Threat Groups

LockBit 3.0 (also known as LockBit Black) is the third major iteration of the LockBit ransomware-as-a-service platform, ...

Everest is a Russian-speaking ransomware and data extortion group active since at least 2020, known for targeting critic...

Qilin (also known as Agenda) is a ransomware-as-a-service operation that emerged in 2022, initially targeting healthcare...

Akira ransomware first appeared in March 2023 and quickly became one of the most active groups of that year, targeting s...

Play ransomware (also known as PlayCrypt) emerged in mid-2022 and is characterized by its use of the ".play" file extens...

Clop (also spelled Cl0p) is a financially motivated ransomware group attributed to the FIN11/TA505 threat cluster with a...

Cactus ransomware surfaced in March 2023 and quickly gained attention for exploiting vulnerabilities in Qlik Sense analy...

LockBit 2.0 (also known as LockBit Red) was the second major version of the LockBit ransomware-as-a-service platform, ac...

INC Ransom (INCransom) is a double-extortion ransomware group that emerged in mid-2023, targeting healthcare, education,...

Chaos ransomware operates as a ransomware-as-a-service builder that has been widely distributed on underground forums si...

ALPHV (also known as BlackCat or Noberus) was a sophisticated ransomware-as-a-service operation launched in November 202...

Black Basta emerged in April 2022 and is widely assessed by researchers and law enforcement to be composed of former Con...

DragonForce is a ransomware-as-a-service operation with roots in a Malaysian hacktivist group of the same name that was ...

Medusa ransomware (not to be confused with MedusaLocker) is a ransomware-as-a-service operation that became highly activ...

RansomHub is a ransomware-as-a-service operation that launched in February 2024 and rapidly became one of the most activ...

SafePay is a double-extortion ransomware group that emerged in late 2024, quickly attracting attention for its professio...

8Base is a double-extortion ransomware group that first appeared in early 2022 but dramatically escalated activity in mi...

The Gentlemen is a ransomware-as-a-service group that emerged in mid-2024 and rapidly accumulated victims across North A...

BianLian ransomware first appeared in June 2022 and is attributed by multiple researchers and the FBI/CISA to a China-ba...

Lynx is a ransomware-as-a-service operation that emerged in mid-2024 and is assessed to be a rebrand or direct successor...

Interlock ransomware emerged in late 2024 and is notable for deploying a custom ransomware variant that targets both Win...

Conti was one of the most prolific and financially damaging ransomware operations in history, attributed by the FBI and ...

Nightspire is a relatively new double-extortion ransomware group that emerged in early 2025 and has quickly accumulated ...

Dispossessor (also tracked as Radar) was a ransomware-adjacent data extortion operation active from August 2023 until it...

PYSA (also known as Mespinoza) is a ransomware group active since 2019 that has primarily targeted education, healthcare...

Hunters International emerged in October 2023 and is widely assessed to be a rebrand or direct continuation of the Hive ...

CoinbaseCartel (also known as CoinBase Cartel) is a financially motivated cybercrime group that operates a data acquisit...

KillSec (Kill Security) is a hacktivist-turned-cybercriminal group that emerged in late 2023, linked by researchers to I...

Sinobi is a data extortion and ransomware group that emerged in 2024 and is assessed to have inherited personnel and cod...

Rhysida is a ransomware group that emerged in May 2023, quickly gaining notoriety for attacking healthcare providers and...

LockBit 5.0 (also referred to as LockBit Nation-State) is a claimed successor to LockBit 3.0 that emerged after Operatio...

Payload is a ransomware group that emerged in 2024, primarily targeting organizations in North America and Europe throug...

RansomHouse is a data extortion group and marketplace active since December 2021 that focuses on stealing data without n...

Hive was a major ransomware-as-a-service operation active from June 2021 until January 2023, targeting over 1,500 organi...

BlackSuit is the rebranded continuation of the Royal ransomware operation, confirmed by CISA and FBI in an August 2024 j...

Handala (also known as Handala Hack Team or Hatef) is an Iran-linked hacktivist group that emerged during the Israel-Ham...

FOG ransomware is a sophisticated strain first observed in May 2024, initially targeting US educational institutions bef...

Vice Society is a ransomware group that was active from mid-2021 to 2023, distinguished by its heavy focus on the educat...

CiphBit is a ransomware operation first detected in early 2024, using a custom encryptor targeting Windows and network s...

FunkSec is an Algerian ransomware group that emerged in late 2024 and quickly generated a high victim count through a co...

Royal ransomware was active from September 2022 to mid-2023 and is believed to have been formed by former members of the...

