Ransomware Intelligence / Groups
Ransomware groups
Ranked by leak-site claims in the last 30 days. Each group page shows its weekly trend, the sectors and countries it is claiming, and the vulnerabilities to patch.
Active in the last 30 days
79 groups with at least one claim.
| Group | Claims, 30 days | Last seen |
|---|---|---|
| the gentlemen | 100 | 2026-10-11 |
| qilin | 87 | 2026-10-14 |
| n0n | 81 | 2026-10-15 |
| killsec3 | 46 | 2026-09-27 |
| inc ransom | 43 | 2026-10-14 |
| akira | 38 | 2026-10-14 |
| nightspire | 34 | 2026-10-14 |
| safepay | 34 | 2026-10-12 |
| storm | 30 | 2026-10-12 |
| wallstreet | 26 | 2026-10-14 |
| emperador | 25 | 2026-10-14 |
| clop | 23 | 2026-09-23 |
| audit team | 19 | 2026-10-13 |
| metaencryptor | 18 | 2026-10-12 |
| panzer | 17 | 2026-10-13 |
| play | 17 | 2026-10-13 |
| lockbit5 | 16 | 2026-10-14 |
| leakeddata | 16 | 2026-10-09 |
| interlock | 15 | 2026-10-12 |
| dragonforce | 14 | 2026-10-14 |
| brain cipher | 14 | 2026-10-12 |
| everest | 14 | 2026-10-12 |
| rhysida | 14 | 2026-10-11 |
| lamashtu | 14 | 2026-10-05 |
| krybit | 14 | 2026-10-04 |
| orova | 13 | 2026-10-14 |
| booba team | 13 | 2026-10-04 |
| imnotavillian | 11 | 2026-09-28 |
| umbra | 10 | 2026-10-10 |
| vypr | 10 | 2026-10-07 |
| ransomhouse | 9 | 2026-10-13 |
| vexy | 9 | 2026-10-13 |
| byod | 9 | 2026-10-13 |
| arcus media | 9 | 2026-10-09 |
| 3am | 9 | 2026-10-06 |
| shinyhunters | 9 | 2026-10-02 |
| majinahanashi | 8 | 2026-10-13 |
| hyflock | 8 | 2026-10-13 |
| payoutsking | 7 | 2026-10-14 |
| aurora | 7 | 2026-10-14 |
| m3rx | 7 | 2026-09-29 |
| global cybernetic collective | 7 | 2026-09-28 |
| zawoo | 7 | 2026-09-24 |
| kairos | 6 | 2026-10-14 |
| termite | 6 | 2026-10-09 |
| endzone | 6 | 2026-10-06 |
| chaos | 5 | 2026-10-10 |
| anubis | 5 | 2026-10-09 |
| black x | 5 | 2026-10-09 |
| doommageddon | 5 | 2026-10-05 |
| pear | 5 | 2026-10-01 |
| eclipse | 4 | 2026-10-14 |
| deadlock | 4 | 2026-10-14 |
| dark project | 4 | 2026-10-12 |
| shiba | 4 | 2026-10-11 |
| genesis | 4 | 2026-10-01 |
| redact | 3 | 2026-10-12 |
| cry0 | 3 | 2026-10-09 |
| global secret group | 3 | 2026-10-05 |
| spirals | 3 | 2026-10-03 |
| gammax | 3 | 2026-09-29 |
| direwolf | 2 | 2026-10-13 |
| bravox | 2 | 2026-10-09 |
| payload | 2 | 2026-10-08 |
| insomnia | 2 | 2026-10-05 |
| blacklocks | 2 | 2026-09-26 |
| titan | 2 | 2026-09-22 |
| unsafe | 2 | 2026-09-21 |
| exitium | 1 | 2026-10-12 |
| run some wares | 1 | 2026-10-08 |
| morpheus | 1 | 2026-10-01 |
| ulose | 1 | 2026-09-29 |
| vladivostok | 1 | 2026-09-28 |
| space bears | 1 | 2026-09-23 |
| secp0 | 1 | 2026-09-22 |
| money message | 1 | 2026-09-21 |
| securotrop | 1 | 2026-09-18 |
| black nevas | 1 | 2026-09-17 |
| iah647 | 1 | 2026-09-15 |
36 groups with no claims in the last 30 days
Data sources
- Source: CISA KEVupdated 3 hours ago
- Source: RansomLookupdated 3 hours ago
- Sector, country and region labels are inferred by SecuritySnares from the published organisation name using Claude; treat them as estimates.not yet synced
Leak-site listings reflect claims by threat actors and are not independently verified. Victims are never named on this site unless they have disclosed the incident themselves. Read the methodology.