Threat Groups

Qilin (also known as Agenda) is a ransomware-as-a-service operation that emerged in 2022, initially targeting healthcare...

LockBit 3.0 (also known as LockBit Black) is the third major iteration of the LockBit ransomware-as-a-service platform, ...

Akira ransomware first appeared in March 2023 and quickly became one of the most active groups of that year, targeting s...

Play ransomware (also known as PlayCrypt) emerged in mid-2022 and is characterized by its use of the ".play" file extens...

Clop (also spelled Cl0p) is a financially motivated ransomware group attributed to the FIN11/TA505 threat cluster with a...

The Gentlemen is a ransomware-as-a-service group that emerged in mid-2024 and rapidly accumulated victims across North A...

ALPHV (also known as BlackCat or Noberus) was a sophisticated ransomware-as-a-service operation launched in November 202...

INC Ransom (INCransom) is a double-extortion ransomware group that emerged in mid-2023, targeting healthcare, education,...

Medusa ransomware (not to be confused with MedusaLocker) is a ransomware-as-a-service operation that became highly activ...

LockBit 2.0 (also known as LockBit Red) was the second major version of the LockBit ransomware-as-a-service platform, ac...

8Base is a double-extortion ransomware group that first appeared in early 2022 but dramatically escalated activity in mi...

RansomHub is a ransomware-as-a-service operation that launched in February 2024 and rapidly became one of the most activ...

Black Basta emerged in April 2022 and is widely assessed by researchers and law enforcement to be composed of former Con...

DragonForce is a ransomware-as-a-service operation with roots in a Malaysian hacktivist group of the same name that was ...

SafePay is a double-extortion ransomware group that emerged in late 2024, quickly attracting attention for its professio...

Everest is a Russian-speaking ransomware and data extortion group active since at least 2020, known for targeting critic...

Lynx is a ransomware-as-a-service operation that emerged in mid-2024 and is assessed to be a rebrand or direct successor...

Sinobi is a data extortion and ransomware group that emerged in 2024 and is assessed to have inherited personnel and cod...

LockBit 5.0 (also referred to as LockBit Nation-State) is a claimed successor to LockBit 3.0 that emerged after Operatio...

Cactus ransomware surfaced in March 2023 and quickly gained attention for exploiting vulnerabilities in Qlik Sense analy...

KillSec (Kill Security) is a hacktivist-turned-cybercriminal group that emerged in late 2023, linked by researchers to I...

BianLian ransomware first appeared in June 2022 and is attributed by multiple researchers and the FBI/CISA to a China-ba...

Rhysida is a ransomware group that emerged in May 2023, quickly gaining notoriety for attacking healthcare providers and...

Conti was one of the most prolific and financially damaging ransomware operations in history, attributed by the FBI and ...

Dispossessor (also tracked as Radar) was a ransomware-adjacent data extortion operation active from August 2023 until it...

BlackSuit is the rebranded continuation of the Royal ransomware operation, confirmed by CISA and FBI in an August 2024 j...

Nightspire is a relatively new double-extortion ransomware group that emerged in early 2025 and has quickly accumulated ...

Handala (also known as Handala Hack Team or Hatef) is an Iran-linked hacktivist group that emerged during the Israel-Ham...

Hunters International emerged in October 2023 and is widely assessed to be a rebrand or direct continuation of the Hive ...

Nova (formerly known as RALord) is a ransomware-as-a-service operation that rebranded from RALord in late 2024. The grou...

PYSA (also known as Mespinoza) is a ransomware group active since 2019 that has primarily targeted education, healthcare...

Stormous is a pro-Russian hacktivist and ransomware group that emerged around mid-2021, believed to include members from...

WorldLeaks is the rebranded continuation of Hunters International, launched in January 2025 after the group ceased file-...

FOG ransomware is a sophisticated strain first observed in May 2024, initially targeting US educational institutions bef...

RansomHouse is a data extortion group and marketplace active since December 2021 that focuses on stealing data without n...

Sarcoma is a double-extortion ransomware group that emerged in mid-2024, primarily targeting manufacturing, professional...

FunkSec is an Algerian ransomware group that emerged in late 2024 and quickly generated a high victim count through a co...

Royal ransomware was active from September 2022 to mid-2023 and is believed to have been formed by former members of the...

SpaceBears is a data extortion group that emerged in 2024, focusing on stealing and publishing sensitive corporate data ...

