Ransomware group directory

523 tracked ransomware groups with victim-claim counts, leak-site availability, and activity status.

• qilin — 2,728 victim claims, status: active, last activity 2026-08-30
• lockbit3 — 2,526 victim claims, status: active, last activity 2026-07-01
• akira — 1,885 victim claims, status: active, last activity 2026-08-30
• clop — 1,794 victim claims, status: active, last activity 2026-08-13
• play — 1,334 victim claims, status: active, last activity 2026-08-20
• lockbit2 — 1,214 victim claims, status: monitoring, last activity 2025-06-01
• alphv — 1,185 victim claims, status: monitoring, last activity 2026-01-11
• ransomhub — 1,030 victim claims, status: monitoring, last activity 2026-01-11
• incransom — 1,022 victim claims, status: active, last activity 2026-08-29
• the gentlemen — 913 victim claims, status: active, last activity 2026-08-29
• blackbasta — 833 victim claims, status: monitoring, last activity 2025-06-01
• dragonforce — 817 victim claims, status: active, last activity 2026-08-24
• bianlian — 722 victim claims, status: monitoring, last activity 2026-01-11
• medusa — 663 victim claims, status: monitoring, last activity 2026-04-26
• safepay — 645 victim claims, status: active, last activity 2026-08-29
• everest — 615 victim claims, status: active, last activity 2026-08-20
• cactus — 566 victim claims, status: monitoring, last activity 2026-01-11
• 8base — 519 victim claims, status: monitoring, last activity 2025-11-30
• lynx — 477 victim claims, status: active, last activity 2026-08-29
• lockbit5 — 420 victim claims, status: active, last activity 2026-08-28
• nightspire — 374 victim claims, status: active, last activity 2026-08-22
• dispossessor — 369 victim claims, status: monitoring, last activity 2025-06-01
• royal — 364 victim claims, status: monitoring, last activity 2025-06-01
• rhysida — 354 victim claims, status: active, last activity 2026-08-29
• blacksuit — 353 victim claims, status: monitoring, last activity 2026-01-11
• conti — 351 victim claims, status: monitoring, last activity 2025-06-01
• INC Ransom — 316 victim claims, status: active, last activity 2026-08-29
• pysa — 311 victim claims, status: monitoring, last activity 2025-06-01
• hunters — 310 victim claims, status: monitoring, last activity 2026-01-11
• killsec — 303 victim claims, status: active, last activity 2026-08-23
• handala — 284 victim claims, status: monitoring, last activity 2026-04-11
• sinobi — 277 victim claims, status: monitoring, last activity 2026-05-08
• Deadlock — 272 victim claims, status: active, last activity 2026-08-28
• stormous — 268 victim claims, status: active, last activity 2026-07-02
• ransomhouse — 265 victim claims, status: active, last activity 2026-08-18
• noescape — 246 victim claims, status: monitoring, last activity 2025-06-01
• nova — 237 victim claims, status: active, last activity 2026-07-25
• worldleaks — 223 victim claims, status: active, last activity 2026-07-21
• coinbasecartel — 221 victim claims, status: active, last activity 2026-08-23
• killsec3 — 219 victim claims, status: active, last activity 2026-07-23
• hive — 208 victim claims, status: monitoring, last activity 2025-06-01
• hiveleak — 206 victim claims, status: monitoring, last activity 2023-05-26
• malas — 205 victim claims, status: monitoring, last activity 2026-05-09
• fog — 203 victim claims, status: monitoring, last activity 2025-07-05
• vicesociety — 193 victim claims, status: monitoring, last activity 2025-06-01
• cloak — 188 victim claims, status: active, last activity 2026-06-18
• babuk2 — 182 victim claims, status: monitoring, last activity 2025-06-05
• devman — 182 victim claims, status: monitoring, last activity 2026-02-04
• payoutsking — 180 victim claims, status: active, last activity 2026-08-28
• coinbase cartel — 177 victim claims, status: active, last activity 2026-08-31
• shinyhunters — 173 victim claims, status: active, last activity 2026-08-29
• funksec — 171 victim claims, status: active, last activity 2026-07-20
• snatch — 170 victim claims, status: monitoring, last activity 2026-01-11
• spacebears — 170 victim claims, status: active, last activity 2026-08-30
• sarcoma — 166 victim claims, status: monitoring, last activity 2026-03-30
• ragroup — 166 victim claims, status: monitoring, last activity 2026-01-09
• apt73 — 159 victim claims, status: active, last activity 2026-07-24
• killsecurity — 156 victim claims, status: monitoring, last activity 2026-01-09
• meow — 155 victim claims, status: monitoring, last activity 2025-06-01
• SilentRansomGroup — 155 victim claims, status: active, last activity 2026-08-27
• blackbyte — 149 victim claims, status: monitoring, last activity 2026-01-11
• avaddon — 148 victim claims, status: monitoring, last activity 2025-06-01
• ElDorado — 146 victim claims, status: monitoring, last activity 2025-06-01
• krybit — 141 victim claims, status: active, last activity 2026-08-26
