Ransomware group directory

520 tracked ransomware groups with victim-claim counts, leak-site availability, and activity status.

• qilin — 2,628 victim claims, status: active, last activity 2026-10-19
• lockbit3 — 2,269 victim claims, status: active, last activity 2026-10-14
• clop — 1,869 victim claims, status: active, last activity 2026-09-23
• akira — 1,712 victim claims, status: active, last activity 2026-10-15
• play — 1,353 victim claims, status: active, last activity 2026-10-16
• alphv — 1,166 victim claims, status: monitoring, last activity 2026-01-11
• the gentlemen — 1,096 victim claims, status: active, last activity 2026-10-16
• INC Ransom — 1,025 victim claims, status: active, last activity 2026-10-19
• lockbit2 — 992 victim claims, status: monitoring, last activity 2025-06-01
• ransomhub — 942 victim claims, status: monitoring, last activity 2026-01-11
• safepay — 827 victim claims, status: active, last activity 2026-10-13
• blackbasta — 803 victim claims, status: monitoring, last activity 2025-06-01
• dragonforce — 777 victim claims, status: active, last activity 2026-10-17
• bianlian — 677 victim claims, status: monitoring, last activity 2026-01-11
• everest — 665 victim claims, status: active, last activity 2026-10-17
• medusa — 566 victim claims, status: monitoring, last activity 2026-04-26
• cactus — 540 victim claims, status: monitoring, last activity 2026-01-11
• 8base — 463 victim claims, status: monitoring, last activity 2025-11-30
• lockbit5 — 457 victim claims, status: active, last activity 2026-10-19
• nightspire — 418 victim claims, status: active, last activity 2026-10-18
• lynx — 409 victim claims, status: active, last activity 2026-08-29
• rhysida — 380 victim claims, status: active, last activity 2026-10-13
• dispossessor — 365 victim claims, status: monitoring, last activity 2025-06-01
• royal — 357 victim claims, status: monitoring, last activity 2025-06-01
• conti — 351 victim claims, status: monitoring, last activity 2025-06-01
• pysa — 310 victim claims, status: monitoring, last activity 2025-06-01
• hunters — 307 victim claims, status: monitoring, last activity 2026-01-11
• blacksuit — 302 victim claims, status: monitoring, last activity 2026-01-11
• killsec — 301 victim claims, status: active, last activity 2026-09-18
• deadlock — 283 victim claims, status: active, last activity 2026-10-12
• handala — 283 victim claims, status: monitoring, last activity 2026-04-11
• coinbasecartel — 282 victim claims, status: active, last activity 2026-08-31
• sinobi — 277 victim claims, status: monitoring, last activity 2026-05-08
• ransomhouse — 272 victim claims, status: active, last activity 2026-10-13
• stormous — 262 victim claims, status: monitoring, last activity 2026-07-02
• apt73 — 250 victim claims, status: active, last activity 2026-10-07
• noescape — 245 victim claims, status: monitoring, last activity 2025-06-01
• killsec3 — 220 victim claims, status: active, last activity 2026-09-21
• nova — 219 victim claims, status: active, last activity 2026-07-25
• hive — 207 victim claims, status: monitoring, last activity 2025-06-01
• SilentRansomGroup — 205 victim claims, status: active, last activity 2026-10-19
• hiveleak — 205 victim claims, status: monitoring, last activity 2023-05-26
• malas — 204 victim claims, status: monitoring, last activity 2026-05-09
• krybit — 204 victim claims, status: active, last activity 2026-10-04
• worldleaks — 194 victim claims, status: monitoring, last activity 2026-07-21
• fog — 194 victim claims, status: monitoring, last activity 2025-07-05
• vicesociety — 192 victim claims, status: monitoring, last activity 2025-06-01
• payoutsking — 189 victim claims, status: active, last activity 2026-10-14
• shinyhunters — 186 victim claims, status: active, last activity 2026-10-02
• cloak — 181 victim claims, status: active, last activity 2026-10-18
• pear — 181 victim claims, status: active, last activity 2026-10-16
• babuk2 — 181 victim claims, status: monitoring, last activity 2025-06-05
• devman — 180 victim claims, status: monitoring, last activity 2026-02-04
• spacebears — 176 victim claims, status: active, last activity 2026-10-15
• funksec — 170 victim claims, status: monitoring, last activity 2026-07-20
• Storm — 169 victim claims, status: active, last activity 2026-10-19
• sarcoma — 162 victim claims, status: active, last activity 2026-10-13
• n0n — 161 victim claims, status: active, last activity 2026-10-19
• ragroup — 161 victim claims, status: monitoring, last activity 2026-01-09
• snatch — 159 victim claims, status: monitoring, last activity 2026-01-11
• killsecurity — 156 victim claims, status: monitoring, last activity 2026-01-09
• genesis — 155 victim claims, status: active, last activity 2026-10-12
• blackbyte — 148 victim claims, status: monitoring, last activity 2026-01-11
• avaddon — 148 victim claims, status: monitoring, last activity 2025-06-01
