Threat Actors
The ransomware crews and extortion groups behind recent data breaches — who they are, what they target, and every incident we link to them.
LockBit3339 trackedLockBit is one of the most active ransomware-as-a-service brands, known for fast encryption and a large affiliate network.Qilin1995 trackedQilin is a ransomware-as-a-service operation that encrypts victims and steals data for double-extortion, frequently hitting healthcare and manufacturing.Akira1543 trackedAkira is a ransomware group that targets mid-market companies, exfiltrating data before encryption and pressuring victims on a leak site.Play1275 trackedPlay is a ransomware group known for double-extortion attacks against businesses and public-sector organizations.clop1254 trackedclop is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.INC Ransom871 trackedINC Ransom is a ransomware operation using double-extortion against a range of industries including healthcare and government.ransomhub841 trackedransomhub is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.alphv731 trackedalphv is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.DragonForce594 trackedDragonForce is a ransomware group that runs a leak site and targets enterprises for data theft and extortion.The Gentlemen593 trackedThe Gentlemen is a ransomware/extortion group that lists victims on its leak site and threatens to publish stolen data.bianlian534 trackedbianlian is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.blackbasta523 trackedblackbasta is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.SafePay518 trackedSafePay is a ransomware group using double-extortion against small and mid-sized organizations.medusa517 trackedmedusa is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.8base455 tracked8base is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.lynx413 trackedlynx is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.everest364 trackedeverest is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.conti351 trackedconti is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.dispossessor344 trackeddispossessor is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.lockbit5311 trackedlockbit5 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.pysa309 trackedpysa is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.hunters306 trackedhunters is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.nightspire296 trackednightspire is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.killsec281 trackedkillsec is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.sinobi274 trackedsinobi is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.rhysida273 trackedrhysida is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cactus248 trackedcactus is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.royal211 trackedroyal is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.hive208 trackedhive is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ransomhouse199 trackedransomhouse is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.fog189 trackedfog is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.stormous189 trackedstormous is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.vicesociety188 trackedvicesociety is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.devman184 trackeddevman is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.blacksuit183 trackedblacksuit is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.babuk2180 trackedbabuk2 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.coinbasecartel175 trackedcoinbasecartel is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.handala175 trackedhandala is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.worldleaks173 trackedworldleaks is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.funksec172 trackedfunksec is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cloak166 trackedcloak is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Nova163 trackedNova is a ransomware operation that steals and encrypts victim data and posts stolen files to pressure payment.apt73157 trackedapt73 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ShinyHunters156 trackedShinyHunters is a prolific data-extortion group known for breaching large enterprises and leaking or selling stolen databases, often via compromised cloud and SaaS accounts.blackbyte147 trackedblackbyte is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.avaddon146 trackedavaddon is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.meow145 trackedmeow is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.malas144 trackedmalas is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.snatch142 trackedsnatch is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.sarcoma141 trackedsarcoma is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.spacebears140 trackedspacebears is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ragnarlocker128 trackedragnarlocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.noescape126 trackednoescape is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.raworld123 trackedraworld is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.SilentRansomGroup117 trackedSilentRansomGroup is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.toufan117 trackedtoufan is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.interlock113 trackedinterlock is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ElDorado112 trackedElDorado is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.monti110 trackedmonti is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.payoutsking104 trackedpayoutsking is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cuba103 trackedcuba is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.pear101 trackedpear is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.genesis99 trackedgenesis is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.arcusmedia98 trackedarcusmedia is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.anubis91 trackedanubis is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.abyss90 trackedabyss is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.revil89 trackedrevil is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.kairos88 trackedkairos is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.threeam87 trackedthreeam is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.ransomexx86 trackedransomexx is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.lorenz78 trackedlorenz is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.medusalocker78 trackedmedusalocker is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.warlock78 trackedwarlock is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.cicada330175 trackedcicada3301 is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.direwolf75 trackeddirewolf is a ransomware / data-extortion group tracked on public leak-site monitors. The breaches below are victims it has publicly claimed.Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.