• kairos — 137 victim claims, status: active, last activity 2026-08-20
• apt73/bashe — 135 victim claims, status: active, last activity 2026-07-24
• raworld — 133 victim claims, status: monitoring, last activity 2025-06-01
• ragnarlocker — 131 victim claims, status: monitoring, last activity 2026-01-11
• monti — 129 victim claims, status: monitoring, last activity 2025-06-16
• anubis — 129 victim claims, status: active, last activity 2026-08-28
• medusalocker — 127 victim claims, status: active, last activity 2026-08-27
• cicada3301 — 124 victim claims, status: monitoring, last activity 2025-12-12
• interlock — 124 victim claims, status: active, last activity 2026-08-19
• pear — 124 victim claims, status: active, last activity 2026-08-27
• direwolf — 122 victim claims, status: active, last activity 2026-08-31
• toufan — 120 victim claims, status: monitoring, last activity 2026-03-26
• bashe — 119 victim claims, status: monitoring, last activity 2026-02-18
• arcusmedia — 118 victim claims, status: active, last activity 2026-08-24
• chaos — 114 victim claims, status: active, last activity 2026-08-28
• lockbit3_fs — 112 victim claims, status: monitoring, last activity 2026-01-11
• cuba — 111 victim claims, status: monitoring, last activity 2025-06-01
• genesis — 110 victim claims, status: active, last activity 2026-08-25
• abyss — 104 victim claims, status: active, last activity 2026-08-27
• ransomexx — 100 victim claims, status: active, last activity 2026-06-20
• trigona — 98 victim claims, status: monitoring, last activity 2025-06-01
• payload — 98 victim claims, status: active, last activity 2026-08-20
• revil — 97 victim claims, status: monitoring, last activity 2025-06-01
• BrainCipher — 92 victim claims, status: active, last activity 2026-07-22
• threeam — 92 victim claims, status: active, last activity 2026-08-30
• avoslocker — 90 victim claims, status: monitoring, last activity 2025-06-01
• warlock — 82 victim claims, status: monitoring, last activity 2026-03-20
• karakurt — 81 victim claims, status: monitoring, last activity 2026-05-25
• ransomedvc — 81 victim claims, status: monitoring, last activity 2024-06-07
• lorenz — 80 victim claims, status: monitoring, last activity 2025-06-01
• blacknevas — 77 victim claims, status: active, last activity 2026-08-14
• beast — 76 victim claims, status: active, last activity 2026-08-30
• gunra — 71 victim claims, status: active, last activity 2026-08-18
• ExfilSquad — 71 victim claims, status: active, last activity 2026-08-31
• leakeddata — 69 victim claims, status: active, last activity 2026-08-27
• quantum — 68 victim claims, status: monitoring, last activity 2025-06-01
• ransomed — 68 victim claims, status: monitoring, last activity 2025-06-01
• nitrogen — 67 victim claims, status: active, last activity 2026-06-03
• termite — 65 victim claims, status: active, last activity 2026-08-22
• ciphbit — 64 victim claims, status: monitoring, last activity 2026-02-10
• blacklock — 64 victim claims, status: monitoring, last activity 2025-09-24
• flocker — 63 victim claims, status: monitoring, last activity 2025-09-29
• knight — 63 victim claims, status: monitoring, last activity 2025-06-01
• lv — 63 victim claims, status: monitoring, last activity 2025-06-01
• metaencryptor — 62 victim claims, status: active, last activity 2026-08-23
• orova — 62 victim claims, status: active, last activity 2026-08-30
• eraleign (apt73) — 62 victim claims, status: active, last activity 2026-07-24
• titan — 61 victim claims, status: active, last activity 2026-08-20
• mallox — 60 victim claims, status: monitoring, last activity 2025-06-01
• darkvault — 59 victim claims, status: monitoring, last activity 2026-03-24
• embargo — 59 victim claims, status: active, last activity 2026-08-20
• maze — 59 victim claims, status: monitoring, last activity 2026-01-11
• ShadowByt3$ — 59 victim claims, status: active, last activity 2026-08-28
• settra — 59 victim claims, status: active, last activity 2026-08-21
• tengu — 58 victim claims, status: monitoring, last activity 2026-03-10
• bravox — 58 victim claims, status: active, last activity 2026-08-17
• dAn0n — 54 victim claims, status: monitoring, last activity 2025-06-01
• CRPxO — 54 victim claims, status: active, last activity 2026-08-19
• donutleaks — 53 victim claims, status: monitoring, last activity 2025-06-01
• helldown — 52 victim claims, status: monitoring, last activity 2025-06-01
• losttrust — 52 victim claims, status: monitoring, last activity 2025-06-01
• ailock — 51 victim claims, status: active, last activity 2026-08-26
• insomnia — 50 victim claims, status: active, last activity 2026-08-19
• crpx0 — 50 victim claims, status: active, last activity 2026-08-12
• alphalocker — 49 victim claims, status: active, last activity 2026-08-25
• arvinclub — 49 victim claims, status: monitoring, last activity 2025-06-01
• crypto24 — 48 victim claims, status: monitoring, last activity 2026-04-17
