Ransomware Tracker
Ransomware Groups
Every group observed claiming victims, with activity status and recent volume.
Last updated:
Tracked groups
47
Active (last 60 days)
19
Claimed victims
5,903
Groups (47)
| qilin | active | 989 | 50 | 20 | 28 Aug 2026 | 22 Oct 2025 |
| akira | active | 511 | 18 | 19 | 28 Aug 2026 | 5 Nov 2025 |
| lockbit3 | dormant | 494 | 58 | 19 | 5 Dec 2025 | 26 Feb 2024 |
| incransom | active | 411 | 51 | 21 | 27 Aug 2026 | 12 Jan 2025 |
| dragonforce | active | 392 | 43 | 21 | 24 Aug 2026 | 8 Oct 2025 |
| rhysida | active | 272 | 36 | 20 | 28 Aug 2026 | 12 Nov 2025 |
| play | active | 250 | 10 | 19 | 20 Aug 2026 | 11 Aug 2024 |
| 0apt | dormant | 227 | 5 | 11 | 18 Feb 2026 | 4 Feb 2026 |
| safepay | active | 220 | 24 | 20 | 28 Aug 2026 | 12 Nov 2025 |
| ransomhouse | active | 195 | 45 | 23 | 3 Aug 2026 | 10 Dec 2021 |
| worldleaks | active | 187 | 29 | 21 | 4 Jul 2026 | 2 Jul 2025 |
| sinobi | dormant | 181 | 10 | 18 | 5 May 2026 | 10 Oct 2025 |
| nova | active | 175 | 36 | 18 | 24 Jul 2026 | 22 Mar 2025 |
| everest | dormant | 145 | 13 | 14 | 30 May 2026 | 14 May 2025 |
| spacebears | active | 130 | 33 | 16 | 17 Aug 2026 | 1 Nov 2025 |
| interlock | active | 116 | 7 | 17 | 22 Aug 2026 | 2 Jan 2026 |
| silentransomgroup | active | 108 | 2 | 16 | 22 Aug 2026 | 11 Nov 2025 |
| lynx | active | 87 | 16 | 19 | 6 Aug 2026 | 15 Sept 2025 |
| chaos | active | 76 | 9 | 16 | 10 Aug 2026 | 11 Nov 2025 |
| beast | active | 69 | 17 | 16 | 19 Aug 2026 | 2 Feb 2025 |
| warlock | dormant | 55 | 13 | 8 | 3 Oct 2025 | 2 Apr 2025 |
| abyss | active | 54 | 2 | 14 | 28 Aug 2026 | 11 Nov 2025 |
| arcusmedia | dormant | 50 | 12 | 11 | 16 Sept 2025 | 21 Nov 2024 |
| handala | dormant | 48 | 4 | 10 | 15 Mar 2026 | 15 Aug 2025 |
| nitrogen | dormant | 48 | 7 | 13 | 5 Jun 2026 | 11 Nov 2025 |
| j | dormant | 38 | 9 | 13 | 1 Nov 2025 | 17 Feb 2025 |
| termite | dormant | 34 | 11 | 16 | 16 Apr 2026 | 30 Sept 2025 |
| payoutsking | dormant | 27 | 7 | 11 | 20 Nov 2025 | 27 Jun 2025 |
| ciphbit | dormant | 26 | 11 | 9 | 24 Nov 2025 | 24 Nov 2025 |
| sarcoma | dormant | 26 | 9 | 13 | 30 Mar 2026 | 12 Nov 2025 |
| braincipher | dormant | 25 | 7 | 7 | 11 Nov 2025 | 11 Nov 2025 |
| kraken | dormant | 25 | 9 | 11 | 24 Nov 2025 | 11 Nov 2025 |
| morpheus | active | 25 | 11 | 11 | 30 Jul 2026 | 12 Dec 2024 |
| blacknevas | dormant | 23 | 11 | 12 | 22 Dec 2025 | 8 May 2025 |
| embargo | active | 19 | 4 | 11 | 30 Jun 2026 | 30 Apr 2024 |
| gunra | dormant | 18 | 12 | 7 | 29 Dec 2025 | 26 Nov 2025 |
| crypto24 | dormant | 16 | 13 | 9 | 17 Apr 2026 | 20 Oct 2025 |
| datacarry | dormant | 15 | 12 | 9 | 7 Dec 2025 | 11 Nov 2025 |
| ransomexx | dormant | 14 | 8 | 8 | 20 Jun 2026 | 8 Jul 2024 |
| weyhro | dormant | 14 | 5 | 7 | 10 Aug 2025 | 12 Dec 2024 |
| underground | dormant | 13 | 8 | 4 | 25 Jun 2025 | 14 Jul 2023 |
| imncrew | dormant | 12 | 7 | 8 | 11 Nov 2025 | 11 Nov 2025 |
| moneymessage | dormant | 12 | 2 | 8 | 11 Nov 2025 | 11 Nov 2025 |
| medusalocker | dormant | 11 | 4 | 5 | 14 Sept 2025 | 29 Mar 2023 |
| blackbyte | dormant | 8 | 3 | 6 | 11 Nov 2025 | 11 Nov 2025 |
| runsomewares | dormant | 6 | 2 | 4 | 11 Nov 2025 | 11 Nov 2025 |
| silent | dormant | 6 | 2 | 4 | 12 Nov 2025 | 12 Nov 2025 |