• ElDorado — 146 victim claims, status: monitoring, last activity 2025-06-01
• meow — 145 victim claims, status: monitoring, last activity 2025-06-01
• direwolf — 145 victim claims, status: active, last activity 2026-10-13
• arcusmedia — 140 victim claims, status: active, last activity 2026-10-09
• medusalocker — 140 victim claims, status: active, last activity 2026-10-05
• interlock — 140 victim claims, status: active, last activity 2026-10-12
• BrainCipher — 136 victim claims, status: active, last activity 2026-10-09
• kairos — 135 victim claims, status: active, last activity 2026-10-14
• apt73/bashe — 135 victim claims, status: active, last activity 2026-07-24
• raworld — 132 victim claims, status: monitoring, last activity 2025-06-01
• ragnarlocker — 130 victim claims, status: monitoring, last activity 2026-01-11
• anubis — 125 victim claims, status: active, last activity 2026-10-20
• AuditTeam — 125 victim claims, status: active, last activity 2026-10-13
• threeam — 125 victim claims, status: active, last activity 2026-10-06
• monti — 123 victim claims, status: monitoring, last activity 2025-06-16
• toufan — 120 victim claims, status: monitoring, last activity 2026-03-26
• bashe — 119 victim claims, status: monitoring, last activity 2026-02-18
• Orova — 117 victim claims, status: active, last activity 2026-10-14
• cicada3301 — 116 victim claims, status: monitoring, last activity 2025-12-12
• lockbit3_fs — 112 victim claims, status: monitoring, last activity 2026-01-11
• abyss — 106 victim claims, status: active, last activity 2026-10-18
• cuba — 105 victim claims, status: monitoring, last activity 2025-06-01
• blacknevas — 104 victim claims, status: active, last activity 2026-10-15
• chaos — 100 victim claims, status: active, last activity 2026-10-09
• revil — 97 victim claims, status: monitoring, last activity 2025-06-01
• Settra — 96 victim claims, status: active, last activity 2026-10-18
• trigona — 95 victim claims, status: monitoring, last activity 2025-06-01
• leakeddata — 95 victim claims, status: active, last activity 2026-10-19
• metaencryptor — 93 victim claims, status: active, last activity 2026-10-12
• ransomexx — 93 victim claims, status: monitoring, last activity 2026-06-20
• emperador — 90 victim claims, status: active, last activity 2026-10-19
• avoslocker — 90 victim claims, status: monitoring, last activity 2025-06-01
• Global Secret Group — 90 victim claims, status: active, last activity 2026-10-19
• titan — 90 victim claims, status: active, last activity 2026-10-16
• payload — 87 victim claims, status: active, last activity 2026-10-19
• warlock — 82 victim claims, status: monitoring, last activity 2026-03-20
• M3rx — 81 victim claims, status: active, last activity 2026-09-29
• ransomedvc — 81 victim claims, status: monitoring, last activity 2024-06-07
• beast — 80 victim claims, status: active, last activity 2026-09-25
• Panzer — 78 victim claims, status: active, last activity 2026-10-13
• Dark Project — 78 victim claims, status: active, last activity 2026-10-14
• lorenz — 78 victim claims, status: monitoring, last activity 2025-06-01
• ExfilSquad — 77 victim claims, status: active, last activity 2026-09-08
• karakurt — 76 victim claims, status: active, last activity 2026-10-15
• termite — 74 victim claims, status: active, last activity 2026-10-09
• gunra — 72 victim claims, status: active, last activity 2026-09-04
• quantum — 68 victim claims, status: monitoring, last activity 2025-06-01
• ransomed — 68 victim claims, status: monitoring, last activity 2025-06-01
• aurora — 67 victim claims, status: active, last activity 2026-10-19
• Bavacai — 66 victim claims, status: active, last activity 2026-10-15
• nitrogen — 65 victim claims, status: active, last activity 2026-10-19
• ShadowByt3$ — 65 victim claims, status: active, last activity 2026-09-15
• blacklock — 64 victim claims, status: monitoring, last activity 2025-09-24
• Vexy Ransomware — 63 victim claims, status: active, last activity 2026-10-17
• majinahanashi — 63 victim claims, status: active, last activity 2026-10-17
• ciphbit — 63 victim claims, status: monitoring, last activity 2026-02-10
• flocker — 63 victim claims, status: monitoring, last activity 2025-09-29
• lv — 63 victim claims, status: monitoring, last activity 2025-06-01
• eraleign (apt73) — 62 victim claims, status: active, last activity 2026-07-24
• Booba Project — 61 victim claims, status: active, last activity 2026-10-04
• darkvault — 60 victim claims, status: monitoring, last activity 2026-03-24
• maze — 59 victim claims, status: monitoring, last activity 2026-01-11
• Helix — 59 victim claims, status: active, last activity 2026-10-19
• insomnia — 59 victim claims, status: active, last activity 2026-10-05
• knight — 58 victim claims, status: monitoring, last activity 2025-06-01
• embargo — 58 victim claims, status: active, last activity 2026-09-09