• space bears — 48 victim claims, status: active, last activity 2026-08-22
• ryuk — 48 victim claims, status: monitoring, last activity 2021-05-18
• ransomblog_noname — 47 victim claims, status: monitoring, last activity 2026-01-09
• blackshrantac — 46 victim claims, status: monitoring, last activity 2026-01-20
• CMD ORGANIZATION — 46 victim claims, status: active, last activity 2026-08-31
• CMDOrganization — 46 victim claims, status: active, last activity 2026-07-31
• M3rx — 45 victim claims, status: active, last activity 2026-08-29
• midas — 44 victim claims, status: monitoring, last activity 2025-06-01
• ORION — 44 victim claims, status: active, last activity 2026-08-10
• securotrop — 43 victim claims, status: active, last activity 2026-08-18
• Booba Project — 43 victim claims, status: active, last activity 2026-08-30
• Global Secret Group — 43 victim claims, status: active, last activity 2026-08-25
• nokoyawa — 42 victim claims, status: monitoring, last activity 2025-06-01
• Dark Project — 42 victim claims, status: active, last activity 2026-08-25
• J — 41 victim claims, status: monitoring, last activity 2026-01-11
• siegedsec — 40 victim claims, status: monitoring, last activity 2025-06-01
• storm — 40 victim claims, status: active, last activity 2026-08-27
• darkleakmarket — 39 victim claims, status: monitoring, last activity 2026-01-11
• moneymessage — 39 victim claims, status: active, last activity 2026-08-28
• dragonransomware — 39 victim claims, status: monitoring, last activity 2025-06-01
• global — 39 victim claims, status: active, last activity 2026-08-29
• lapsus$ — 39 victim claims, status: active, last activity 2026-06-23
• spook — 38 victim claims, status: monitoring, last activity 2025-06-01
• leaknet — 37 victim claims, status: active, last activity 2026-08-22
• GLOBAL SECRET — 36 victim claims, status: active, last activity 2026-08-28
• daixin — 35 victim claims, status: monitoring, last activity 2026-03-20
• HELIX — 35 victim claims, status: active, last activity 2026-08-30
• werewolves — 34 victim claims, status: monitoring, last activity 2026-01-11
• obscura — 34 victim claims, status: monitoring, last activity 2026-01-11
• xpl0itrs — 34 victim claims, status: active, last activity 2026-08-28
• lamashtu — 34 victim claims, status: active, last activity 2026-06-17
• wannacry — 33 victim claims, status: monitoring, last activity 2025-06-01
• aurora — 33 victim claims, status: active, last activity 2026-08-27
• devman2 — 33 victim claims, status: monitoring, last activity 2026-02-04
• blackmatter — 32 victim claims, status: monitoring, last activity 2025-06-01
• marketo — 32 victim claims, status: monitoring, last activity 2025-06-01
• suncrypt — 32 victim claims, status: monitoring, last activity 2025-06-01
• majinahanashi — 32 victim claims, status: active, last activity 2026-08-29
• hellcat — 31 victim claims, status: monitoring, last activity 2026-01-11
• redransomware — 30 victim claims, status: monitoring, last activity 2025-06-01
• frag — 30 victim claims, status: monitoring, last activity 2025-10-12
• L Group — 30 victim claims, status: active, last activity 2026-08-23
• payloadbin — 29 victim claims, status: monitoring, last activity 2025-06-01
• underground — 29 victim claims, status: monitoring, last activity 2026-01-11
• morpheus — 29 victim claims, status: active, last activity 2026-07-30
• dysphor1a — 29 victim claims, status: active, last activity 2026-08-29
• bavacai — 29 victim claims, status: active, last activity 2026-06-30
• freecivilian — 28 victim claims, status: monitoring, last activity 2025-06-01
• onyx — 28 victim claims, status: monitoring, last activity 2025-06-01
• unsafe — 27 victim claims, status: active, last activity 2026-08-28
• kraken — 27 victim claims, status: active, last activity 2026-08-12
• mydata — 27 victim claims, status: monitoring, last activity 2026-02-28
• fulcrumsec — 27 victim claims, status: active, last activity 2026-06-16
• kelvinsecurity — 26 victim claims, status: monitoring, last activity 2026-01-11
• netwalker — 26 victim claims, status: monitoring, last activity 2025-06-01
• trinity — 26 victim claims, status: monitoring, last activity 2025-08-12
• doppelpaymer — 25 victim claims, status: monitoring, last activity 2025-06-01
• brain cipher — 25 victim claims, status: active, last activity 2026-07-22
• vect — 24 victim claims, status: monitoring, last activity 2026-04-15
• emperador — 24 victim claims, status: active, last activity 2026-08-31
• lockbit3_cronos — 23 victim claims, status: monitoring, last activity 2024-02-27
• radar — 22 victim claims, status: monitoring, last activity 2026-04-29
• dunghill_leak — 22 victim claims, status: monitoring, last activity 2026-01-09
• zawoo — 22 victim claims, status: active, last activity 2026-08-30
• darkrace — 21 victim claims, status: monitoring, last activity 2025-06-01
• xinglocker — 21 victim claims, status: monitoring, last activity 2025-06-01
