Dragons Eye Ransomware Tracker

Public ransomware intelligence: live monitoring of leak-site victim claims, a directory of tracked ransomware groups, sector and geography statistics, and activity trends for defenders, researchers, and SOC analysts.

• 42,962 victim claims tracked
• 532 ransomware groups tracked (158 active)
• 181 countries affected
• 593 claims observed in the latest seven days

Most active ransomware groups

• qilin — 2,806 victim claims
• lockbit3 — 2,526 victim claims
• akira — 1,924 victim claims
• clop — 1,803 victim claims
• play — 1,352 victim claims
• lockbit2 — 1,214 victim claims
• alphv — 1,185 victim claims
• incransom — 1,055 victim claims
• ransomhub — 1,030 victim claims
• the gentlemen — 994 victim claims

Most targeted sectors

• Manufacturing — 4,449 victim claims
• Construction — 1,613 victim claims
• Technology — 1,596 victim claims
• Business Services — 1,520 victim claims
• Technologies — 1,159 victim claims
• Healthcare — 1,097 victim claims
• Healthcare services — 1,068 victim claims
• Services — 820 victim claims
• Education — 751 victim claims
• Unknown — 609 victim claims

Most affected countries

• United States — 13,804 victim claims
• United Kingdom — 1,362 victim claims
• Canada — 1,228 victim claims
• Germany — 1,211 victim claims
• Italy — 1,016 victim claims
• France — 853 victim claims
• Brazil — 653 victim claims
• Spain — 608 victim claims
• India — 594 victim claims
• Australia — 563 victim claims

Frequently asked questions

What is a ransomware victim claim on Dragons Eye?

A claim is a group-published allegation that an organization was attacked, posted on the group's leak site and observed by a monitoring provider. Dragons Eye reports what providers saw groups publish — not what Dragons Eye independently verified happened.

Are these claims verified attacks?

No. Every record is an unverified attacker assertion observed by a provider. Multiple providers observing the same claim raises confidence that the claim was posted; it does not verify that an attack occurred. Authority-confirmed badges only mean a matching official breach report exists in a primary source — they still do not verify the group's claim.

How are ransomware groups counted?

Groups are tracked as canonical identities after reconciling provider observations and approved aliases. Tracked groups are the directory total; active groups are those with recent provider-observed claim activity in the current window. Mirror or republished observations do not inflate independent-provider counts, and no provider count verifies the underlying allegation.

How should this tracker be used responsibly?

Dragons Eye is for research, defense, and educational use only. Do not use it to interact with, support, or negotiate with threat groups. The tracker never connects to Tor, never exposes leak-site infrastructure or leaked material, and must not be used to harass or extort named organizations.

For collection rules and terminology, read the methodology and glossary.

Explore

• Ransomware group directory
• Victim-claim directory
• Live ransomware activity map
• Ransomware activity by country and sector
• Weekly ransomware signals
• Monthly State of Ransomware reports
• Year-long claim-publishing calendar
• Intelligence Lab analytics
• Data quality and screening dashboard
• Methodology & attribution
• Glossary of tracker terms
• About

Source: reconciled leak-site victim claims aggregated from documented public monitoring providers. Independent providers are distinguished from mirrors, and no provider count verifies an underlying allegation. Definitions for every term used here are in the glossary.

Victim records are provider-reported allegations, not independently verified breaches. Published for research, defense, and educational use.