Ransomware Tracker
Ransomware Groups
Every group observed claiming victims, with activity status and recent volume.
Last updated:
Tracked groups
54
Active (last 60 days)
24
Claimed victims
7,170
Groups (54)
| qilin | active | 1,129 | 50 | 20 | 17 Oct 2026 | 11 Aug 2024 |
| clop | active | 701 | 23 | 17 | 3 Oct 2026 | 24 Sept 2026 |
| akira | active | 566 | 18 | 19 | 22 Oct 2026 | 5 Nov 2025 |
| lockbit3 | dormant | 494 | 58 | 19 | 5 Dec 2025 | 26 Feb 2024 |
| incransom | active | 471 | 54 | 21 | 20 Oct 2026 | 6 Aug 2023 |
| dragonforce | active | 391 | 42 | 21 | 24 Aug 2026 | 8 Oct 2025 |
| rhysida | active | 290 | 36 | 20 | 22 Oct 2026 | 12 Nov 2025 |
| play | active | 276 | 12 | 19 | 13 Oct 2026 | 11 Aug 2024 |
| safepay | active | 263 | 29 | 20 | 13 Oct 2026 | 12 Nov 2025 |
| 0apt | dormant | 224 | 5 | 11 | 18 Feb 2026 | 4 Feb 2026 |
| ransomhouse | active | 204 | 48 | 23 | 5 Oct 2026 | 10 Dec 2021 |
| worldleaks | dormant | 185 | 29 | 21 | 4 Jul 2026 | 2 Jul 2025 |
| sinobi | dormant | 182 | 10 | 18 | 5 May 2026 | 10 Oct 2025 |
| nova | dormant | 179 | 36 | 18 | 24 Jul 2026 | 22 Mar 2025 |
| everest | dormant | 148 | 13 | 14 | 30 May 2026 | 14 May 2025 |
| spacebears | active | 141 | 34 | 16 | 15 Oct 2026 | 1 Nov 2025 |
| interlock | active | 133 | 7 | 18 | 13 Oct 2026 | 2 Jan 2026 |
| silentransomgroup | active | 122 | 2 | 17 | 22 Oct 2026 | 11 Nov 2025 |
| lynx | active | 90 | 17 | 19 | 27 Aug 2026 | 15 Sept 2025 |
| chaos | dormant | 88 | 9 | 16 | 10 Aug 2026 | 11 Nov 2025 |
| beast | active | 72 | 17 | 16 | 30 Aug 2026 | 2 Feb 2025 |
| warlock | dormant | 55 | 13 | 8 | 3 Oct 2025 | 2 Apr 2025 |
| abyss | active | 51 | 2 | 14 | 28 Aug 2026 | 11 Nov 2025 |
| arcusmedia | dormant | 50 | 12 | 11 | 16 Sept 2025 | 21 Nov 2024 |
| handala | dormant | 47 | 4 | 10 | 15 Mar 2026 | 15 Aug 2025 |
| nitrogen | dormant | 47 | 7 | 13 | 5 Jun 2026 | 11 Nov 2025 |
| blacknevas | active | 38 | 12 | 16 | 17 Sept 2026 | 8 May 2025 |
| j | dormant | 38 | 9 | 13 | 1 Nov 2025 | 17 Feb 2025 |
| securotrop | active | 38 | 2 | 9 | 18 Sept 2026 | 26 Jun 2025 |
| termite | dormant | 33 | 11 | 16 | 16 Apr 2026 | 30 Sept 2025 |
| direwolf | active | 32 | 8 | 12 | 13 Oct 2026 | 21 Aug 2026 |
| morpheus | active | 28 | 11 | 11 | 1 Oct 2026 | 12 Dec 2024 |
| payoutsking | dormant | 27 | 7 | 11 | 20 Nov 2025 | 27 Jun 2025 |
| ciphbit | dormant | 26 | 11 | 9 | 24 Nov 2025 | 24 Nov 2025 |
| genesis | active | 26 | 2 | 9 | 30 Sept 2026 | 3 Jul 2026 |
| sarcoma | dormant | 26 | 9 | 13 | 30 Mar 2026 | 12 Nov 2025 |
| braincipher | dormant | 25 | 7 | 7 | 11 Nov 2025 | 11 Nov 2025 |
| kraken | dormant | 25 | 9 | 11 | 24 Nov 2025 | 11 Nov 2025 |
| daixin | active | 23 | 4 | 7 | 13 Sept 2026 | 13 Sept 2026 |
| embargo | active | 19 | 4 | 11 | 9 Sept 2026 | 30 Apr 2024 |
| gunra | dormant | 18 | 12 | 7 | 29 Dec 2025 | 26 Nov 2025 |
| crypto24 | active | 17 | 12 | 8 | 16 Sept 2026 | 20 Oct 2025 |
| datacarry | dormant | 15 | 12 | 9 | 7 Dec 2025 | 11 Nov 2025 |
| ransomexx | dormant | 14 | 8 | 8 | 20 Jun 2026 | 8 Jul 2024 |
| weyhro | dormant | 14 | 5 | 7 | 10 Aug 2025 | 12 Dec 2024 |
| radar | dormant | 13 | 4 | 8 | 29 Apr 2026 | 14 Aug 2025 |
| underground | dormant | 13 | 8 | 4 | 25 Jun 2025 | 14 Jul 2023 |
| imncrew | dormant | 12 | 7 | 8 | 11 Nov 2025 | 11 Nov 2025 |
| moneymessage | dormant | 12 | 2 | 8 | 11 Nov 2025 | 11 Nov 2025 |
| medusalocker | dormant | 11 | 4 | 5 | 14 Sept 2025 | 29 Mar 2023 |
| alphalocker | active | 8 | 4 | 4 | 13 Sept 2026 | 13 Sept 2026 |
| blackbyte | dormant | 8 | 3 | 6 | 11 Nov 2025 | 11 Nov 2025 |
| runsomewares | dormant | 6 | 2 | 4 | 11 Nov 2025 | 11 Nov 2025 |
| silent | dormant | 6 | 2 | 4 | 12 Nov 2025 | 12 Nov 2025 |