Devman is a former RansomHub and INC Ransom affiliate that began operating independently as a ransomware-as-a-service pl...

Hive was a major ransomware-as-a-service operation active from June 2021 until January 2023, targeting over 1,500 organi...

Beast ransomware operates as a ransomware-as-a-service platform targeting Windows, Linux, and VMware ESXi environments. ...

CoinbaseCartel (also known as CoinBase Cartel) is a financially motivated cybercrime group that operates a data acquisit...

Vice Society is a ransomware group that was active from mid-2021 to 2023, distinguished by its heavy focus on the educat...

BlackByte is a ransomware-as-a-service operation first observed in July 2021, assessed to be Russia-linked and notable f...

Meow ransomware is a strain that emerged in 2022, appending the ".MEOW" extension to encrypted files and primarily targe...

ShinyHunters is a prolific data theft and extortion group responsible for numerous high-profile breaches including the 2...

Malas is a lesser-documented ransomware group that maintains an active dark web presence; detailed information about its

Avaddon was a ransomware-as-a-service operation active from June 2020 to June 2021, when the operators unexpectedly shut...

Snatch ransomware (not to be confused with the 2022 data extortion group reusing the brand) is a Russia-linked operation...

APT73 is a ransomware group that operated under the "eraleign" identity before rebranding as Bashe in October 2024. Some...

Eldorado is a ransomware-as-a-service operation that emerged in early 2024, offering both Windows and VMware ESXi encryp...

3AM (ThreeAM) is a ransomware group discovered in September 2023, first observed being deployed as a fallback when LockB...

Financial interests only. <br/> We do not provide or work with affiliate programs, no collaborations either. <br/...

NoEscape was a ransomware-as-a-service operation that launched in June 2023 and is assessed by multiple researchers to b...

Anubis ransomware emerged in 2024 as a data extortion and ransomware-as-a-service platform that distinguishes itself wit...

Krybit is an emerging RaaS group that launched in late March 2026, offering affiliates an 80/20 revenue split with suppo

Monti is a ransomware group that emerged in June 2022, widely assessed to be a copycat or offshoot of the Conti operatio...

Interlock ransomware emerged in late 2024 and is notable for deploying a custom ransomware variant that targets both Win...

RansomExx (also known as Defray777) is a ransomware family that targeted multiple high-profile organizations including K...

Babuk 2.0 (also styled as Babuk Locker 2.0 or SatanLock) is a group that impersonates the original Babuk ransomware oper...

DirewWolf is a recently emerged double-extortion ransomware group that conducts targeted attacks against medium to large...

PEAR (Pure Extraction And Ransom) Team is a data extortion group that emerged in 2024, focusing on publishing stolen cor...

Kairos is a double-extortion ransomware group that emerged in 2024, operating a dark web leak site and targeting organiz...

SilentRansomGroup (SRG) is a former Conti team that continued operating independently following Conti's dissolution in 2...

WannaCry was a destructive ransomware worm deployed in May 2017 that infected over 200,000 computers across 150 countrie...

REvil (also known as Sodinokibi) was one of the most financially damaging ransomware-as-a-service operations in history,...

Abyss (Abyss Data) is a data extortion group that emerged in early 2023, focusing on stealing and publishing sensitive c...

Arcus Media is a ransomware-as-a-service operation that first emerged in May 2024, offering affiliates a Linux and Windo...

Payload is a ransomware group that emerged in 2024, primarily targeting organizations in North America and Europe throug...

CRPxO is actively recruiting affiliates, offering: 🔹 70% revenue share 🔹 XMR/BTC payouts 🔹 Claimed payouts within 24 ...

Cuba ransomware is a ransomware-as-a-service operation active since at least 2019, assessed to be Russia-linked despite ...

RagnarLocker was a Russia-linked ransomware group active from 2019 to 2023, known for conducting its own intrusions with...

AvosLocker is a ransomware-as-a-service operation that launched in mid-2021, known for targeting critical infrastructure...

Chaos ransomware operates as a ransomware-as-a-service builder that has been widely distributed on underground forums si...

Embargo is a ransomware-as-a-service operation that emerged in mid-2024, utilizing Rust-based encryptors for both Window...

LostTrust is a double-extortion ransomware operation that emerged in March 2023 and publicized over 50 victims within da

Payouts King Group is a data extortion collective that explicitly states it does not operate as a RaaS and does not use ...

Warlock ransomware emerged in mid-2025 and has been attributed by Microsoft, Sophos, and Trend Micro with moderate-to-hi...