• panzer — 21 victim claims, status: active, last activity 2026-08-28
• AuditTeam — 21 victim claims, status: active, last activity 2026-08-27
• booba team — 21 victim claims, status: active, last activity 2026-08-24
• leaktheanalyst — 20 victim claims, status: monitoring, last activity 2025-06-01
• kazu — 20 victim claims, status: active, last activity 2026-08-23
• tridentlocker — 20 victim claims, status: active, last activity 2026-07-29
• 3am — 20 victim claims, status: active, last activity 2026-08-29
• blackwater — 20 victim claims, status: active, last activity 2026-08-31
• dunghill — 19 victim claims, status: monitoring, last activity 2025-08-20
• mountlocker — 19 victim claims, status: monitoring, last activity 2025-06-01
• cephalus — 19 victim claims, status: monitoring, last activity 2025-09-28
• Gammax — 19 victim claims, status: active, last activity 2026-08-26
• ALP-001 — 19 victim claims, status: monitoring, last activity 2026-04-08
• ralord — 18 victim claims, status: monitoring, last activity 2026-06-01
• teamxxx — 18 victim claims, status: monitoring, last activity 2025-10-01
• d4rk4rmy — 18 victim claims, status: monitoring, last activity 2025-09-29
• brotherhood — 18 victim claims, status: monitoring, last activity 2026-01-11
• madliberator — 17 victim claims, status: monitoring, last activity 2025-06-01
• sabbath — 17 victim claims, status: monitoring, last activity 2025-06-01
• kawa4096 — 17 victim claims, status: monitoring, last activity 2025-09-15
• benzona — 17 victim claims, status: monitoring, last activity 2026-03-20
• audit team — 17 victim claims, status: active, last activity 2026-08-27
• mogilevich — 16 victim claims, status: monitoring, last activity 2025-06-01
• mosesstaff — 16 victim claims, status: monitoring, last activity 2025-06-02
• apos — 16 victim claims, status: monitoring, last activity 2025-11-07
• secp0 — 16 victim claims, status: monitoring, last activity 2026-04-30
• datacarry — 16 victim claims, status: monitoring, last activity 2026-01-11
• cheers — 15 victim claims, status: monitoring, last activity 2025-06-01
• cryp70n1c0d3 — 15 victim claims, status: monitoring, last activity 2026-03-29
• nefilim — 15 victim claims, status: monitoring, last activity 2025-06-01
• Black X — 15 victim claims, status: active, last activity 2026-08-28
• Barracuda — 15 victim claims, status: active, last activity 2026-08-23
• Icarus — 15 victim claims, status: active, last activity 2026-06-23
• azroteam — 15 victim claims, status: monitoring, last activity 2021-09-09
• babuk — 14 victim claims, status: monitoring, last activity 2025-06-01
• blackout — 14 victim claims, status: active, last activity 2026-07-19
• dataleak — 14 victim claims, status: active, last activity 2026-07-08
• sparta — 14 victim claims, status: monitoring, last activity 2025-06-01
• weyhro — 14 victim claims, status: monitoring, last activity 2026-01-11
• cyberleek — 14 victim claims, status: active, last activity 2026-08-24
• cipherforce — 14 victim claims, status: monitoring, last activity 2026-03-26
• groove — 13 victim claims, status: monitoring, last activity 2025-06-01
• mindware — 13 victim claims, status: monitoring, last activity 2025-06-01
• argonauts — 13 victim claims, status: monitoring, last activity 2025-06-01
• darkpower — 12 victim claims, status: monitoring, last activity 2025-06-01
• IMNCrew — 12 victim claims, status: monitoring, last activity 2025-11-26
• ms13-089 — 12 victim claims, status: active, last activity 2026-08-31
• Wallstreet — 12 victim claims, status: active, last activity 2026-08-30
• samsam — 12 victim claims, status: monitoring, last activity 2018-09-28
• icefire — 11 victim claims, status: monitoring, last activity 2025-06-01
• Doommageddon — 11 victim claims, status: active, last activity 2026-08-28
• arcus media — 11 victim claims, status: active, last activity 2026-08-24
• 0day Syndicate — 11 victim claims, status: active, last activity 2026-07-21
• darkside — 10 victim claims, status: monitoring, last activity 2025-06-01
• malekteam — 10 victim claims, status: monitoring, last activity 2025-06-05
• projectrelic — 10 victim claims, status: monitoring, last activity 2025-06-01
• unsafeleak — 10 victim claims, status: monitoring, last activity 2023-07-25
• exitium — 10 victim claims, status: active, last activity 2026-08-11
• ulose — 10 victim claims, status: active, last activity 2026-06-09
• leak bazaar — 10 victim claims, status: monitoring, last activity 2026-05-10
• nasir security — 10 victim claims, status: monitoring, last activity 2026-04-15
• rook — 9 victim claims, status: monitoring, last activity 2025-06-01
• orca — 9 victim claims, status: monitoring, last activity 2026-04-27
• linkc — 9 victim claims, status: monitoring, last activity 2026-04-08
• skira — 9 victim claims, status: monitoring, last activity 2026-01-02
• crazyhunter — 9 victim claims, status: monitoring, last activity 2025-06-01