• CMDOrganization — 57 victim claims, status: active, last activity 2026-10-02
• mallox — 54 victim claims, status: monitoring, last activity 2025-06-01
• losttrust — 52 victim claims, status: monitoring, last activity 2025-06-01
• lamashtu — 52 victim claims, status: active, last activity 2026-10-05
• ailock — 51 victim claims, status: active, last activity 2026-08-26
• helldown — 51 victim claims, status: monitoring, last activity 2025-06-01
• CRPxO — 51 victim claims, status: active, last activity 2026-08-19
• tengu — 50 victim claims, status: monitoring, last activity 2026-03-10
• Wallstreet — 50 victim claims, status: active, last activity 2026-10-16
• dAn0n — 50 victim claims, status: monitoring, last activity 2025-06-01
• donutleaks — 49 victim claims, status: monitoring, last activity 2025-06-01
• crpx0 — 49 victim claims, status: active, last activity 2026-08-12
• crypto24 — 49 victim claims, status: active, last activity 2026-08-31
• kazu — 49 victim claims, status: active, last activity 2026-10-18
• arvinclub — 48 victim claims, status: monitoring, last activity 2025-06-01
• ryuk — 48 victim claims, status: monitoring, last activity 2021-05-18
• ransomblog_noname — 47 victim claims, status: monitoring, last activity 2026-01-09
• ZaWoo — 46 victim claims, status: active, last activity 2026-09-30
• alphalocker — 45 victim claims, status: active, last activity 2026-08-25
• global — 44 victim claims, status: active, last activity 2026-10-08
• midas — 44 victim claims, status: monitoring, last activity 2025-06-01
• securotrop — 43 victim claims, status: active, last activity 2026-09-18
• blackshrantac — 43 victim claims, status: monitoring, last activity 2026-01-20
• GLOBAL SECRET — 43 victim claims, status: active, last activity 2026-10-06
• ORION — 42 victim claims, status: active, last activity 2026-08-10
• fulcrumsec — 41 victim claims, status: active, last activity 2026-10-19
• J — 41 victim claims, status: active, last activity 2026-01-11
• bravox — 40 victim claims, status: active, last activity 2026-10-16
• moneymessage — 40 victim claims, status: active, last activity 2026-09-22
• nokoyawa — 40 victim claims, status: monitoring, last activity 2025-06-01
• unsafe — 39 victim claims, status: active, last activity 2026-10-07
• darkleakmarket — 39 victim claims, status: monitoring, last activity 2026-01-11
• dragonransomware — 39 victim claims, status: monitoring, last activity 2025-06-01
• leaknet — 39 victim claims, status: active, last activity 2026-09-30
• lapsus$ — 38 victim claims, status: active, last activity 2026-10-17
• daixin — 38 victim claims, status: active, last activity 2026-10-05
• spook — 38 victim claims, status: monitoring, last activity 2025-06-01
• booba team — 37 victim claims, status: active, last activity 2026-10-04
• dysphor1a — 35 victim claims, status: active, last activity 2026-09-19
• Gammax — 34 victim claims, status: active, last activity 2026-10-13
• obscura — 34 victim claims, status: monitoring, last activity 2026-01-11
• xpl0itrs — 33 victim claims, status: active, last activity 2026-08-28
• wannacry — 33 victim claims, status: monitoring, last activity 2025-06-01
• devman2 — 33 victim claims, status: monitoring, last activity 2026-02-04
• blackmatter — 32 victim claims, status: monitoring, last activity 2025-06-01
• marketo — 32 victim claims, status: monitoring, last activity 2025-06-01
• suncrypt — 32 victim claims, status: monitoring, last activity 2025-06-01
• mydata — 32 victim claims, status: active, last activity 2026-09-01
• METAENCRYPTER — 31 victim claims, status: active, last activity 2026-09-28
• frag — 30 victim claims, status: monitoring, last activity 2025-10-12
• werewolves — 29 victim claims, status: monitoring, last activity 2026-01-11
• hellcat — 29 victim claims, status: monitoring, last activity 2026-01-11
• ms13-089 — 29 victim claims, status: active, last activity 2026-10-04
• 3am — 29 victim claims, status: active, last activity 2026-10-06
• redransomware — 28 victim claims, status: monitoring, last activity 2025-06-01
• morpheus — 28 victim claims, status: active, last activity 2026-10-01
• L Group — 28 victim claims, status: active, last activity 2026-08-23
• payloadbin — 28 victim claims, status: monitoring, last activity 2025-06-01
• freecivilian — 28 victim claims, status: monitoring, last activity 2025-06-01
• onyx — 28 victim claims, status: monitoring, last activity 2025-06-01
• Black X — 27 victim claims, status: active, last activity 2026-10-09
• underground — 27 victim claims, status: monitoring, last activity 2026-01-11
• kraken — 27 victim claims, status: active, last activity 2026-08-12
• lockbit — 27 victim claims, status: active, last activity 2026-10-16
• kelvinsecurity — 26 victim claims, status: monitoring, last activity 2026-01-11
• netwalker — 26 victim claims, status: monitoring, last activity 2025-06-01
• trinity — 26 victim claims, status: monitoring, last activity 2025-08-12