AiLock is a ransomware-as-a-service group that emerged in early 2025, marketing itself as AI-assisted and suspected by r...

Cicada3301 (unrelated to the 2012 internet puzzle) is a ransomware-as-a-service operation that emerged in June 2024 with...

RansomedVC was a short-lived extortion group active from August to November 2023 that claimed high-profile victims inclu

Toufan (also known as Toufan Al-Aqsa) is an Iran-linked hacktivist group that emerged during the Israel-Hamas conflict i...

Insomnia is a data-theft and extortion group that emerged in October 2025, targeting primarily US-based healthcare organ

Knight is a Ransomware-as-a-Service (RaaS) operation first observed in August 2023, believed to be a rebrand or evolutio...

RA World (formerly known as RA Group, active since April 2023) is a ransomware operation linked by Symantec and Palo Alt...

CMD is a new kind of company that specializes in corporate system security and in identifying vulnerabilities across all...

Cloak is a cybercriminal ransomware group that first emerged in late 2023, targeting small to mid-size businesses across...

BrainCipher ransomware surfaced in mid-2024, initially gaining attention for a major attack against Indonesia's National...

Gunra is an emerging ransomware group first identified in April 2025. It employs a classic double-extortion model—encryp...

Karakurt is a data extortion group established in 2021 as an offshoot of the Conti ransomware operation (Wizard Spider),...

parser needs to be built

Quantum ransomware emerged in August 2021 as a rebrand of the MountLocker operation and was subsequently linked to the C...

Ransomware group active in data extortion.

Lorenz is a ransomware group active since early 2021, known for an unusual tactic of selling access to victim networks t...

BlackLock (also known as Mamona) is a ransomware-as-a-service operation that emerged in late 2023 as an evolution of the...

DarkVault is a versatile threat actor that emerged in 2024, conducting both ransomware and data extortion operations aga...

Securotrop is a ransomware group established in early 2025 that operates within the Qilin affiliate network while mainta

Trigona ransomware was active from late 2022 to 2023, targeting businesses across multiple sectors with AES encryption a...

aka Public Data Storage <br/>Crypto24 emerged in early 2025 as a fast-growing double-extortion ransomware-as-a-service ...

Frag ransomware emerged in late 2024, primarily observed exploiting Veeam Backup & Replication vulnerabilities (CVE-2024...

Obscura is a ransomware strain observed in 2025, written in Go and specifically targeting Windows domain controllers via

We are a group of young people who identify themselves as specialists in the field of network security with at least 15 ...

M3rx is a small ransomware group first observed in 2025, using AES-CTR/AES-GCM encryption and targeting organizations in

Maze ransomware pioneered the double-extortion model in late 2019, becoming the first major group to combine file encryp...

Nitrogen is a data extortion group that emerged in 2023, primarily conducting data theft without encryption to pressure ...

Termite is a ransomware group that emerged in late 2024, gaining attention for exploiting a zero-day vulnerability in Cl...

DonutLeaks is a data extortion group that emerged in 2022, publishing stolen data from organizations that refused to pay...

dAn0n is a data-extortion actor that first appeared in April 2024. Operating primarily in a leak-focused extortion model...

BlackNevas ransomware — also referred to as “Trial Recovery” — was first observed in November 2024. It is a direct deriv...

aka black shrantac

Lamashtu is an extortion group that first appeared in April 2026, claiming attacks against organizations in France, Roma

Aurora is a ransomware group associated with a multi-purpose Go-based malware distributed by multiple criminal teams fro

Ransomware group active in data extortion.

J is an emerging ransomware group that launched its leak site in May 2025, claiming over 41 victims by late 2025 includi

Dragon Ransomware, is promising rapid and customizable ransomware operations for Windows systems. Key features include a...

Medusa is a DDoS bot written in .NET 2.0. In its current incarnation its C&C protocol is based on HTTP, while its predec...

Ryuk ransomware is attributed to the Russia-based Wizard Spider cybercriminal group and was one of the most damaging ran...

Spook ransomware operated briefly in September–October 2021 as a rebrand of the Prometheus ransomware group (built on th

DarkLeakMarket is a dark web data leak marketplace active since at least 2019 that sells stolen data sourced from ransom

Mallox (also known as TargetCompany, Fargo, or Tohnichi) is a ransomware-as-a-service operation assessed to be China-lin...