Stormous is a pro-Russian hacktivist and ransomware group that emerged around mid-2021, believed to include members from...

WorldLeaks is the rebranded continuation of Hunters International, launched in January 2025 after the group ceased file-...

Babuk 2.0 (also styled as Babuk Locker 2.0 or SatanLock) is a group that impersonates the original Babuk ransomware oper...

BlackByte is a ransomware-as-a-service operation first observed in July 2021, assessed to be Russia-linked and notable f...

Avaddon was a ransomware-as-a-service operation active from June 2020 to June 2021, when the operators unexpectedly shut...

Meow ransomware is a strain that emerged in 2022, appending the ".MEOW" extension to encrypted files and primarily targe...

Sarcoma is a double-extortion ransomware group that emerged in mid-2024, primarily targeting manufacturing, professional...

Snatch ransomware (not to be confused with the 2022 data extortion group reusing the brand) is a Russia-linked operation...

SpaceBears is a data extortion group that emerged in 2024, focusing on stealing and publishing sensitive corporate data ...

Eraleign (APT73) rebranded as Bashe in October 2024 after operating under the Eraleign name, with the transition coincid...

RagnarLocker was a Russia-linked ransomware group active from 2019 to 2023, known for conducting its own intrusions with...

SilentRansomGroup (SRG) is a former Conti team that continued operating independently following Conti's dissolution in 2...

NoEscape was a ransomware-as-a-service operation that launched in June 2023 and is assessed by multiple researchers to b...

Nova (formerly known as RALord) is a ransomware-as-a-service operation that rebranded from RALord in late 2024. The grou...

Toufan (also known as Toufan Al-Aqsa) is an Iran-linked hacktivist group that emerged during the Israel-Hamas conflict i...

PEAR (Pure Extraction And Ransom) Team is a data extortion group that emerged in 2024, focusing on publishing stolen cor...

APT73 is a ransomware group that operated under the "eraleign" identity before rebranding as Bashe in October 2024. Some...

ShinyHunters is a prolific data theft and extortion group responsible for numerous high-profile breaches including the 2...

Devman is a former RansomHub and INC Ransom affiliate that began operating independently as a ransomware-as-a-service pl...

Monti is a ransomware group that emerged in June 2022, widely assessed to be a copycat or offshoot of the Conti operatio...

Eldorado is a ransomware-as-a-service operation that emerged in early 2024, offering both Windows and VMware ESXi encryp...

Cuba ransomware is a ransomware-as-a-service operation active since at least 2019, assessed to be Russia-linked despite ...

Arcus Media is a ransomware-as-a-service operation that first emerged in May 2024, offering affiliates a Linux and Windo...

RansomExx (also known as Defray777) is a ransomware family that targeted multiple high-profile organizations including K...

REvil (also known as Sodinokibi) was one of the most financially damaging ransomware-as-a-service operations in history,...

Blackout surfaced in February 2024, using a variant based on DarkSide and BlackMatter ransomware source code, establishi...

Anubis ransomware emerged in 2024 as a data extortion and ransomware-as-a-service platform that distinguishes itself wit...

Kairos is a double-extortion ransomware group that emerged in 2024, operating a dark web leak site and targeting organiz...

Abyss (Abyss Data) is a data extortion group that emerged in early 2023, focusing on stealing and publishing sensitive c...

Cloak is a cybercriminal ransomware group that first emerged in late 2023, targeting small to mid-size businesses across...

Payouts King Group is a data extortion collective that explicitly states it does not operate as a RaaS and does not use ...

Karakurt is a data extortion group established in 2021 as an offshoot of the Conti ransomware operation (Wizard Spider),...

Warlock ransomware emerged in mid-2025 and has been attributed by Microsoft, Sophos, and Trend Micro with moderate-to-hi...

Lorenz is a ransomware group active since early 2021, known for an unusual tactic of selling access to victim networks t...

3AM (ThreeAM) is a ransomware group discovered in September 2023, first observed being deployed as a fallback when LockB...

Cicada3301 (unrelated to the 2012 internet puzzle) is a ransomware-as-a-service operation that emerged in June 2024 with...

Beast ransomware operates as a ransomware-as-a-service platform targeting Windows, Linux, and VMware ESXi environments. ...

DirewWolf is a recently emerged double-extortion ransomware group that conducts targeted attacks against medium to large...

Financial interests only. <br/> We do not provide or work with affiliate programs, no collaborations either. <br/...

AvosLocker is a ransomware-as-a-service operation that launched in mid-2021, known for targeting critical infrastructure...

Quantum ransomware emerged in August 2021 as a rebrand of the MountLocker operation and was subsequently linked to the C...

