexPLM Improper Input Validation Vulnerability
2026-06-12 CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
2026-06-08 CVE-2026-50751 Check Point Security Gateway Check Point Security Gateway Improper Authentication Vulnerability
2026-05-29 CVE-2026-0257 Palo Alto Networks PAN-OS Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

Data sources

  • Source: CISA KEV
    updated 1 hour ago
  • Opening demands are read from leaked ransomware negotiation chats collected by Ransomchats (MIT licence), using an OpenAI language model. These chats are not a representative sample.
    updated 1 hour ago
  • Source: RansomLook
    updated 1 hour ago
  • Sector, country and region labels are inferred by SecuritySnares from the published organisation name using an OpenAI language model; treat them as estimates.
    updated 1 hour ago

Leak-site listings reflect claims by threat actors and are not independently verified. Victims are never named on this site unless they have disclosed the incident themselves.