Ransomware Intelligence

What ransomware is doing this week

Which groups are active, which sectors they are claiming, and which vulnerabilities they are known to exploit. Refreshed nightly from public sources.

Leak-site listings are claims made by criminals, not confirmed incidents. We count them by group and sector. We never name a victim.

Most active groups

Leak-site claims per group. Counts, not names.

Last 7 days

  1. n0n 60
  2. qilin 21
  3. nightspire 19
  4. wallstreet 13
  5. orova 11
  6. akira 9
  7. hyflock 8
  8. majinahanashi 8
  9. interlock 7
  10. the gentlemen 7

Last 30 days

  1. the gentlemen 100
  2. qilin 87
  3. n0n 81
  4. killsec3 46
  5. inc ransom 43
  6. akira 38
  7. nightspire 34
  8. safepay 34
  9. storm 30
  10. wallstreet 26

Claims by sector, last 30 days

Sector is inferred from the public listing with an LLM-assisted classifier and may be wrong; posts not yet classified are grouped as "Unclassified". See the methodology.

  • Unclassified 1034

Vulnerabilities with known ransomware use

From CISA's Known Exploited Vulnerabilities catalog, newest first. If you run the product, patch it.

Added CVE Vendor / product Vulnerability
2026-08-18 CVE-2026-59310 Broadcom VMware vCenter Broadcom VMware vCenter Path Traversal Vulnerability
2026-08-05 CVE-2026-63077 JetBrains TeamCity JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
2026-07-29 CVE-2026-20316 Cisco Secure Firewall Management Center (FMC) Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
2026-07-14 CVE-2026-15410 SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Code Injection Vulnerability
2026-07-14 CVE-2026-15409 SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
2026-07-01 CVE-2026-45659 Microsoft SharePoint Server Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability
2026-06-25 CVE-2026-12569 PTC Windchill and FlexPLM PTC Windchill and FlexPLM Improper Input Validation Vulnerability
2026-06-12 CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
2026-06-08 CVE-2026-50751 Check Point Security Gateway Check Point Security Gateway Improper Authentication Vulnerability
2026-05-29 CVE-2026-0257 Palo Alto Networks PAN-OS Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

Data sources

  • Source: CISA KEV
    updated 3 hours ago
  • Source: RansomLook
    updated 3 hours ago
  • Sector, country and region labels are inferred by SecuritySnares from the published organisation name using Claude; treat them as estimates.
    not yet synced

Leak-site listings reflect claims by threat actors and are not independently verified. Victims are never named on this site unless they have disclosed the incident themselves.