Threat Groups

Qilin (also known as Agenda) is a ransomware-as-a-service operation that emerged in 2022, initially targeting healthcare...

LockBit 3.0 (also known as LockBit Black) is the third major iteration of the LockBit ransomware-as-a-service platform, ...

Play ransomware (also known as PlayCrypt) emerged in mid-2022 and is characterized by its use of the ".play" file extens...

Akira ransomware first appeared in March 2023 and quickly became one of the most active groups of that year, targeting s...

LockBit 2.0 (also known as LockBit Red) was the second major version of the LockBit ransomware-as-a-service platform, ac...

Clop (also spelled Cl0p) is a financially motivated ransomware group attributed to the FIN11/TA505 threat cluster with a...

Medusa ransomware (not to be confused with MedusaLocker) is a ransomware-as-a-service operation that became highly activ...

INC Ransom (INCransom) is a double-extortion ransomware group that emerged in mid-2023, targeting healthcare, education,...

ALPHV (also known as BlackCat or Noberus) was a sophisticated ransomware-as-a-service operation launched in November 202...

Black Basta emerged in April 2022 and is widely assessed by researchers and law enforcement to be composed of former Con...

8Base is a double-extortion ransomware group that first appeared in early 2022 but dramatically escalated activity in mi...

BianLian ransomware first appeared in June 2022 and is attributed by multiple researchers and the FBI/CISA to a China-ba...

RansomHub is a ransomware-as-a-service operation that launched in February 2024 and rapidly became one of the most activ...

The Gentlemen is a ransomware-as-a-service group that emerged in mid-2024 and rapidly accumulated victims across North A...

Dispossessor (also tracked as Radar) was a ransomware-adjacent data extortion operation active from August 2023 until it...

Conti was one of the most prolific and financially damaging ransomware operations in history, attributed by the FBI and ...

SafePay is a double-extortion ransomware group that emerged in late 2024, quickly attracting attention for its professio...

DragonForce is a ransomware-as-a-service operation with roots in a Malaysian hacktivist group of the same name that was ...

Hunters International emerged in October 2023 and is widely assessed to be a rebrand or direct continuation of the Hive ...

PYSA (also known as Mespinoza) is a ransomware group active since 2019 that has primarily targeted education, healthcare...

Everest is a Russian-speaking ransomware and data extortion group active since at least 2020, known for targeting critic...

Sinobi is a data extortion and ransomware group that emerged in 2024 and is assessed to have inherited personnel and cod...

Nightspire is a relatively new double-extortion ransomware group that emerged in early 2025 and has quickly accumulated ...

FOG ransomware is a sophisticated strain first observed in May 2024, initially targeting US educational institutions bef...

LockBit 5.0 (also referred to as LockBit Nation-State) is a claimed successor to LockBit 3.0 that emerged after Operatio...

Rhysida is a ransomware group that emerged in May 2023, quickly gaining notoriety for attacking healthcare providers and...

Lynx is a ransomware-as-a-service operation that emerged in mid-2024 and is assessed to be a rebrand or direct successor...

KillSec (Kill Security) is a hacktivist-turned-cybercriminal group that emerged in late 2023, linked by researchers to I...

Cactus ransomware surfaced in March 2023 and quickly gained attention for exploiting vulnerabilities in Qlik Sense analy...

Hive was a major ransomware-as-a-service operation active from June 2021 until January 2023, targeting over 1,500 organi...

RansomHouse is a data extortion group and marketplace active since December 2021 that focuses on stealing data without n...

Sarcoma is a double-extortion ransomware group that emerged in mid-2024, primarily targeting manufacturing, professional...

Vice Society is a ransomware group that was active from mid-2021 to 2023, distinguished by its heavy focus on the educat...

Handala (also known as Handala Hack Team or Hatef) is an Iran-linked hacktivist group that emerged during the Israel-Ham...

Stormous is a pro-Russian hacktivist and ransomware group that emerged around mid-2021, believed to include members from...