• Doommageddon — 25 victim claims, status: active, last activity 2026-10-05
• doppelpaymer — 25 victim claims, status: monitoring, last activity 2025-06-01
• Iah647 — 24 victim claims, status: active, last activity 2026-10-18
• vect — 23 victim claims, status: monitoring, last activity 2026-04-15
• lockbit3_cronos — 23 victim claims, status: monitoring, last activity 2024-02-27
• Barracuda — 22 victim claims, status: active, last activity 2026-10-09
• secp0 — 22 victim claims, status: active, last activity 2026-09-22
• radar — 22 victim claims, status: monitoring, last activity 2026-04-29
• dunghill_leak — 22 victim claims, status: monitoring, last activity 2026-01-09
• Eclipse — 21 victim claims, status: active, last activity 2026-10-14
• xinglocker — 21 victim claims, status: monitoring, last activity 2025-06-01
• AUR0RA — 21 victim claims, status: active, last activity 2026-10-11
• leaktheanalyst — 20 victim claims, status: monitoring, last activity 2025-06-01
• siegedsec — 19 victim claims, status: monitoring, last activity 2025-06-01
• ImNotAVillain — 19 victim claims, status: active, last activity 2026-10-02
• darkrace — 19 victim claims, status: monitoring, last activity 2025-06-01
• tridentlocker — 19 victim claims, status: active, last activity 2026-09-04
• netrunner — 19 victim claims, status: active, last activity 2026-10-08
• dunghill — 19 victim claims, status: monitoring, last activity 2025-08-20
• mountlocker — 19 victim claims, status: monitoring, last activity 2025-06-01
• cephalus — 19 victim claims, status: monitoring, last activity 2025-09-28
• ALP-001 — 19 victim claims, status: monitoring, last activity 2026-04-08
• blackwater — 18 victim claims, status: active, last activity 2026-08-31
• d4rk4rmy — 18 victim claims, status: monitoring, last activity 2025-09-29
• brotherhood — 18 victim claims, status: monitoring, last activity 2026-01-11
• ralord — 17 victim claims, status: monitoring, last activity 2026-06-01
• madliberator — 17 victim claims, status: monitoring, last activity 2025-06-01
• sabbath — 17 victim claims, status: monitoring, last activity 2025-06-01
• kawa4096 — 17 victim claims, status: monitoring, last activity 2025-09-15
• nasir security — 17 victim claims, status: active, last activity 2026-08-22
• benzona — 17 victim claims, status: monitoring, last activity 2026-03-20
• Ulose — 16 victim claims, status: active, last activity 2026-09-29
• mosesstaff — 16 victim claims, status: monitoring, last activity 2025-06-02
• apos — 16 victim claims, status: monitoring, last activity 2025-11-07
• datacarry — 16 victim claims, status: active, last activity 2026-01-11
• exitium — 15 victim claims, status: active, last activity 2026-10-11
• cheers — 15 victim claims, status: monitoring, last activity 2025-06-01
• cryp70n1c0d3 — 15 victim claims, status: monitoring, last activity 2026-03-29
• nefilim — 15 victim claims, status: monitoring, last activity 2025-06-01
• cyberleek — 15 victim claims, status: active, last activity 2026-10-19
• azroteam — 15 victim claims, status: monitoring, last activity 2021-09-09
• leak bazaar — 14 victim claims, status: monitoring, last activity 2026-05-10
• umbra — 14 victim claims, status: active, last activity 2026-10-14
• mogilevich — 14 victim claims, status: monitoring, last activity 2025-06-01
• babuk — 14 victim claims, status: monitoring, last activity 2025-06-01
• blackout — 14 victim claims, status: monitoring, last activity 2026-07-19
• dataleak — 14 victim claims, status: monitoring, last activity 2026-07-08
• sparta — 14 victim claims, status: monitoring, last activity 2025-06-01
• weyhro — 14 victim claims, status: monitoring, last activity 2026-01-11
• HYFLOCK — 14 victim claims, status: active, last activity 2026-10-13
• teamxxx — 13 victim claims, status: monitoring, last activity 2025-10-01
• Icarus — 13 victim claims, status: monitoring, last activity 2026-06-23
• Sovcali — 13 victim claims, status: active, last activity 2026-10-08
• groove — 13 victim claims, status: monitoring, last activity 2025-06-01
• mindware — 13 victim claims, status: monitoring, last activity 2025-06-01
• argonauts — 13 victim claims, status: monitoring, last activity 2025-06-01
• TiMc — 13 victim claims, status: active, last activity 2026-09-30
• EndZone — 12 victim claims, status: active, last activity 2026-10-06
• cipherforce — 12 victim claims, status: monitoring, last activity 2026-03-26
• IMNCrew — 12 victim claims, status: monitoring, last activity 2026-01-11
• samsam — 12 victim claims, status: monitoring, last activity 2018-09-28
• malekteam — 11 victim claims, status: active, last activity 2026-10-02
• Redact — 11 victim claims, status: active, last activity 2026-10-19
• spirals — 11 victim claims, status: active, last activity 2026-10-03
• PrinzEugen — 11 victim claims, status: monitoring, last activity 2026-07-14
