Ransomware Intelligence / Groups
Ransomware groups
Ranked by leak-site claims in the last 30 days. Each group page shows its weekly trend, the sectors and countries it is claiming, and the vulnerabilities to patch.
Active in the last 30 days
82 groups with at least one claim.
| Group | Claims, 30 days | Last seen |
|---|---|---|
| the gentlemen | 100 | 2026-10-11 |
| qilin | 91 | 2026-10-15 |
| n0n | 87 | 2026-10-15 |
| killsec3 | 46 | 2026-09-27 |
| inc ransom | 43 | 2026-10-14 |
| akira | 38 | 2026-10-15 |
| nightspire | 35 | 2026-10-15 |
| storm | 30 | 2026-10-12 |
| wallstreet | 27 | 2026-10-15 |
| emperador | 26 | 2026-10-15 |
| safepay | 25 | 2026-10-12 |
| clop | 23 | 2026-09-23 |
| lockbit5 | 22 | 2026-10-15 |
| audit team | 19 | 2026-10-13 |
| metaencryptor | 18 | 2026-10-12 |
| play | 17 | 2026-10-13 |
| panzer | 16 | 2026-10-13 |
| leakeddata | 16 | 2026-10-09 |
| dragonforce | 14 | 2026-10-14 |
| brain cipher | 14 | 2026-10-12 |
| everest | 14 | 2026-10-12 |
| rhysida | 14 | 2026-10-11 |
| lamashtu | 14 | 2026-10-05 |
| krybit | 14 | 2026-10-04 |
| orova | 13 | 2026-10-14 |
| interlock | 13 | 2026-10-12 |
| booba team | 13 | 2026-10-04 |
| imnotavillian | 11 | 2026-09-28 |
| umbra | 10 | 2026-10-10 |
| vypr | 10 | 2026-10-07 |
| vexy | 9 | 2026-10-15 |
| byod | 9 | 2026-10-13 |
| 3am | 9 | 2026-10-06 |
| shinyhunters | 9 | 2026-10-02 |
| ransomhouse | 8 | 2026-10-13 |
| majinahanashi | 8 | 2026-10-13 |
| hyflock | 8 | 2026-10-13 |
| arcus media | 8 | 2026-10-09 |
| iah647 | 7 | 2026-10-15 |
| the seven deadly sins | 7 | 2026-10-15 |
| payoutsking | 7 | 2026-10-14 |
| aurora | 7 | 2026-10-14 |
| m3rx | 7 | 2026-09-29 |
| global cybernetic collective | 7 | 2026-09-28 |
| zawoo | 7 | 2026-09-24 |
| kairos | 6 | 2026-10-14 |
| termite | 6 | 2026-10-09 |
| endzone | 6 | 2026-10-06 |
| chaos | 5 | 2026-10-10 |
| anubis | 5 | 2026-10-09 |
| black x | 5 | 2026-10-09 |
| doommageddon | 5 | 2026-10-05 |
| pear | 5 | 2026-10-01 |
| eclipse | 4 | 2026-10-14 |
| deadlock | 4 | 2026-10-14 |
| shiba | 4 | 2026-10-11 |
| genesis | 4 | 2026-10-01 |
| space bears | 3 | 2026-10-15 |
| dark project | 3 | 2026-10-12 |
| redact | 3 | 2026-10-12 |
| cry0 | 3 | 2026-10-09 |
| global secret group | 3 | 2026-10-05 |
| spirals | 3 | 2026-10-03 |
| gammax | 3 | 2026-09-29 |
| scarlettgroup | 2 | 2026-10-15 |
| black nevas | 2 | 2026-10-15 |
| direwolf | 2 | 2026-10-13 |
| bravox | 2 | 2026-10-09 |
| payload | 2 | 2026-10-08 |
| blacklocks | 2 | 2026-09-26 |
| titan | 2 | 2026-09-22 |
| unsafe | 2 | 2026-09-21 |
| 0x00 | 1 | 2026-10-15 |
| exitium | 1 | 2026-10-12 |
| run some wares | 1 | 2026-10-08 |
| insomnia | 1 | 2026-10-05 |
| morpheus | 1 | 2026-10-01 |
| ulose | 1 | 2026-09-29 |
| vladivostok | 1 | 2026-09-28 |
| secp0 | 1 | 2026-09-22 |
| money message | 1 | 2026-09-21 |
| securotrop | 1 | 2026-09-18 |
36 groups with no claims in the last 30 days
Data sources
- Source: CISA KEVupdated 2 hours ago
- Opening demands are read from leaked ransomware negotiation chats collected by Ransomchats (MIT licence), using an OpenAI language model. These chats are not a representative sample.updated 2 hours ago
- Source: RansomLookupdated 2 hours ago
- Sector, country and region labels are inferred by SecuritySnares from the published organisation name using an OpenAI language model; treat them as estimates.updated 2 hours ago
Leak-site listings reflect claims by threat actors and are not independently verified. Victims are never named on this site unless they have disclosed the incident themselves. Read the methodology.