Nova (formerly known as RALord) is a ransomware-as-a-service operation that rebranded from RALord in late 2024. The grou...

Meow ransomware is a strain that emerged in 2022, appending the ".MEOW" extension to encrypted files and primarily targe...

Royal ransomware was active from September 2022 to mid-2023 and is believed to have been formed by former members of the...

CoinbaseCartel (also known as CoinBase Cartel) is a financially motivated cybercrime group that operates a data acquisit...

Babuk 2.0 (also styled as Babuk Locker 2.0 or SatanLock) is a group that impersonates the original Babuk ransomware oper...

SpaceBears is a data extortion group that emerged in 2024, focusing on stealing and publishing sensitive corporate data ...

Avaddon was a ransomware-as-a-service operation active from June 2020 to June 2021, when the operators unexpectedly shut...

BlackSuit is the rebranded continuation of the Royal ransomware operation, confirmed by CISA and FBI in an August 2024 j...

RagnarLocker was a Russia-linked ransomware group active from 2019 to 2023, known for conducting its own intrusions with...

FunkSec is an Algerian ransomware group that emerged in late 2024 and quickly generated a high victim count through a co...

Snatch ransomware (not to be confused with the 2022 data extortion group reusing the brand) is a Russia-linked operation...

WorldLeaks is the rebranded continuation of Hunters International, launched in January 2025 after the group ceased file-...

Abyss (Abyss Data) is a data extortion group that emerged in early 2023, focusing on stealing and publishing sensitive c...

NoEscape was a ransomware-as-a-service operation that launched in June 2023 and is assessed by multiple researchers to b...

Monti is a ransomware group that emerged in June 2022, widely assessed to be a copycat or offshoot of the Conti operatio...

SilentRansomGroup (SRG) is a former Conti team that continued operating independently following Conti's dissolution in 2...

Toufan (also known as Toufan Al-Aqsa) is an Iran-linked hacktivist group that emerged during the Israel-Hamas conflict i...

BlackByte is a ransomware-as-a-service operation first observed in July 2021, assessed to be Russia-linked and notable f...

APT73 is a ransomware group that operated under the "eraleign" identity before rebranding as Bashe in October 2024. Some...

Arcus Media is a ransomware-as-a-service operation that first emerged in May 2024, offering affiliates a Linux and Windo...

Interlock ransomware emerged in late 2024 and is notable for deploying a custom ransomware variant that targets both Win...

PEAR (Pure Extraction And Ransom) Team is a data extortion group that emerged in 2024, focusing on publishing stolen cor...

Eldorado is a ransomware-as-a-service operation that emerged in early 2024, offering both Windows and VMware ESXi encryp...

3AM (ThreeAM) is a ransomware group discovered in September 2023, first observed being deployed as a fallback when LockB...

RansomExx (also known as Defray777) is a ransomware family that targeted multiple high-profile organizations including K...

ShinyHunters is a prolific data theft and extortion group responsible for numerous high-profile breaches including the 2...

Cuba ransomware is a ransomware-as-a-service operation active since at least 2019, assessed to be Russia-linked despite ...

Devman is a former RansomHub and INC Ransom affiliate that began operating independently as a ransomware-as-a-service pl...

Beast ransomware operates as a ransomware-as-a-service platform targeting Windows, Linux, and VMware ESXi environments. ...

REvil (also known as Sodinokibi) was one of the most financially damaging ransomware-as-a-service operations in history,...

Financial interests only. <br/> We do not provide or work with affiliate programs, no collaborations either. <br/...

Kairos is a double-extortion ransomware group that emerged in 2024, operating a dark web leak site and targeting organiz...

Warlock ransomware emerged in mid-2025 and has been attributed by Microsoft, Sophos, and Trend Micro with moderate-to-hi...

Cloak is a cybercriminal ransomware group that first emerged in late 2023, targeting small to mid-size businesses across...

Anubis ransomware emerged in 2024 as a data extortion and ransomware-as-a-service platform that distinguishes itself wit...