• icefire — 11 victim claims, status: monitoring, last activity 2025-06-01
• cry0 — 11 victim claims, status: active, last activity 2026-10-13
• vypr — 11 victim claims, status: active, last activity 2026-10-07
• global cybernetic collective — 11 victim claims, status: active, last activity 2026-09-29
• imnotavillian — 11 victim claims, status: active, last activity 2026-09-28
• 0day Syndicate — 11 victim claims, status: monitoring, last activity 2026-07-21
• darkpower — 10 victim claims, status: monitoring, last activity 2025-06-01
• darkside — 10 victim claims, status: monitoring, last activity 2025-06-01
• projectrelic — 10 victim claims, status: monitoring, last activity 2025-06-01
• unsafeleak — 10 victim claims, status: monitoring, last activity 2023-07-25
• BYOD — 10 victim claims, status: active, last activity 2026-10-17
• rook — 9 victim claims, status: monitoring, last activity 2025-06-01
• orca — 9 victim claims, status: monitoring, last activity 2026-04-27
• linkc — 9 victim claims, status: monitoring, last activity 2026-04-08
• skira — 9 victim claims, status: monitoring, last activity 2026-01-02
• crazyhunter — 9 victim claims, status: monitoring, last activity 2025-06-01
• bitpaymer — 9 victim claims, status: monitoring, last activity 2019-11-10
• RunSomeWares — 8 victim claims, status: active, last activity 2026-10-08
• cryptbb — 8 victim claims, status: monitoring, last activity 2025-06-01
• qiulong — 8 victim claims, status: monitoring, last activity 2025-06-01
• rancoz — 8 victim claims, status: monitoring, last activity 2025-06-01
• VanHelsing — 8 victim claims, status: monitoring, last activity 2025-06-13
• radiant — 8 victim claims, status: active, last activity 2025-12-12
• nullbulge — 8 victim claims, status: monitoring, last activity 2026-01-11
• THE SEVEN DEADLY SINS — 8 victim claims, status: active, last activity 2026-10-16
• IAMNOTAVILLAIN — 8 victim claims, status: active, last activity 2026-10-11
• Ethics — 8 victim claims, status: active, last activity 2026-09-30
• Falcon — 8 victim claims, status: active, last activity 2026-09-26
• bluewhale — 8 victim claims, status: active, last activity 2026-08-14
• TRIPLE X — 8 victim claims, status: active, last activity 2026-08-10
• cryptolocker — 8 victim claims, status: monitoring, last activity 2019-04-28
• 0mega — 7 victim claims, status: monitoring, last activity 2026-01-11
• cyclops — 7 victim claims, status: monitoring, last activity 2025-06-01
• karma — 7 victim claims, status: monitoring, last activity 2025-06-01
• pay2key — 7 victim claims, status: monitoring, last activity 2026-01-11
• chort — 7 victim claims, status: monitoring, last activity 2025-06-01
• bert — 7 victim claims, status: monitoring, last activity 2025-09-01
• dreamfyre — 7 victim claims, status: monitoring, last activity 2026-06-27
• Meowciety403 — 6 victim claims, status: active, last activity 2026-09-26
• D1R — 6 victim claims, status: active, last activity 2026-09-25
• arkana — 6 victim claims, status: monitoring, last activity 2025-08-05
• atomsilo — 6 victim claims, status: monitoring, last activity 2026-03-10
• redalert — 6 victim claims, status: monitoring, last activity 2025-06-01
• yanluowang — 6 victim claims, status: monitoring, last activity 2025-06-01
• silent — 6 victim claims, status: monitoring, last activity 2025-12-20
• bqtlock — 6 victim claims, status: monitoring, last activity 2026-04-03
• abyss-data — 6 victim claims, status: active, last activity 2026-08-26
• egregor — 6 victim claims, status: monitoring, last activity 2026-01-11
• Cl0p — 6 victim claims, status: active, last activity 2026-09-20
• MYDATA / ALPHA LOCKER — 6 victim claims, status: active, last activity 2026-08-28
• the crew — 6 victim claims, status: active, last activity 2026-08-24
• bravox2 — 6 victim claims, status: monitoring, last activity 2026-02-10
• blacktor — 5 victim claims, status: monitoring, last activity 2025-06-01
• donex — 5 victim claims, status: monitoring, last activity 2025-06-01
• lockdata — 5 victim claims, status: monitoring, last activity 2025-06-01
• pandora — 5 victim claims, status: monitoring, last activity 2025-06-01
• raznatovic — 5 victim claims, status: monitoring, last activity 2025-06-01
• ValenciaLeaks — 5 victim claims, status: monitoring, last activity 2025-06-01
• GDLockerSec — 5 victim claims, status: monitoring, last activity 2025-06-01
• satanlockv2 — 5 victim claims, status: monitoring, last activity 2026-01-11
• kryptos — 5 victim claims, status: active, last activity 2026-01-10
• minteye — 5 victim claims, status: active, last activity 2026-01-11
• pryx — 5 victim claims, status: active, last activity 2026-08-25
• secpo — 5 victim claims, status: monitoring, last activity 2026-04-29
• cryptowall — 5 victim claims, status: monitoring, last activity 2016-06-05
• cryptnet — 4 victim claims, status: monitoring, last activity 2025-06-01