• ms13089 — 9 victim claims, status: active, last activity 2026-08-15
• Iah647 — 9 victim claims, status: active, last activity 2026-08-29
• LeakBazaar — 9 victim claims, status: monitoring, last activity 2026-05-10
• black nevas — 9 victim claims, status: monitoring, last activity 2026-04-30
• bitpaymer — 9 victim claims, status: monitoring, last activity 2019-11-10
• cryptbb — 8 victim claims, status: monitoring, last activity 2025-06-01
• qiulong — 8 victim claims, status: monitoring, last activity 2025-06-01
• rancoz — 8 victim claims, status: monitoring, last activity 2025-06-01
• VanHelsing — 8 victim claims, status: monitoring, last activity 2025-06-13
• radiant — 8 victim claims, status: monitoring, last activity 2025-12-12
• nullbulge — 8 victim claims, status: monitoring, last activity 2026-01-11
• TiMc — 8 victim claims, status: active, last activity 2026-08-28
• bluewhale — 8 victim claims, status: active, last activity 2026-08-14
• TRIPLE X — 8 victim claims, status: active, last activity 2026-08-10
• cryptolocker — 8 victim claims, status: monitoring, last activity 2019-04-28
• 0mega — 7 victim claims, status: monitoring, last activity 2026-01-11
• cyclops — 7 victim claims, status: monitoring, last activity 2025-06-01
• karma — 7 victim claims, status: monitoring, last activity 2025-06-01
• pay2key — 7 victim claims, status: monitoring, last activity 2026-01-11
• chort — 7 victim claims, status: monitoring, last activity 2025-06-01
• arkana — 7 victim claims, status: monitoring, last activity 2025-08-05
• bert — 7 victim claims, status: monitoring, last activity 2025-09-01
• nasirsecurity — 7 victim claims, status: active, last activity 2026-08-22
• iah6477 — 7 victim claims, status: active, last activity 2026-08-29
• money message — 7 victim claims, status: active, last activity 2026-08-28
• PrinzEugen — 7 victim claims, status: active, last activity 2026-07-14
• atomsilo — 6 victim claims, status: monitoring, last activity 2026-03-10
• redalert — 6 victim claims, status: monitoring, last activity 2025-06-01
• yanluowang — 6 victim claims, status: monitoring, last activity 2025-06-01
• RunSomeWares — 6 victim claims, status: monitoring, last activity 2026-01-11
• silent — 6 victim claims, status: monitoring, last activity 2025-12-20
• bqtlock — 6 victim claims, status: monitoring, last activity 2026-04-03
• abyss-data — 6 victim claims, status: active, last activity 2026-08-26
• egregor — 6 victim claims, status: monitoring, last activity 2026-01-11
• MYDATA / ALPHA LOCKER — 6 victim claims, status: active, last activity 2026-08-28
• the crew — 6 victim claims, status: active, last activity 2026-08-24
• Sovcali — 6 victim claims, status: active, last activity 2026-08-24
• prinz eugen — 6 victim claims, status: active, last activity 2026-06-28
• netrunner — 6 victim claims, status: monitoring, last activity 2026-04-02
• bravox2 — 6 victim claims, status: monitoring, last activity 2026-02-10
• blacktor — 5 victim claims, status: monitoring, last activity 2025-06-01
• donex — 5 victim claims, status: monitoring, last activity 2025-06-01
• lockbit — 5 victim claims, status: monitoring, last activity 2025-06-01
• lockdata — 5 victim claims, status: monitoring, last activity 2025-06-01
• pandora — 5 victim claims, status: monitoring, last activity 2025-06-01
• raznatovic — 5 victim claims, status: monitoring, last activity 2025-06-01
• ValenciaLeaks — 5 victim claims, status: monitoring, last activity 2025-06-01
• GDLockerSec — 5 victim claims, status: monitoring, last activity 2025-06-01
• satanlockv2 — 5 victim claims, status: monitoring, last activity 2026-01-11
• kryptos — 5 victim claims, status: monitoring, last activity 2026-01-10
• minteye — 5 victim claims, status: monitoring, last activity 2026-01-11
• pryx — 5 victim claims, status: active, last activity 2026-08-25
• ethics — 5 victim claims, status: active, last activity 2026-08-10
• D1R — 5 victim claims, status: active, last activity 2026-07-13
• dreamfyre — 5 victim claims, status: active, last activity 2026-06-27
• mnt6 — 5 victim claims, status: monitoring, last activity 2026-05-02
• secpo — 5 victim claims, status: monitoring, last activity 2026-04-29
• cryptowall — 5 victim claims, status: monitoring, last activity 2016-06-05
• cryptnet — 4 victim claims, status: monitoring, last activity 2025-06-01
• ransomcortex — 4 victim claims, status: monitoring, last activity 2025-06-01
• SenSayQ — 4 victim claims, status: monitoring, last activity 2025-06-01
• shaoleaks — 4 victim claims, status: monitoring, last activity 2025-06-01
• vendetta — 4 victim claims, status: monitoring, last activity 2025-06-01
• desolator — 4 victim claims, status: monitoring, last activity 2025-11-18
• osiris — 4 victim claims, status: monitoring, last activity 2026-04-09
• ransomblog_noname2 — 4 victim claims, status: monitoring, last activity 2026-01-09
• Meowciety403 — 4 victim claims, status: active, last activity 2026-08-29