DirewWolf is a recently emerged double-extortion ransomware group that conducts targeted attacks against medium to large...

WannaCry was a destructive ransomware worm deployed in May 2017 that infected over 200,000 computers across 150 countrie...

Embargo is a ransomware-as-a-service operation that emerged in mid-2024, utilizing Rust-based encryptors for both Window...

Lorenz is a ransomware group active since early 2021, known for an unusual tactic of selling access to victim networks t...

Karakurt is a data extortion group established in 2021 as an offshoot of the Conti ransomware operation (Wizard Spider),...

Cicada3301 (unrelated to the 2012 internet puzzle) is a ransomware-as-a-service operation that emerged in June 2024 with...

RA World (formerly known as RA Group, active since April 2023) is a ransomware operation linked by Symantec and Palo Alt...

Mallox (also known as TargetCompany, Fargo, or Tohnichi) is a ransomware-as-a-service operation assessed to be China-lin...

Payload is a ransomware group that emerged in 2024, primarily targeting organizations in North America and Europe throug...

Quantum ransomware emerged in August 2021 as a rebrand of the MountLocker operation and was subsequently linked to the C...

Medusa is a DDoS bot written in .NET 2.0. In its current incarnation its C&C protocol is based on HTTP, while its predec...

AvosLocker is a ransomware-as-a-service operation that launched in mid-2021, known for targeting critical infrastructure...

parser needs to be built

BlackLock (also known as Mamona) is a ransomware-as-a-service operation that emerged in late 2023 as an evolution of the...

BrainCipher ransomware surfaced in mid-2024, initially gaining attention for a major attack against Indonesia's National...

DonutLeaks is a data extortion group that emerged in 2022, publishing stolen data from organizations that refused to pay...

Payouts King Group is a data extortion collective that explicitly states it does not operate as a RaaS and does not use ...

DarkVault is a versatile threat actor that emerged in 2024, conducting both ransomware and data extortion operations aga...

AiLock is a ransomware-as-a-service group that emerged in early 2025, marketing itself as AI-assisted and suspected by r...

Ransomware group active in data extortion.

Ryuk ransomware is attributed to the Russia-based Wizard Spider cybercriminal group and was one of the most damaging ran...

Gunra is an emerging ransomware group first identified in April 2025. It employs a classic double-extortion model—encryp...

Maze ransomware pioneered the double-extortion model in late 2019, becoming the first major group to combine file encryp...

Arvin Club first appeared around early to mid-2021, debuting on its Tor leak site with posts dating back to May 5, 2021....

aka Public Data Storage <br/>Crypto24 emerged in early 2025 as a fast-growing double-extortion ransomware-as-a-service ...

Knight is a Ransomware-as-a-Service (RaaS) operation first observed in August 2023, believed to be a rebrand or evolutio...

CiphBit is a ransomware operation first detected in early 2024, using a custom encryptor targeting Windows and network s...

Midas ransomware is a data extortion group active since late 2021 that shares significant technical similarities with th...

Nitrogen is a data extortion group that emerged in 2023, primarily conducting data theft without encryption to pressure ...

Now a RaaS by BlackLock ($$$). <br/>Global Group is a newly emerged Ransomware-as-a-Service (RaaS) platform that debuted...

Helldown is a double-extortion ransomware group that emerged in late 2024, known for exploiting vulnerabilities in Zyxel...

aka black shrantac

We are a group of young people who identify themselves as specialists in the field of network security with at least 15 ...

SunCrypt is a ransomware group active since 2019 that joined the Maze ransomware cartel in 2020, adopting the double-ext...

Termite is a ransomware group that emerged in late 2024, gaining attention for exploiting a zero-day vulnerability in Cl...

Nokoyawa ransomware is a strain active from early 2022 that shares significant code and infrastructure with the Karma an...

DoppelPaymer ransomware is attributed to the Russia-based Evil Corp cybercriminal organization and is a successor to Bit...

Dragon Ransomware, is promising rapid and customizable ransomware operations for Windows systems. Key features include a...