• ransomcortex — 4 victim claims, status: monitoring, last activity 2025-06-01
• SenSayQ — 4 victim claims, status: monitoring, last activity 2025-06-01
• shaoleaks — 4 victim claims, status: monitoring, last activity 2025-06-01
• vendetta — 4 victim claims, status: monitoring, last activity 2025-06-01
• desolator — 4 victim claims, status: monitoring, last activity 2025-11-18
• osiris — 4 victim claims, status: monitoring, last activity 2026-04-09
• ransomblog_noname2 — 4 victim claims, status: monitoring, last activity 2026-01-09
• Scarlettgroup — 4 victim claims, status: active, last activity 2026-10-15
• shiba — 4 victim claims, status: active, last activity 2026-10-10
• BOOBA — 4 victim claims, status: active, last activity 2026-10-04
• 0DAY — 4 victim claims, status: active, last activity 2026-08-16
• lockergoga — 4 victim claims, status: monitoring, last activity 2019-03-22
• scarab — 4 victim claims, status: monitoring, last activity 2018-06-01
• mnt6 — 3 victim claims, status: monitoring, last activity 2026-05-02
• BlackLocks — 3 victim claims, status: active, last activity 2026-09-26
• blackshadow — 3 victim claims, status: monitoring, last activity 2025-06-01
• bonacigroup — 3 victim claims, status: monitoring, last activity 2025-06-01
• grief — 3 victim claims, status: monitoring, last activity 2025-06-01
• hellogookie — 3 victim claims, status: monitoring, last activity 2025-06-01
• noname — 3 victim claims, status: monitoring, last activity 2025-06-01
• ragnarok — 3 victim claims, status: monitoring, last activity 2025-06-01
• trisec — 3 victim claims, status: monitoring, last activity 2025-06-01
• vanirgroup — 3 victim claims, status: monitoring, last activity 2026-01-11
• bluebox — 3 victim claims, status: monitoring, last activity 2025-06-01
• rebornvc — 3 victim claims, status: monitoring, last activity 2026-01-11
• yurei — 3 victim claims, status: monitoring, last activity 2025-10-12
• kyber — 3 victim claims, status: active, last activity 2026-07-30
• kittykatkrew — 3 victim claims, status: monitoring, last activity 2026-02-25
• lynxr — 3 victim claims, status: monitoring, last activity 2026-01-23
• snake — 3 victim claims, status: monitoring, last activity 2020-06-07
• coldlock — 3 victim claims, status: monitoring, last activity 2020-05-05
• locky — 3 victim claims, status: monitoring, last activity 2016-12-12
• insane — 2 victim claims, status: monitoring, last activity 2025-06-01
• nightsky — 2 victim claims, status: monitoring, last activity 2025-06-01
• prolock — 2 victim claims, status: monitoring, last activity 2025-06-01
• lunalock — 2 victim claims, status: monitoring, last activity 2026-01-11
• blackbyte-crux — 2 victim claims, status: monitoring, last activity 2026-06-07
• 0x00 — 2 victim claims, status: active, last activity 2026-10-15
• spy corporate — 2 victim claims, status: active, last activity 2026-08-13
• Blackfield — 2 victim claims, status: monitoring, last activity 2026-07-03
• The Green Blood Group — 2 victim claims, status: monitoring, last activity 2026-02-04
• gookie — 2 victim claims, status: monitoring, last activity 2024-04-19
• bitlocker — 2 victim claims, status: monitoring, last activity 2022-05-02
• wastedlocker — 2 victim claims, status: monitoring, last activity 2020-10-16
• sekhmet — 2 victim claims, status: monitoring, last activity 2020-06-20
• dharma — 2 victim claims, status: monitoring, last activity 2020-06-01
• robbinhood — 2 victim claims, status: monitoring, last activity 2019-05-07
• teslacrypt — 2 victim claims, status: monitoring, last activity 2016-03-09
• crosslock — 1 victim claims, status: monitoring, last activity 2025-06-01
• hades — 1 victim claims, status: monitoring, last activity 2025-06-01
• la_piovra — 1 victim claims, status: monitoring, last activity 2025-06-01
• ranstreet — 1 victim claims, status: monitoring, last activity 2025-06-01
• robinhood — 1 victim claims, status: monitoring, last activity 2026-01-11
• slug — 1 victim claims, status: monitoring, last activity 2025-06-01
• synack — 1 victim claims, status: monitoring, last activity 2025-06-01
• zerotolerance — 1 victim claims, status: monitoring, last activity 2025-06-01
• playboy — 1 victim claims, status: monitoring, last activity 2025-06-01
• walocker — 1 victim claims, status: monitoring, last activity 2026-01-11
• Владивосток — 1 victim claims, status: active, last activity 2026-10-07
• vladivostok — 1 victim claims, status: active, last activity 2026-09-28
• securotop — 1 victim claims, status: active, last activity 2026-08-18
• montage — 1 victim claims, status: active, last activity 2026-08-13
• spycorp — 1 victim claims, status: active, last activity 2026-08-12
• syndicate — 1 victim claims, status: monitoring, last activity 2026-07-13
• threatmarket — 1 victim claims, status: monitoring, last activity 2026-04-02
• Loki — 1 victim claims, status: monitoring, last activity 2026-03-12
