Threat actors
Ransomware group technical profiles
Technical detail on the groups named in our reports: the vulnerabilities they have been seen exploiting, the ATT&CK techniques and tools reported for them, and their leak-site infrastructure. Built for detection engineers, threat hunters and vulnerability teams.
Countries where the listed groups have claimed the most victims. Choose a group to see its origin and the countries it has targeted.
United States of America4913
United Kingdom538
Canada501
Germany495
Italy345
France329
Spain273
Brazil263
Australia229
India229
49 groups shown
| Group | First tracked | Techniques | Tools | CVEs | Leak sites | Reports |
|---|---|---|---|---|---|---|
| Akira | 2023-04-26 | 36 | 42 | 11 | 2 | 2 |
| APT73 | 2024-04-22 | — | — | — | 11 | 5 |
| Arcus Media | 2024-05-15 | — | — | — | 1 | 1 |
| Aurora | 2026-04-29 | — | — | — | 1 | 1 |
| Babuk | 2020-10-25 | — | 1 | 1 | 1 | 3 |
| BianLian | 2022-07-14 | 11 | 17 | 4 | 3 | 1 |
| BlackByte | 2021-10-04 | 62 | 9 | 1 | 9 | 1 |
| BlackNevas | 2025-08-06 | — | — | — | 1 | 5 |
| BqtLock | 2025-07-31 | — | — | — | 1 | — |
| Cloak | 2023-08-24 | — | — | — | 1 | 1 |
| Coinbase Cartel | 2025-09-15 | 18 | — | — | 1 | 2 |
| CRPxO | 2026-07-09 | — | — | — | 5 | 1 |
| Crypto24 | 2025-04-08 | — | — | — | 1 | 1 |
| Daixin | 2022-08-03 | — | 1 | — | 2 | 1 |
| Deadlock | 2026-06-15 | — | — | — | 2 | 1 |
| Dire Wolf | 2025-05-22 | — | — | — | 1 | 3 |
| Dispossessor | 2024-04-19 | — | — | — | 2 | 2 |
| Doommageddon | 2026-07-06 | — | — | — | 1 | 1 |
| DragonForce | 2023-12-13 | 5 | 4 | 11 | 5 | 6 |
| Embargo | 2024-04-21 | — | 3 | — | 42 | 2 |
| Everest | 2021-09-09 | 17 | 8 | — | 8 | 5 |
| Gammax | 2026-07-30 | — | — | — | 1 | 1 |
| Gunra | 2025-04-23 | — | — | — | 3 | 1 |
| Handala | 2024-05-26 | 77 | — | — | 5 | 3 |
| INC Ransom | 2023-08-09 | 28 | 15 | 1 | 7 | 7 |
| Kairos | 2024-11-13 | — | — | — | 3 | 1 |
| Kazu | 2025-11-11 | — | — | — | 5 | 3 |
| KillSec | 2024-03-21 | — | — | — | 2 | 1 |
| Krybit | 2026-04-03 | — | — | — | 6 | 6 |
| Lamashtu | 2026-04-13 | — | — | — | 2 | 2 |
| LockBit | 2020-10-21 | 25 | — | 8 | 1 | 7 |
| Lynx | 2024-07-29 | 13 | 2 | — | 10 | 2 |
| Medusa | 2023-01-11 | 80 | 27 | 6 | 11 | 1 |
| MedusaLocker | 2022-11-15 | 1 | 11 | — | 5 | 1 |
| Nasir Security | 2025-10-11 | — | — | — | 2 | 4 |
| NightSpire | 2025-03-12 | 35 | 3 | 1 | 6 | 3 |
| Nova | 2025-04-28 | — | — | — | 11 | 3 |
| Panzer | 2026-08-05 | — | — | — | 6 | 2 |
| Payload | 2026-02-17 | 11 | — | — | 2 | 7 |
| Qilin | 2022-10-08 | 55 | 25 | 15 | 4 | 9 |
| RansomExx | 2020-05-14 | — | 6 | 3 | 1 | 1 |
| RansomHub | 2024-02-10 | 83 | 32 | 11 | 3 | 2 |
| Rhysida | 2023-06-05 | 32 | 8 | 1 | 2 | 2 |
| Sarcoma | 2024-10-09 | 23 | 1 | — | 1 | 3 |
| Stormous | 2022-03-22 | 34 | — | — | 4 | 2 |
| Tengu | 2025-10-23 | 10 | — | — | 1 | 5 |
| The Gentlemen | 2025-09-09 | 56 | 34 | 7 | 2 | 9 |
| Titan | 2026-05-18 | — | — | — | 3 | 1 |
| Wallstreet | 2026-06-26 | — | — | — | 1 | 1 |
Data snapshot: 2026-10-11