RA World (formerly known as RA Group, active since April 2023) is a ransomware operation linked by Symantec and Palo Alt...

BlackNevas ransomware — also referred to as “Trial Recovery” — was first observed in November 2024. It is a direct deriv...

Medusa is a DDoS bot written in .NET 2.0. In its current incarnation its C&C protocol is based on HTTP, while its predec...

Jan13, 2026: We believe the group might be related to Babuk-Bjorka.

BlackLock (also known as Mamona) is a ransomware-as-a-service operation that emerged in late 2023 as an evolution of the...

Nitrogen is a data extortion group that emerged in 2023, primarily conducting data theft without encryption to pressure ...

parser needs to be built

Maze ransomware pioneered the double-extortion model in late 2019, becoming the first major group to combine file encryp...

Ransomware group active in data extortion.

BrainCipher ransomware surfaced in mid-2024, initially gaining attention for a major attack against Indonesia's National...

DarkVault is a versatile threat actor that emerged in 2024, conducting both ransomware and data extortion operations aga...

Knight is a Ransomware-as-a-Service (RaaS) operation first observed in August 2023, believed to be a rebrand or evolutio...

Trigona ransomware was active from late 2022 to 2023, targeting businesses across multiple sectors with AES encryption a...

Mallox (also known as TargetCompany, Fargo, or Tohnichi) is a ransomware-as-a-service operation assessed to be China-lin...

Ryuk ransomware is attributed to the Russia-based Wizard Spider cybercriminal group and was one of the most damaging ran...

We are a group of young people who identify themselves as specialists in the field of network security with at least 15 ...

aka Public Data Storage <br/>Crypto24 emerged in early 2025 as a fast-growing double-extortion ransomware-as-a-service ...

Termite is a ransomware group that emerged in late 2024, gaining attention for exploiting a zero-day vulnerability in Cl...

DonutLeaks is a data extortion group that emerged in 2022, publishing stolen data from organizations that refused to pay...

Embargo is a ransomware-as-a-service operation that emerged in mid-2024, utilizing Rust-based encryptors for both Window...

Midas ransomware is a data extortion group active since late 2021 that shares significant technical similarities with th...

aka black shrantac

Nokoyawa ransomware is a strain active from early 2022 that shares significant code and infrastructure with the Karma an...

Gunra is an emerging ransomware group first identified in April 2025. It employs a classic double-extortion model—encryp...

Helldown is a double-extortion ransomware group that emerged in late 2024, known for exploiting vulnerabilities in Zyxel...

AiLock is a ransomware-as-a-service group that emerged in early 2025, marketing itself as AI-assisted and suspected by r...

Arvin Club first appeared around early to mid-2021, debuting on its Tor leak site with posts dating back to May 5, 2021....

WannaCry was a destructive ransomware worm deployed in May 2017 that infected over 200,000 computers across 150 countrie...

SunCrypt is a ransomware group active since 2019 that joined the Maze ransomware cartel in 2020, adopting the double-ext...

BlackMatter was a ransomware-as-a-service operation active from July to November 2021, widely assessed as a direct rebra...

dAn0n is a data-extortion actor that first appeared in April 2024. Operating primarily in a leak-focused extortion model...

Frag ransomware emerged in late 2024, primarily observed exploiting Veeam Backup & Replication vulnerabilities (CVE-2024...

Dragon Ransomware, is promising rapid and customizable ransomware operations for Windows systems. Key features include a...

Now a RaaS by BlackLock ($$$). <br/>Global Group is a newly emerged Ransomware-as-a-Service (RaaS) platform that debuted...

Werewolves is a Russia-linked ransomware group that emerged in mid-2023, using a modified version of the LockBit 3.0 sou...

Ransomware group active in data extortion.

Daixin Team is a ransomware and data extortion group active since mid-2022, primarily targeting the US healthcare and pu...

Kelvin Security is a cybercrime group active since at least 2013, primarily known for hacktivism, data breaches, and web...

Underground ransomware (also known as Underground Team) is a Russia-linked group associated with the RomCom RAT threat c...

NetWalker (also known as Mailto) was a ransomware operation active from 2019 to January 2021, when US and Bulgarian auth...

DoppelPaymer ransomware is attributed to the Russia-based Evil Corp cybercriminal organization and is a successor to Bit...

Lapsus$ is a data extortion group that emerged in late 2021, known for social engineering, SIM-swapping, and insider rec...

xing use a custom mountlocker exe

HellCat is a ransomware-as-a-service operation that emerged in late 2024, with KELA researchers identifying core operato...