• falcon — 4 victim claims, status: active, last activity 2026-08-29
• Eclipse — 4 victim claims, status: active, last activity 2026-08-27
• AUR0RA — 4 victim claims, status: active, last activity 2026-08-20
• 0DAY — 4 victim claims, status: active, last activity 2026-08-16
• Redact — 4 victim claims, status: active, last activity 2026-06-28
• lockergoga — 4 victim claims, status: monitoring, last activity 2019-03-22
• scarab — 4 victim claims, status: monitoring, last activity 2018-06-01
• blackshadow — 3 victim claims, status: monitoring, last activity 2025-06-01
• bonacigroup — 3 victim claims, status: monitoring, last activity 2025-06-01
• grief — 3 victim claims, status: monitoring, last activity 2025-06-01
• hellogookie — 3 victim claims, status: monitoring, last activity 2025-06-01
• noname — 3 victim claims, status: monitoring, last activity 2025-06-01
• ragnarok — 3 victim claims, status: monitoring, last activity 2025-06-01
• trisec — 3 victim claims, status: monitoring, last activity 2025-06-01
• vanirgroup — 3 victim claims, status: monitoring, last activity 2026-01-11
• bluebox — 3 victim claims, status: monitoring, last activity 2025-06-01
• rebornvc — 3 victim claims, status: monitoring, last activity 2026-01-11
• yurei — 3 victim claims, status: monitoring, last activity 2025-10-12
• kyber — 3 victim claims, status: active, last activity 2026-07-30
• cry0 — 3 victim claims, status: active, last activity 2026-08-06
• kittykatkrew — 3 victim claims, status: monitoring, last activity 2026-02-25
• lynxr — 3 victim claims, status: monitoring, last activity 2026-01-23
• snake — 3 victim claims, status: monitoring, last activity 2020-06-07
• coldlock — 3 victim claims, status: monitoring, last activity 2020-05-05
• locky — 3 victim claims, status: monitoring, last activity 2016-12-12
• insane — 2 victim claims, status: monitoring, last activity 2025-06-01
• nightsky — 2 victim claims, status: monitoring, last activity 2025-06-01
• prolock — 2 victim claims, status: monitoring, last activity 2025-06-01
• lunalock — 2 victim claims, status: monitoring, last activity 2026-01-11
• blackbyte-crux — 2 victim claims, status: active, last activity 2026-06-07
• spy corporate — 2 victim claims, status: active, last activity 2026-08-13
• Blackfield — 2 victim claims, status: active, last activity 2026-07-03
• The Green Blood Group — 2 victim claims, status: monitoring, last activity 2026-02-04
• gookie — 2 victim claims, status: monitoring, last activity 2024-04-19
• bitlocker — 2 victim claims, status: monitoring, last activity 2022-05-02
• wastedlocker — 2 victim claims, status: monitoring, last activity 2020-10-16
• sekhmet — 2 victim claims, status: monitoring, last activity 2020-06-20
• dharma — 2 victim claims, status: monitoring, last activity 2020-06-01
• robbinhood — 2 victim claims, status: monitoring, last activity 2019-05-07
• teslacrypt — 2 victim claims, status: monitoring, last activity 2016-03-09
• crosslock — 1 victim claims, status: monitoring, last activity 2025-06-01
• hades — 1 victim claims, status: monitoring, last activity 2025-06-01
• la_piovra — 1 victim claims, status: monitoring, last activity 2025-06-01
• ranstreet — 1 victim claims, status: monitoring, last activity 2025-06-01
• robinhood — 1 victim claims, status: monitoring, last activity 2026-01-11
• slug — 1 victim claims, status: monitoring, last activity 2025-06-01
• synack — 1 victim claims, status: monitoring, last activity 2025-06-01
• zerotolerance — 1 victim claims, status: monitoring, last activity 2025-06-01
• playboy — 1 victim claims, status: monitoring, last activity 2025-06-01
• walocker — 1 victim claims, status: monitoring, last activity 2026-01-11
• securotop — 1 victim claims, status: active, last activity 2026-08-18
• montage — 1 victim claims, status: active, last activity 2026-08-13
• BOOBA — 1 victim claims, status: active, last activity 2026-08-10
• syndicate — 1 victim claims, status: active, last activity 2026-07-13
• threatmarket — 1 victim claims, status: monitoring, last activity 2026-04-02
• Loki — 1 victim claims, status: monitoring, last activity 2026-03-12
• xp95 — 1 victim claims, status: monitoring, last activity 2026-03-04
• reynolds — 1 victim claims, status: monitoring, last activity 2026-02-10
• sicarii — 1 victim claims, status: monitoring, last activity 2026-01-05
• ransomwatch — 1 victim claims, status: monitoring, last activity 2024-01-12
• memedusalockerdusa — 1 victim claims, status: monitoring, last activity 2022-11-15
• blogxx — 1 victim claims, status: monitoring, last activity 2022-10-12
• roadsweep — 1 victim claims, status: monitoring, last activity 2022-07-18
• macaw — 1 victim claims, status: monitoring, last activity 2021-10-16
• deathkitty — 1 victim claims, status: monitoring, last activity 2021-07-22
• zeppelin — 1 victim claims, status: monitoring, last activity 2021-05-19
• networm — 1 victim claims, status: monitoring, last activity 2021-05-02