Money Message emerged in March 2023 targeting Windows and Linux systems across banking, transportation, and professional

AlphaLocker is a low-cost ransomware operation built on the EDA2 open-source project that sells affiliates an admin pane

Eraleign (APT73) rebranded as Bashe in October 2024 after operating under the Eraleign name, with the transition coincid...

Midas ransomware is a data extortion group active since late 2021 that shares significant technical similarities with th...

FulcrumSec is a data extortion group active since approximately September 2025, specializing in high-speed exfiltration

Helldown is a double-extortion ransomware group that emerged in late 2024, known for exploiting vulnerabilities in Zyxel...

Lapsus$ is a data extortion group that emerged in late 2021, known for social engineering, SIM-swapping, and insider rec...

IMN Crew is a data extortion and ransomware group that emerged in late March 2025, primarily targeting financial service

Nokoyawa ransomware is a strain active from early 2022 that shares significant code and infrastructure with the Karma an...

Radar (also known as Dispossessor), active since August 2023 and led by an actor called "Brain," was a RaaS group target

Werewolves is a Russia-linked ransomware group that emerged in mid-2023, using a modified version of the LockBit 3.0 sou...

CiphBit is a ransomware operation first detected in early 2024, using a custom encryptor targeting Windows and network s...

Founded 4 April 2026

BlackMatter was a ransomware-as-a-service operation active from July to November 2021, widely assessed as a direct rebra...

Only exfiltration

Morpheus emerged in late 2024 as a semi-private RaaS operation whose affiliates share identical payloads with the HellCa

Marketo, launched in April 2021, is a data-theft extortion marketplace that steals and sells data to third parties or ba

Emerging actor candidate first observed 2026-07-07; no verified public victim disclosure yet.

Daixin Team is a ransomware and data extortion group active since mid-2022, primarily targeting the US healthcare and pu...

ShadowByt3$ is a ransomware-as-a-service group first observed in October 2025, using multi-method extortion and communic

Arvin Club first appeared around early to mid-2021, debuting on its Tor leak site with posts dating back to May 5, 2021....

Cephalus is a ransomware group active from mid-2025 that leverages stolen RDP credentials to deploy a Go-based ransomwar

Jan13, 2026: We believe the group might be related to Babuk-Bjorka.

Trinity ransomware was first discovered in May 2024, believed to be a rebrand of the Venus/2023Lock variants, using ChaC

VECT is a RaaS group that launched its affiliate program in December 2025 with a five-tier revenue-sharing model and a f

Group is also currently known as MADDLL32 and Metatron.

⚠️ The group appears unreliable. Most, if not all, of its alleged victims cannot be verified. WE HAVE DECIDED TO REMOVE

Now a RaaS by BlackLock ($$$). <br/>Global Group is a newly emerged Ransomware-as-a-Service (RaaS) platform that debuted...

<br/> <br/>In the cyber-undergrounds, we're exploring shadowed corridors of the digital world in search of inside infor...

SunCrypt is a ransomware group active since 2019 that joined the Maze ransomware cartel in 2020, adopting the double-ext...

xing use a custom mountlocker exe

Dunghill Leak is the publicly branded data leak site (DLS) operated by the Dark Angels ransomware group, established cir...

RALord is a ransomware group identified in March 2025 operating within the NOVA RaaS platform, targeting healthcare, edu

Brotherhood is a ransomware group that emerged in late 2025, targeting organizations in the US, Canada, and Australia ac

Cyclops ransomware was rebranded as Knight around mid‑2023, emerging initially in early 2023. It operates as a Ransomwar...

D4rk4rmy is a data-extortion focused threat actor that emerged in mid-2025, targeting high-profile organizations across ...

DoppelPaymer ransomware is attributed to the Russia-based Evil Corp cybercriminal organization and is a successor to Bit...

Kelvin Security is a cybercrime group active since at least 2013, primarily known for hacktivism, data breaches, and web...

NetWalker (also known as Mailto) was a ransomware operation active from 2019 to January 2021, when US and Bulgarian auth...

LeakTheAnalyst is a data-theft extortion group that operates a dark web leak site with approximately 20 claimed victims,

TridentLocker is a newly emerged ransomware group (surfaced mid-2025) targeting organizations managing high volumes of r

A group which seems to recycle leak from other ransomware groups

VanHelsing is a multi-platform RaaS operation that launched on March 7, 2025, requiring a $5,000 affiliate deposit and s

Sabbath (also known as 54BB47h, operated by UNC2190) is a ransomware group active from mid-2021 that emerged as a rebran

Not a ransomware group but a hacktivist group that appeared coincidentally days before Russia’s invasion of Ukraine

Appears to be a Data Extortion group with no encryption.