Encrypted Extension: .vanhelsing, .vanlocker. Targets Windows Platform only

Hellcome Bjorkanism <br/>Bjorka emerged as a prominent data-extortion actor and hacktivist initially active in 2022, ta...

D4rk4rmy is a data-extortion focused threat actor that emerged in mid-2025, targeting high-profile organizations across ...

DataCarry is a newly observed ransomware and data-extortion operation, first seen in May 2025. It operates a double-exto...

Group is also currently known as MADDLL32 and Metatron.

Dunghill Leak is the publicly branded data leak site (DLS) operated by the Dark Angels ransomware group, established cir...

Apos ransomware surfaced in April 2024 and is best characterized as a data‑broker or leak‑only operation, rather than a ...

According to Vitali Kremez and Michael Gillespie, this ransomware shares much code with Nemty 2.5. A difference is remov...

Appears to be a Data Extortion group with no encryption.

AtomSilo emerged in September 2021 and ceased operations by year-end 2021. It functioned with a double‑extortion model, ...

Cheers is a Linux-based ransomware variant observed starting in May 2022, engineered specifically to target VMware ESXi ...

A group which seems to recycle leak from other ransomware groups

Groove was a short-lived ransomware group and cybercrime gang that emerged in August 2021 and became notable for its agg...

DarkRace is a moderately destructive ransomware strain observed since 2024. It encrypts files and appends a randomized e...

FireEye describes DARKSIDE as a ransomware written in C and configurable to target files whether on fixed, removable dis...

Dark Power is a ransomware group first observed in January 2023, known for targeting small to mid-sized organizations ac...

0mega is a ransomware group first observed in May 2022, operating with a double extortion model: <br/>* Encrypting victi...

Egregor is a ransomware strain that appeared in September 2020, widely believed to be a rebrand or successor to the Maze...

Ransomware.

For those out of the loop, you may already know us as TeamPCP or Shellforce, we have been active a while publishing data...

CMD is a new kind of company that specializes in corporate system security and in identifying vulnerabilities across all...

BERT ransomware (also tracked as Water Pombero) first emerged in April 2025, rapidly targeting both Windows and Linux sy...

Cyclops ransomware was rebranded as Knight around mid‑2023, emerging initially in early 2023. It operates as a Ransomwar...

Chort is a relatively new data-extortion ransomware group that surfaced in late 2024, with confirmed activity beginning ...

Karma is a ransomware group first observed in November 2021, operating a double-extortion model that combines data theft...

Unlike many other groups, Silent claims to operate with a high level of anonymity and discretion. According to their own...

Ransomware.

Pandora ransomware was obtained by vx-underground at 2022-03-14.

RANSOMED.VC aka Raznatovic

A hacktivist group protecting artists' rights and ensuring fair compensation for their work.

Donex is a ransomware family that emerged in early 2022 as a rebrand of the older Muse ransomware. It uses a double-exto...

aka BaqiyatLock <br/>BQTLock surfaced in July 2025 and operates as a fully-fledged Ransomware-as-a-Service (RaaS) with a...

Official twitter account: https://x.com/ValenciaLeaks72

<br/> <br/>In the cyber-undergrounds, we're exploring shadowed corridors of the digital world in search of inside infor...

Kraken leak blog (hellokitty) <br/>Kraken is a ransomware family first observed in August 2018 as a Ransomware-as-a-Serv...

BlackShadow is a state-aligned cybercrime group reportedly linked to Iran’s cyber operations, first identified in late 2...

According to Bleeping Computer, the ransomware is used in targeted attacks against unpatched Citrix servers. It excludes...

Grief, also known as Pay or Grief, is a ransomware group that emerged in May 2021 and is widely believed to be operated ...

Dharma is a prolific ransomware family active since at least 2016, evolving from the earlier CrySiS ransomware. It opera...

RAAS - Ransomware intégré à un fichier PDF, à faire ouvrir à vos victimes ou à insérer vous-même, Windows et Mac, ne fon...

Connected to GD Lockersec and Babuk-Bjorka. <br/> <br/>Group is aka SalanLock (from typo on victim pages).

CryptNet is a newer Ransomware-as-a-Service (RaaS) operation first identified in April 2023. It follows a double-extorti...

Antibrok3rs emerged as an access broker (not a ransomware operator itself) linked to the aftermath of the 2023 MOVEit su...

PwndLocker is a ransomware that was observed in late 2019 and is reported to have been used to target businesses and loc...

Hades is a ransomware group first observed in December 2020, believed by several threat intelligence firms to be operate...

Crux is a newly identified ransomware variant active since July 2025, which claims affiliation with the established Blac...

Group is connected to Qilin.