• maui — 1 victim claims, status: monitoring, last activity 2021-05-01
• astroteam — 1 victim claims, status: monitoring, last activity 2021-04-05
• phoenixcryptolocker — 1 victim claims, status: monitoring, last activity 2021-03-21
• ronggolawe — 1 victim claims, status: monitoring, last activity 2021-02-01
• cring — 1 victim claims, status: monitoring, last activity 2021-01-01
• netflim — 1 victim claims, status: monitoring, last activity 2020-11-01
• agelocker — 1 victim claims, status: monitoring, last activity 2020-08-30
• thanos — 1 victim claims, status: monitoring, last activity 2020-07-01
• mamba — 1 victim claims, status: monitoring, last activity 2020-05-07
• nozelesn — 1 victim claims, status: monitoring, last activity 2018-12-17
• pewcrypt — 1 victim claims, status: monitoring, last activity 2018-11-01
• gandcrab — 1 victim claims, status: monitoring, last activity 2018-09-09
• hermes — 1 victim claims, status: monitoring, last activity 2018-07-27
• triplem — 1 victim claims, status: monitoring, last activity 2018-03-30
• samas — 1 victim claims, status: monitoring, last activity 2018-02-16
• global3 — 1 victim claims, status: monitoring, last activity 2017-09-09
• erebus — 1 victim claims, status: monitoring, last activity 2017-06-10
• cryptomix — 1 victim claims, status: monitoring, last activity 2017-01-15
• cerber — 1 victim claims, status: monitoring, last activity 2017-01-09
• hddcryptor — 1 victim claims, status: monitoring, last activity 2016-11-25
• lechiffre — 1 victim claims, status: monitoring, last activity 2016-03-01
• keyholder — 1 victim claims, status: monitoring, last activity 2015-04-04
• megacode — 1 victim claims, status: monitoring, last activity 2015-03-20
• goznym — 1 victim claims, status: monitoring, last activity 2015-01-01
• cryptoware — 1 victim claims, status: monitoring, last activity 2015-01-01
• Abrahams_Ax — 0 victim claims, status: offline, last activity 2025-06-01
• adminlocker — 0 victim claims, status: offline, last activity 2025-06-01
• againstthewest — 0 victim claims, status: offline, last activity 2025-06-01
• aGl0bGVyCg — 0 victim claims, status: offline, last activity 2025-06-01
• ako — 0 victim claims, status: offline, last activity 2025-06-01
• avos — 0 victim claims, status: offline, last activity 2025-06-01
• aztroteam — 0 victim claims, status: offline, last activity 2025-06-01
• babyduck — 0 victim claims, status: offline, last activity 2025-06-01
• bluesky — 0 victim claims, status: offline, last activity 2025-06-01
• chilelocker — 0 victim claims, status: offline, last activity 2025-06-01
• cooming — 0 victim claims, status: offline, last activity 2025-06-01
• crylock — 0 victim claims, status: offline, last activity 2025-06-01
• dagonlocker — 0 victim claims, status: offline, last activity 2025-06-01
• darkangels — 0 victim claims, status: offline, last activity 2025-06-01
• darkbit — 0 victim claims, status: offline, last activity 2025-06-01
• diavol — 0 victim claims, status: offline, last activity 2025-06-01
• dread — 0 victim claims, status: monitoring, last activity 2026-01-11
• ech0raix — 0 victim claims, status: offline, last activity 2025-08-01
• entropy — 0 victim claims, status: offline, last activity 2025-06-01
• ep918 — 0 victim claims, status: offline, last activity 2025-06-01
• exorcist — 0 victim claims, status: offline, last activity 2025-06-01
• fsteam — 0 victim claims, status: offline, last activity 2025-06-01
• haron — 0 victim claims, status: offline, last activity 2025-06-01
• hellokitty — 0 victim claims, status: offline, last activity 2025-06-01
• holyghost — 0 victim claims, status: offline, last activity 2025-06-01
• hotarus — 0 victim claims, status: offline, last activity 2025-06-01
• lilith — 0 victim claims, status: offline, last activity 2025-06-01
• lolnek — 0 victim claims, status: offline, last activity 2025-06-01
• madcat — 0 victim claims, status: offline, last activity 2025-06-01
• mbc — 0 victim claims, status: offline, last activity 2025-06-01
• mydecryptor — 0 victim claims, status: offline, last activity 2025-06-01
• n3tworm — 0 victim claims, status: offline, last activity 2025-06-01
• nemty — 0 victim claims, status: offline, last activity 2025-06-01
• nevada — 0 victim claims, status: offline, last activity 2025-06-01
• onepercent — 0 victim claims, status: offline, last activity 2025-06-01
• prometheus — 0 victim claims, status: offline, last activity 2025-06-01
• qlocker — 0 victim claims, status: offline, last activity 2025-06-01
• rabbithole — 0 victim claims, status: offline, last activity 2025-06-01
• ramp — 0 victim claims, status: monitoring, last activity 2026-01-11
• ranion — 0 victim claims, status: offline, last activity 2025-06-01
• ransomcartel — 0 victim claims, status: offline, last activity 2025-06-01
• ranzy — 0 victim claims, status: offline, last activity 2025-06-01