AtomSilo emerged in September 2021 and ceased operations by year-end 2021. It functioned with a double‑extortion model, ...

Cheers is a Linux-based ransomware variant observed starting in May 2022, engineered specifically to target VMware ESXi ...

Mogilevich appeared in February 2024, rapidly claiming high-profile breaches of Epic Games, DJI, Shein, and Kick.com, bu

PayloadBIN is a ransomware strain deployed in 2021 by Evil Corp as a rebranding of their WastedLocker/Hades/Phoenix line

TeamXXX is an emerging ransomware group that launched its leak site in June 2025, claiming victims across healthcare, ag

Benzona is a financially motivated ransomware group that emerged in late 2024, targeting small to mid-sized organization

CryptBB is a ransomware group with likely Russian origins active around 2023, whose payload appends random extensions to

Flocker (also linked to the FSociety brand) is a ransomware-as-a-service group active since 2023–2024, targeting Windows

HellCat is a ransomware-as-a-service operation that emerged in late 2024, with KELA researchers identifying core operato...

MountLocker operated as a ransomware-as-a-service from July 2020, using a standard developer/affiliate revenue split and

Underground ransomware (also known as Underground Team) is a Russia-linked group associated with the RomCom RAT threat c...

For those out of the loop, you may already know us as TeamPCP or Shellforce, we have been active a while publishing data...

DataCarry is a newly observed ransomware and data-extortion operation, first seen in May 2025. It operates a double-exto...

FreeCivilian is a data extortion group with suspected ties to Russian GRU military intelligence, known for targeting Ukr

Groove was a short-lived ransomware group and cybercrime gang that emerged in August 2021 and became notable for its agg...

DarkRace is a moderately destructive ransomware strain observed since 2024. It encrypts files and appends a randomized e...

RunSomeWares is an emerging ransomware group that surfaced in February 2025 with initial victims across supply-chain ser

Encrypted Extension: .vanhelsing, .vanlocker. Targets Windows Platform only

Skira is a small ransomware group that emerged around late 2024, claiming responsibility for the breach of Carruth Compl

Apos ransomware surfaced in April 2024 and is best characterized as a data‑broker or leak‑only operation, rather than a ...

Arkana is a ransomware group that emerged in early 2025 and gained attention by claiming an attack on U.S. broadband pro

Blackout surfaced in February 2024, using a variant based on DarkSide and BlackMatter ransomware source code, establishi...

According to Vitali Kremez and Michael Gillespie, this ransomware shares much code with Nemty 2.5. A difference is remov...

Red Ransomware (Red CryptoApp) emerged in early 2024, debuting its "Wall of Shame" data leak site with 11 victims across

Sparta is a short-lived ransomware group first observed in September 2022 that conducted double-extortion attacks primar

FireEye describes DARKSIDE as a ransomware written in C and configurable to target files whether on fixed, removable dis...

Linkc is a ransomware group first observed in February 2025, operating a Tor-based data leak site and targeting US-based

Malek Team is an Iranian-linked threat actor that emerged on October 8, 2023 (the day after the Hamas attack on Israel),

Cybereason Nocturnus describes Moses Staff as an Iranian hacker group, first spotted in October 2021. Their motivation a

MS13089 is a newly emerged ransomware group (first observed December 2025) that named itself after a 2013 Microsoft Secu

CrazyHunter is a Go-based ransomware group that emerged in early 2025, derived from the open-source Prince encryptor, ex

Direct Extortion Double Extortion

Qiulong is a ransomware group that emerged around April 2024 primarily targeting Brazilian organizations using double ex

Radiant is a financially motivated ransomware group that emerged in September 2025, conducting double- and single-extort

Blackwater is a ransomware group that first surfaced in early 2026, combining file encryption with data theft and target

Cryp70n1c0d3 is a low-profile ransomware group with limited public documentation; specific targets, attack methodology,

Dataleak is a low-profile ransomware group with approximately 6 known victims including entities in Brazil; very limited

Donex is a ransomware family that emerged in early 2022 as a rebrand of the older Muse ransomware. It uses a double-exto...