Trigona ransomware was active from late 2022 to 2023, targeting businesses across multiple sectors with AES encryption a...

BlackMatter was a ransomware-as-a-service operation active from July to November 2021, widely assessed as a direct rebra...

dAn0n is a data-extortion actor that first appeared in April 2024. Operating primarily in a leak-focused extortion model...

Chaos ransomware operates as a ransomware-as-a-service builder that has been widely distributed on underground forums si...

Jan13, 2026: We believe the group might be related to Babuk-Bjorka.

Kelvin Security is a cybercrime group active since at least 2013, primarily known for hacktivism, data breaches, and web...

Underground ransomware (also known as Underground Team) is a Russia-linked group associated with the RomCom RAT threat c...

Groove was a short-lived ransomware group and cybercrime gang that emerged in August 2021 and became notable for its agg...

BlackNevas ransomware — also referred to as “Trial Recovery” — was first observed in November 2024. It is a direct deriv...

CMD is a new kind of company that specializes in corporate system security and in identifying vulnerabilities across all...

Daixin Team is a ransomware and data extortion group active since mid-2022, primarily targeting the US healthcare and pu...

DataCarry is a newly observed ransomware and data-extortion operation, first seen in May 2025. It operates a double-exto...

Lapsus$ is a data extortion group that emerged in late 2021, known for social engineering, SIM-swapping, and insider rec...

NetWalker (also known as Mailto) was a ransomware operation active from 2019 to January 2021, when US and Bulgarian auth...

Ransomware group active in data extortion.

D4rk4rmy is a data-extortion focused threat actor that emerged in mid-2025, targeting high-profile organizations across ...

HellCat is a ransomware-as-a-service operation that emerged in late 2024, with KELA researchers identifying core operato...

xing use a custom mountlocker exe

According to Vitali Kremez and Michael Gillespie, this ransomware shares much code with Nemty 2.5. A difference is remov...

A group which seems to recycle leak from other ransomware groups

Dunghill Leak is the publicly branded data leak site (DLS) operated by the Dark Angels ransomware group, established cir...

Apos ransomware surfaced in April 2024 and is best characterized as a data‑broker or leak‑only operation, rather than a ...

Eraleign (APT73) rebranded as Bashe in October 2024 after operating under the Eraleign name, with the transition coincid...

Encrypted Extension: .vanhelsing, .vanlocker. Targets Windows Platform only

Werewolves is a Russia-linked ransomware group that emerged in mid-2023, using a modified version of the LockBit 3.0 sou...

Blackout surfaced in February 2024, using a variant based on DarkSide and BlackMatter ransomware source code, establishi...

FireEye describes DARKSIDE as a ransomware written in C and configurable to target files whether on fixed, removable dis...

Appears to be a Data Extortion group with no encryption.

Cheers is a Linux-based ransomware variant observed starting in May 2022, engineered specifically to target VMware ESXi ...

For those out of the loop, you may already know us as TeamPCP or Shellforce, we have been active a while publishing data...

Frag ransomware emerged in late 2024, primarily observed exploiting Veeam Backup & Replication vulnerabilities (CVE-2024...

0mega is a ransomware group first observed in May 2022, operating with a double extortion model: <br/>* Encrypting victi...

AtomSilo emerged in September 2021 and ceased operations by year-end 2021. It functioned with a double‑extortion model, ...

Chort is a relatively new data-extortion ransomware group that surfaced in late 2024, with confirmed activity beginning ...

Egregor is a ransomware strain that appeared in September 2020, widely believed to be a rebrand or successor to the Maze...

Group is also currently known as MADDLL32 and Metatron.

BERT ransomware (also tracked as Water Pombero) first emerged in April 2025, rapidly targeting both Windows and Linux sy...

Ransomware.

Dark Power is a ransomware group first observed in January 2023, known for targeting small to mid-sized organizations ac...

