Ransomware Intelligence updated 11 hours ago
What ransomware is doing this week
Which groups are active, which sectors they are claiming, and which vulnerabilities they are known to exploit. Refreshed nightly from public sources.
Leak-site listings are claims made by criminals, not confirmed incidents. We count them by group and sector and never name a leak-site victim.
- Claims, 7 days
- 381 ▲ 27% vs prior week
- Claims, 30 days
- 1,386
- Active groups
- 87
- Countries
- 90
Most active groups
Leak-site claims per group. Counts, not names.
Last 7 days
- the gentlemen 69
- qilin 29
- soul 25
- n0n 22
- medusalocker 18
- safepay 18
- akira 11
- booba team 11
- brain cipher 11
- SilentRansomGroup 10
Last 30 days
- the gentlemen 204
- n0n 168
- qilin 128
- majinahanashi 37
- akira 36
- nightspire 32
- leakeddata 30
- safepay 30
- SilentRansomGroup 30
- inc ransom 28
In the news
The latest ransomware stories from the security press, newest first.
- 3AM Ransomware Used Human-AI Hybrid Tactics in UK School Estate Compromise
- Ransomware roundup: October 2026
- HHS’ Office for Civil Rights Settles Ransomware Investigation of Lehigh Valley Health Network
- Synology Warns of Ransomware Attacks Targeting NAS Devices Running Outdated DSM Versions
- 3AM Affiliate Embraces AI-Like Loops in European School Attack
- UK school estate hit by 3AM ransomware in suspected AI-assisted attack
- Assured helps recovery teams find clean backups after ransomware attacks
- Britain on notice: AI-powered ransomware attacks to arrive by 2028
Headlines are shown as the publisher wrote them and link to the original story. They are third-party reporting, not SecuritySnares findings. How stories are picked
Claims by sector, last 30 days
Sector is inferred from the public listing with an LLM-assisted classifier and may be wrong; posts not yet classified are grouped as "Unclassified". See the methodology.
Vulnerabilities with known ransomware use
From CISA's Known Exploited Vulnerabilities catalog, newest first. If you run the product, patch it.
| Added | CVE | Vendor / product | Vulnerability |
|---|---|---|---|
| 2026-08-18 | CVE-2026-59310 | Broadcom VMware vCenter | Broadcom VMware vCenter Path Traversal Vulnerability |
| 2026-08-05 | CVE-2026-63077 | JetBrains TeamCity | JetBrains TeamCity Deserialization of Untrusted Data Vulnerability |
| 2026-07-29 | CVE-2026-20316 | Cisco Secure Firewall Management Center (FMC) | Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability |
| 2026-07-14 | CVE-2026-15410 | SonicWall SMA1000 Appliances | SonicWall SMA1000 Appliances Code Injection Vulnerability |
| 2026-07-14 | CVE-2026-15409 | SonicWall SMA1000 Appliances | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability |
| 2026-07-01 | CVE-2026-45659 | Microsoft SharePoint Server | Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability |
| 2026-06-25 | CVE-2026-12569 | PTC Windchill and FlexPLM | PTC Windchill and FlexPLM Improper Input Validation Vulnerability |
| 2026-06-12 | CVE-2026-35273 | Oracle PeopleSoft Enterprise PeopleTools | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability |
| 2026-06-08 | CVE-2026-50751 | Check Point Security Gateway | Check Point Security Gateway Improper Authentication Vulnerability |
| 2026-05-29 | CVE-2026-0257 | Palo Alto Networks PAN-OS | Palo Alto Networks PAN-OS Authentication Bypass Vulnerability |
From intelligence to protection
Most of these groups lock files. RansomSnare is built to stop that at the first one.
Watch RansomSnare stop encryption in a live demo, then measure files affected and time to alert in your own environment.
Data sources
- Source: CISA KEVupdated 11 hours ago
- Opening demands are read from leaked ransomware negotiation chats collected by Ransomchats (MIT licence), using an OpenAI language model. These chats are not a representative sample.updated 11 hours ago
- Source: RansomLookupdated 11 hours ago
- Source: Ransomware.liveupdated 11 hours ago
- Sector, country and region labels are inferred by SecuritySnares from the published organisation name using an OpenAI language model; treat them as estimates.updated 11 hours ago
- News: headlines link to the original publishers (outlets we follow)updated 11 hours ago
Leak-site listings reflect claims by threat actors and are not independently verified. Leak-site victims are never named on this site unless they have disclosed the incident themselves. News headlines are the publishers' own reporting, shown as written.