• rransom — 0 victim claims, status: offline, last activity 2025-06-01
• shadow — 0 victim claims, status: offline, last activity 2025-06-01
• solidbit — 0 victim claims, status: offline, last activity 2025-06-01
• sugar — 0 victim claims, status: offline, last activity 2025-06-01
• u-bomb — 0 victim claims, status: offline, last activity 2025-06-01
• unknown — 0 victim claims, status: offline, last activity 2025-06-01
• vfokx — 0 victim claims, status: offline, last activity 2025-06-01
• x001xs — 0 victim claims, status: offline, last activity 2025-12-20
• xinof — 0 victim claims, status: offline, last activity 2025-06-01
• zeon — 0 victim claims, status: offline, last activity 2025-06-01
• ContFR — 0 victim claims, status: monitoring, last activity 2026-01-11
• mamona — 0 victim claims, status: monitoring, last activity 2025-06-01
• zerolockersec — 0 victim claims, status: monitoring, last activity 2026-01-11
• ransombay — 0 victim claims, status: offline, last activity 2025-06-12
• bluelocker — 0 victim claims, status: offline
• promptlock — 0 victim claims, status: offline
• ShinySp1d3r — 0 victim claims, status: monitoring, last activity 2026-01-11
• antibrok3rs — 0 victim claims, status: monitoring, last activity 2026-01-11
• aware — 0 victim claims, status: monitoring, last activity 2026-01-11
• bjorka — 0 victim claims, status: monitoring, last activity 2026-01-11
• black-nevas — 0 victim claims, status: monitoring, last activity 2026-01-11
• black-suit — 0 victim claims, status: monitoring, last activity 2026-01-11
• coinbase-cartel — 0 victim claims, status: monitoring, last activity 2026-01-11
• darkwave — 0 victim claims, status: monitoring, last activity 2026-01-11
• eraleign-(apt73) — 0 victim claims, status: monitoring, last activity 2026-01-11
• evolution — 0 victim claims, status: monitoring, last activity 2026-01-11
• homeland — 0 victim claims, status: monitoring, last activity 2026-01-11
• imn-crew — 0 victim claims, status: monitoring, last activity 2026-01-11
• inc-ransom — 0 victim claims, status: monitoring, last activity 2026-01-11
• j-group — 0 victim claims, status: monitoring, last activity 2026-01-11
• justice_blade — 0 victim claims, status: monitoring, last activity 2026-01-11
• kelvin-security — 0 victim claims, status: monitoring, last activity 2026-01-11
• late.lol — 0 victim claims, status: monitoring, last activity 2026-01-11
• lockbit4 — 0 victim claims, status: monitoring, last activity 2026-01-11
• money-message — 0 victim claims, status: monitoring, last activity 2026-01-11
• osyolorz-collective — 0 victim claims, status: monitoring, last activity 2026-01-11
• punisher — 0 victim claims, status: monitoring, last activity 2026-01-11
• pyrx — 0 victim claims, status: monitoring, last activity 2026-01-11
• quicklock — 0 victim claims, status: monitoring, last activity 2026-01-11
• ransomedvc2 — 0 victim claims, status: monitoring, last activity 2026-01-11
• ransomware-blog — 0 victim claims, status: monitoring, last activity 2026-01-11
• rtm-locker — 0 victim claims, status: monitoring, last activity 2026-01-11
• satancd — 0 victim claims, status: monitoring, last activity 2026-01-11
• satanlock — 0 victim claims, status: monitoring, last activity 2026-01-11
• scattered-lapsus$-hunters — 0 victim claims, status: monitoring, last activity 2026-01-11
• space-bears — 0 victim claims, status: monitoring, last activity 2026-01-11
• team-underground — 0 victim claims, status: monitoring, last activity 2026-01-11
• tooda — 0 victim claims, status: monitoring, last activity 2026-01-11
• turkish-crypter — 0 victim claims, status: monitoring, last activity 2026-01-11
• vanir-group — 0 victim claims, status: monitoring, last activity 2026-01-11
• vulcan — 0 victim claims, status: monitoring, last activity 2026-01-11
• waissbein — 0 victim claims, status: monitoring, last activity 2026-01-11
• wiper-leak — 0 victim claims, status: monitoring, last activity 2026-01-11
• mount-locker — 0 victim claims, status: monitoring, last activity 2021-05-01
• 0xFFF — 0 victim claims, status: offline, last activity 2026-01-09
• darkbit01 — 0 victim claims, status: offline, last activity 2021-05-01
• lambda — 0 victim claims, status: offline, last activity 2023-12-25
• trisec_cyberoutlaw — 0 victim claims, status: offline, last activity 2024-04-11
• C3RB3R — 0 victim claims, status: monitoring, last activity 2026-01-09

Deeper analysis of any listed group: the 365-day group dossier, head-to-head group comparison, and the co-claim collision graph.

Back to intelligence overview

Source: reconciled leak-site victim claims aggregated from documented public monitoring providers. Independent providers are distinguished from mirrors, and no provider count verifies an underlying allegation. Definitions for every term used here are in the glossary.

Victim records are provider-reported allegations, not independently verified breaches. Published for research, defense, and educational use.