Ransomware Intelligence / Groups
Ransomware groups
Ranked by leak-site claims in the last 30 days. Each group page shows its weekly trend, the sectors and countries it is claiming, and the vulnerabilities to patch.
Opening ransom demands
Across all 193 chats: median $550k, middle half $200k–$1.5M.
| Group | Range | Median opening demand | Chats | Years | Came down to |
|---|---|---|---|---|---|
| Akira | $100k–$10M | $400k | 61 | 2023–2026 | 42% |
| Conti | $100k–$15M | $980k | 27 | 2020–2021 | 43% |
| LockBit 3.0 | $50k–$19M | $1.4M | 21 | 2022–2025 | — |
| DragonForce | $100k–$7M | $955k | 19 | 2024–2026 | — |
| REvil | $25k–$9M | $500k | 11 | 2020–2021 | 60% |
"Came down to" is the median lowest offer as a share of the opening demand, shown where at least 5 chats record one. 17 other groups with fewer than 10 chats are not broken out.
From 193 leaked negotiation chats (Ransomchats, MIT license). Leaked and contributed chats are not a representative sample: a few groups and years dominate, and big cases are over-represented. Amounts are the group's first stated total demand in US dollars. 11 of these demands were made in bitcoin and are converted at the bitcoin price on the day of the chat. Crypto demands from chats with no known date are not included. How these figures are extracted.
Active in the last 30 days
87 groups with at least one claim; the 20 most active are shown.
| Group | Claims, 30 days | Last seen |
|---|---|---|
| the gentlemen | 204 | 2026-11-03 |
| n0n | 168 | 2026-11-04 |
| qilin | 128 | 2026-11-03 |
| majinahanashi | 37 | 2026-10-31 |
| akira | 36 | 2026-11-04 |
| nightspire | 32 | 2026-11-02 |
| leakeddata | 30 | 2026-11-04 |
| SilentRansomGroup | 30 | 2026-11-04 |
| safepay | 30 | 2026-11-04 |
| inc ransom | 28 | 2026-11-03 |
| lockbit5 | 26 | 2026-11-04 |
| whitearmor | 26 | 2026-11-04 |
| booba team | 26 | 2026-11-03 |
| soul | 25 | 2026-11-04 |
| emperador | 23 | 2026-10-31 |
| play | 21 | 2026-11-04 |
| brain cipher | 21 | 2026-11-04 |
| rhysida | 21 | 2026-11-04 |
| audit team | 21 | 2026-10-31 |
| everest | 21 | 2026-10-27 |
67 more active groups
- orova 20
- interlock 19
- wallstreet 19
- medusalocker 18
- settra 17
- hyflock 15
- aurora 14
- scarlettgroup 13
- payload 12
- payoutsking 11
- deadlock 11
- pear 10
- genesis 10
- dragonforce 10
- panzer 10
- umbra 10
- dark project 9
- byod 9
- helix 9
- ransomhouse 8
- shiba 8
- vexy 8
- storm 8
- iah647 8
- the seven deadly sins 8
- everstake 7
- krybit 7
- lamashtu 7
- sovcali 7
- global secret group 6
- OBSOFT 6
- redact 6
- eclipse 6
- direwolf 5
- anubis 5
- cloak 5
- bravox 5
- doommageddon 4
- Aoqin 4
- falcon 4
- metaencryptor 4
- black x 4
- chaos 3
- barracuda 3
- sarcoma 3
- securotrop 3
- space bears 3
- arcus media 3
- vypr 3
- leaknet 2
- crypto24 2
- ulose 2
- fulcrumsec 2
- mimori 2
- termite 2
- destello 1
- PixelLeaks 1
- Syntax 1
- clop 1
- nitrogen 1
- 0x00 1
- black nevas 1
- kairos 1
- exitium 1
- cry0 1
- netrunner 1
- run some wares 1
77 groups with no claims in the last 30 days
- 3am
- endzone
- insomnia
- spirals
- shinyhunters
- morpheus
- m3rx
- gammax
- vladivostok
- imnotavillian
- global cybernetic collective
- killsec3
- blacklocks
- zawoo
- titan
- secp0
- unsafe
- money message
- ShadowByt3$
- global
- beast
- embargo
- kazu
- dysphor1a
- tridentlocker
- gunra
- meowciety403
- coinbase cartel
- lynx
- abyss-data
- ailock
- blackwater
- cyberleek
- l group
- xpl0itrs
- ms13-089
- bluewhale
- crpx0
- ethics
- kraken
- orion
- triple x
- cmd organization
- kyber
- exfilsquad
- nova
- eraleign (apt73)
- apt73
- worldleaks
- blackout
- syndicate
- d1r
- dataleak
- Blackfield
- stormous
- bavacai
- prinz eugen
- lapsus$
- icarus
- ransomexx
- blackbyte-crux
- 0day Syndicate
- spy corporate
- leak bazaar
- sinobi
- mnt6
- radar
- orca
- medusa
- vect
- nasir security
- timc
- ALP-001
- linkc
- handala
- bqtlock
- threatmarket
Data sources: CISA KEV, Ransomchats, RansomLook, Ransomware.live, security news outlets · updated 12 hours ago
Sector, country and ransom-demand figures are SecuritySnares estimates made with a language model. Leak-site listings are claims by threat actors and are not independently verified; leak-site victims are never named unless they have disclosed the incident themselves. News headlines are the publishers' own reporting, shown as written and linked to the original. Methodology