IceFire is a ransomware group first observed in 2022 that expanded to Linux in early 2023 by exploiting a vulnerability

Ransomware, potential rebranding of win.sfile.

NetRunner is a ransomware group active from at least 2025 targeting diverse sectors including healthcare, telecommunicat

Onyx is a ransomware group first observed in April 2022, based on the Chaos ransomware builder, that is notably destruct

Osiris is a ransomware-as-a-service operation first observed in November 2025 that uses a Bring Your Own Vulnerable Driv

3AM, also known as ThreeAM, is a relatively new ransomware family that emerged in late 2023, initially deployed as a fal...

AuditTeam is a small ransomware group with approximately 5 known victims, primarily targeting organizations in East and

Babuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most us

Chort is a relatively new data-extortion ransomware group that surfaced in late 2024, with confirmed activity beginning ...

CryptNet is a newer Ransomware-as-a-Service (RaaS) operation first identified in April 2023. It follows a double-extorti...

Kraken leak blog (hellokitty) <br/>Kraken is a ransomware family first observed in August 2018 as a Ransomware-as-a-Serv...

MNT6 is a lower-profile ransomware group claiming victims across legal, manufacturing, construction, healthcare, and log

Pay2Key is ransomware that has been used by the threat actor Fox Kitten. The group seems to operate since July 2020, tar

Project Relic emerged in mid-2022 as a Golang-based ransomware targeting Windows and Linux hosts, operating with a TOR-b

RebornVC is a rebrand of RansomedVC re-emerging in July 2025 under new leadership, using data auctions, direct extortion

Ransomware.

Unlike many other groups, Silent claims to operate with a high level of anonymity and discretion. According to their own...

TiMc is a ransomware group that emerged in early 2026, claiming high-impact attacks against Spanish IT services leader S

Argonauts is a ransomware group that emerged in September 2024, operating a double-extortion model targeting logistics,

BERT ransomware (also tracked as Water Pombero) first emerged in April 2025, rapidly targeting both Windows and Linux sy...

Dark Power is a ransomware group first observed in January 2023, known for targeting small to mid-sized organizations ac...

RANSOMED.VC aka Raznatovic

Official twitter account: https://x.com/ValenciaLeaks72

XP95 is a cyber-extortion group that emerged in March 2026, using a pure data-theft-and-extortion model with a Windows X

Ransomware.

0mega is a ransomware group first observed in May 2022, operating with a double extortion model: <br/>* Encrypting victi...

Booba

aka BaqiyatLock <br/>BQTLock surfaced in July 2025 and operates as a fully-fledged Ransomware-as-a-Service (RaaS) with a...

D1R Claims Synopsys and Bosch Breaches, but Synopsys Disputes Intrusion

Exitium is a data extortion group first observed in early 2026, operating a Tor-based double extortion site and targetin

Karma is a ransomware group first observed in November 2021, operating a double-extortion model that combines data theft...

Kawa4096 is a ransomware group that emerged in June 2025, targeting multinational corporations across finance, education

LunaLock emerged in September 2025 targeting creative and digital platforms, notably breaching an illustrator marketplac

MintEye is a ransomware group with concentrated activity in North America, targeting professional services, construction

Orca is a ransomware group that emerged in September 2024, identified as a variant of the Zeppelin malware family, targe

RedAlert (also called N13V) is a ransomware group first observed in July 2022 that targets both Windows and Linux VMware

Crux is a newly identified ransomware variant active since July 2025, which claims affiliation with the established Blac...

BlackShadow is a state-aligned cybercrime group reportedly linked to Iran’s cyber operations, first identified in late 2...

Desolator is a ransomware group that emerged in May 2025, targeting construction and engineering firms in Latin America

Dharma is a prolific ransomware family active since at least 2016, evolving from the earlier CrySiS ransomware. It opera...

Our team members are from different countries and we are not interested in anything else, we are only interested in doll...

HelloGookie is a rebrand of the HelloKitty ransomware group announced in April 2024, releasing previously stolen data fr

Insane is a short-lived ransomware group that briefly surfaced in early 2024, claiming a single victim in Thailand befor

KittyKatKrew is a newly emerged ransomware group first identified in early 2026, using both direct and double-extortion

LockData Auction is a dark web marketplace that emerged around May 2021 operating an invite-only stolen data auction por

Pandora ransomware was obtained by vx-underground at 2022-03-14.

According to Bleeping Computer, the ransomware is used in targeted attacks against unpatched Citrix servers. It excludes...