• xp95 — 1 victim claims, status: monitoring, last activity 2026-03-04
• reynolds — 1 victim claims, status: monitoring, last activity 2026-02-10
• sicarii — 1 victim claims, status: monitoring, last activity 2026-01-05
• ransomwatch — 1 victim claims, status: monitoring, last activity 2024-01-12
• memedusalockerdusa — 1 victim claims, status: monitoring, last activity 2022-11-15
• blogxx — 1 victim claims, status: monitoring, last activity 2022-10-12
• roadsweep — 1 victim claims, status: monitoring, last activity 2022-07-18
• macaw — 1 victim claims, status: monitoring, last activity 2021-10-16
• deathkitty — 1 victim claims, status: monitoring, last activity 2021-07-22
• zeppelin — 1 victim claims, status: monitoring, last activity 2021-05-19
• networm — 1 victim claims, status: monitoring, last activity 2021-05-02
• maui — 1 victim claims, status: monitoring, last activity 2021-05-01
• astroteam — 1 victim claims, status: monitoring, last activity 2021-04-05
• phoenixcryptolocker — 1 victim claims, status: monitoring, last activity 2021-03-21
• ronggolawe — 1 victim claims, status: monitoring, last activity 2021-02-01
• cring — 1 victim claims, status: monitoring, last activity 2021-01-01
• netflim — 1 victim claims, status: monitoring, last activity 2020-11-01
• agelocker — 1 victim claims, status: monitoring, last activity 2020-08-30
• thanos — 1 victim claims, status: monitoring, last activity 2020-07-01
• mamba — 1 victim claims, status: monitoring, last activity 2020-05-07
• nozelesn — 1 victim claims, status: monitoring, last activity 2018-12-17
• pewcrypt — 1 victim claims, status: monitoring, last activity 2018-11-01
• gandcrab — 1 victim claims, status: monitoring, last activity 2018-09-09
• hermes — 1 victim claims, status: monitoring, last activity 2018-07-27
• triplem — 1 victim claims, status: monitoring, last activity 2018-03-30
• samas — 1 victim claims, status: monitoring, last activity 2018-02-16
• global3 — 1 victim claims, status: monitoring, last activity 2017-09-09
• erebus — 1 victim claims, status: monitoring, last activity 2017-06-10
• cryptomix — 1 victim claims, status: monitoring, last activity 2017-01-15
• cerber — 1 victim claims, status: monitoring, last activity 2017-01-09
• hddcryptor — 1 victim claims, status: monitoring, last activity 2016-11-25
• lechiffre — 1 victim claims, status: monitoring, last activity 2016-03-01
• keyholder — 1 victim claims, status: monitoring, last activity 2015-04-04
• megacode — 1 victim claims, status: monitoring, last activity 2015-03-20
• goznym — 1 victim claims, status: monitoring, last activity 2015-01-01
• cryptoware — 1 victim claims, status: monitoring, last activity 2015-01-01
• Abrahams_Ax — 0 victim claims, status: offline, last activity 2025-06-01
• adminlocker — 0 victim claims, status: offline, last activity 2025-06-01
• againstthewest — 0 victim claims, status: offline, last activity 2025-06-01
• aGl0bGVyCg — 0 victim claims, status: offline, last activity 2025-06-01
• ako — 0 victim claims, status: offline, last activity 2025-06-01
• avos — 0 victim claims, status: offline, last activity 2025-06-01
• aztroteam — 0 victim claims, status: offline, last activity 2025-06-01
• babyduck — 0 victim claims, status: offline, last activity 2025-06-01
• bluesky — 0 victim claims, status: offline, last activity 2025-06-01
• chilelocker — 0 victim claims, status: offline, last activity 2025-06-01
• cooming — 0 victim claims, status: offline, last activity 2025-06-01
• crylock — 0 victim claims, status: offline, last activity 2025-06-01
• dagonlocker — 0 victim claims, status: offline, last activity 2025-06-01
• darkangels — 0 victim claims, status: offline, last activity 2025-06-01
• darkbit — 0 victim claims, status: offline, last activity 2025-06-01
• diavol — 0 victim claims, status: offline, last activity 2025-06-01
• dread — 0 victim claims, status: monitoring, last activity 2026-01-11
• ech0raix — 0 victim claims, status: offline, last activity 2025-08-01
• entropy — 0 victim claims, status: offline, last activity 2025-06-01
• ep918 — 0 victim claims, status: offline, last activity 2025-06-01
• exorcist — 0 victim claims, status: offline, last activity 2025-06-01
• fsteam — 0 victim claims, status: offline, last activity 2025-06-01
• haron — 0 victim claims, status: offline, last activity 2025-06-01
• hellokitty — 0 victim claims, status: offline, last activity 2025-06-01
• holyghost — 0 victim claims, status: offline, last activity 2025-06-01
• hotarus — 0 victim claims, status: offline, last activity 2025-06-01
• lilith — 0 victim claims, status: offline, last activity 2025-06-01
• lolnek — 0 victim claims, status: offline, last activity 2025-06-01
• madcat — 0 victim claims, status: offline, last activity 2025-06-01
• mbc — 0 victim claims, status: offline, last activity 2025-06-01
• mydecryptor — 0 victim claims, status: offline, last activity 2025-06-01