Karma is a ransomware group first observed in November 2021, operating a double-extortion model that combines data theft...

aka BaqiyatLock <br/>BQTLock surfaced in July 2025 and operates as a fully-fledged Ransomware-as-a-Service (RaaS) with a...

Cyclops ransomware was rebranded as Knight around mid‑2023, emerging initially in early 2023. It operates as a Ransomwar...

DarkRace is a moderately destructive ransomware strain observed since 2024. It encrypts files and appends a randomized e...

<br/> <br/>In the cyber-undergrounds, we're exploring shadowed corridors of the digital world in search of inside infor...

Pandora ransomware was obtained by vx-underground at 2022-03-14.

RANSOMED.VC aka Raznatovic

Ransomware.

BlackShadow is a state-aligned cybercrime group reportedly linked to Iran’s cyber operations, first identified in late 2...

Kraken leak blog (hellokitty) <br/>Kraken is a ransomware family first observed in August 2018 as a Ransomware-as-a-Serv...

PwndLocker is a ransomware that was observed in late 2019 and is reported to have been used to target businesses and loc...

Unlike many other groups, Silent claims to operate with a high level of anonymity and discretion. According to their own...

Official twitter account: https://x.com/ValenciaLeaks72

Dharma is a prolific ransomware family active since at least 2016, evolving from the earlier CrySiS ransomware. It opera...

Our team members are from different countries and we are not interested in anything else, we are only interested in doll...

Grief, also known as Pay or Grief, is a ransomware group that emerged in May 2021 and is widely believed to be operated ...

According to Bleeping Computer, the ransomware is used in targeted attacks against unpatched Citrix servers. It excludes...

Hellcome Bjorkanism <br/>Bjorka emerged as a prominent data-extortion actor and hacktivist initially active in 2022, ta...

CryptNet is a newer Ransomware-as-a-Service (RaaS) operation first identified in April 2023. It follows a double-extorti...

Donex is a ransomware family that emerged in early 2022 as a rebrand of the older Muse ransomware. It uses a double-exto...

Hades is a ransomware group first observed in December 2020, believed by several threat intelligence firms to be operate...

Connected to GD Lockersec and Babuk-Bjorka. <br/> <br/>Group is aka SalanLock (from typo on victim pages).

Zeppelin ransomware is a derivative of the Delphi-based Vega malware family and functions as a Ransomware as a Service (...

3AM, also known as ThreeAM, is a relatively new ransomware family that emerged in late 2023, initially deployed as a fal...

RAAS - Ransomware intégré à un fichier PDF, à faire ouvrir à vos victimes ou à insérer vous-même, Windows et Mac, ne fon...

GandCrab was a prolific Ransomware-as-a-Service (RaaS) operation active from January 2018 to mid-2019. It quickly became...

A hacktivist group protecting artists' rights and ensuring fair compensation for their work.

The group appears unreliable. Most, if not all, of its alleged victims cannot be verified and appear to be randomly sele...

2023Lock is a ransomware strain first observed in January 2024, believed to be an evolution of the Venus and Zeoticus fa...

The locker is written in C/C++/ASM. <br/>It supports all systems starting from Windows 2003, has a separate binary for E...

Abrahams_Ax, first observed in November 2022, is not a Ransomware-as-a-Service (RaaS) operation but a politically motiva...

AdminLocker was first observed around December 2021 and appears to be a lone operator or small group, with no clear Rans...

This ransomware group (notably stylized as aGl0bGVyCg) has extremely limited publicly available information. No confirme...

First observed in early January 2020 (initial victim post on January 9, 2020), Ako (also known as MedusaReborn) operates...

Amnesia ransomware was first identified in May 2017, particularly affecting enterprise cloud environments. It does not a...

Antibrok3rs emerged as an access broker (not a ransomware operator itself) linked to the aftermath of the 2023 MOVEit su...

Aptlock surfaced in early 2025 and is characterized by a single-extortion model combined with threats of data leakage. T...

Arcane first emerged in mid-2021 under the UNC2190 cluster and later rebranded as Sabbath, continuing its operations aga...