• n3tworm — 0 victim claims, status: offline, last activity 2025-06-01
• nemty — 0 victim claims, status: offline, last activity 2025-06-01
• nevada — 0 victim claims, status: offline, last activity 2025-06-01
• onepercent — 0 victim claims, status: offline, last activity 2025-06-01
• prometheus — 0 victim claims, status: offline, last activity 2025-06-01
• qlocker — 0 victim claims, status: offline, last activity 2025-06-01
• rabbithole — 0 victim claims, status: offline, last activity 2025-06-01
• ramp — 0 victim claims, status: monitoring, last activity 2026-01-11
• ranion — 0 victim claims, status: offline, last activity 2025-06-01
• ransomcartel — 0 victim claims, status: offline, last activity 2025-06-01
• ranzy — 0 victim claims, status: offline, last activity 2025-06-01
• rransom — 0 victim claims, status: offline, last activity 2025-06-01
• shadow — 0 victim claims, status: offline, last activity 2025-06-01
• solidbit — 0 victim claims, status: offline, last activity 2025-06-01
• sugar — 0 victim claims, status: offline, last activity 2025-06-01
• u-bomb — 0 victim claims, status: offline, last activity 2025-06-01
• unknown — 0 victim claims, status: offline, last activity 2025-06-01
• vfokx — 0 victim claims, status: offline, last activity 2025-06-01
• x001xs — 0 victim claims, status: offline, last activity 2025-12-20
• xinof — 0 victim claims, status: offline, last activity 2025-06-01
• zeon — 0 victim claims, status: offline, last activity 2025-06-01
• ContFR — 0 victim claims, status: monitoring, last activity 2026-01-11
• mamona — 0 victim claims, status: monitoring, last activity 2025-06-01
• zerolockersec — 0 victim claims, status: monitoring, last activity 2026-01-11
• ransombay — 0 victim claims, status: offline, last activity 2025-06-12
• bluelocker — 0 victim claims, status: offline
• promptlock — 0 victim claims, status: offline
• ShinySp1d3r — 0 victim claims, status: monitoring, last activity 2026-01-11
• antibrok3rs — 0 victim claims, status: monitoring, last activity 2026-01-11
• aware — 0 victim claims, status: monitoring, last activity 2026-01-11
• bjorka — 0 victim claims, status: monitoring, last activity 2026-01-11
• darkwave — 0 victim claims, status: monitoring, last activity 2026-01-11
• evolution — 0 victim claims, status: monitoring, last activity 2026-01-11
• homeland — 0 victim claims, status: monitoring, last activity 2026-01-11
• j-group — 0 victim claims, status: monitoring, last activity 2026-01-11
• justice_blade — 0 victim claims, status: monitoring, last activity 2026-01-11
• late.lol — 0 victim claims, status: monitoring, last activity 2026-01-11
• lockbit4 — 0 victim claims, status: monitoring, last activity 2026-01-11
• osyolorz-collective — 0 victim claims, status: monitoring, last activity 2026-01-11
• punisher — 0 victim claims, status: monitoring, last activity 2026-01-11
• pyrx — 0 victim claims, status: monitoring, last activity 2026-01-11
• quicklock — 0 victim claims, status: monitoring, last activity 2026-01-11
• ransomedvc2 — 0 victim claims, status: monitoring, last activity 2026-01-11
• ransomware-blog — 0 victim claims, status: monitoring, last activity 2026-01-11
• rtm-locker — 0 victim claims, status: monitoring, last activity 2026-01-11
• satancd — 0 victim claims, status: monitoring, last activity 2026-01-11
• satanlock — 0 victim claims, status: monitoring, last activity 2026-01-11
• scattered-lapsus$-hunters — 0 victim claims, status: monitoring, last activity 2026-01-11
• team-underground — 0 victim claims, status: monitoring, last activity 2026-01-11
• tooda — 0 victim claims, status: monitoring, last activity 2026-01-11
• turkish-crypter — 0 victim claims, status: monitoring, last activity 2026-01-11
• vulcan — 0 victim claims, status: monitoring, last activity 2026-01-11
• waissbein — 0 victim claims, status: monitoring, last activity 2026-01-11
• wiper-leak — 0 victim claims, status: monitoring, last activity 2026-01-11
• 0xFFF — 0 victim claims, status: offline, last activity 2026-01-09
• darkbit01 — 0 victim claims, status: offline, last activity 2021-05-01
• lambda — 0 victim claims, status: offline, last activity 2023-12-25
• trisec_cyberoutlaw — 0 victim claims, status: offline, last activity 2024-04-11
• C3RB3R — 0 victim claims, status: monitoring, last activity 2026-01-09

Deeper analysis of any listed group: the 365-day group dossier, head-to-head group comparison, and the co-claim collision graph.

Back to intelligence overview

Source: reconciled leak-site victim claims aggregated from documented public monitoring providers. Independent providers are distinguished from mirrors, and no provider count verifies an underlying allegation. Definitions for every term used here are in the glossary.

Victim records are provider-reported allegations, not independently verified breaches. Published for research, defense, and educational use.