Ransomware and threat groups
Every group named in an incident, most active first. A group's claim stays a claim until the organisation or a regulator confirms it.
Updated 14 Nov 2026, 10:11 UTC, 33 of 36 sources answering. History from 14 Nov 2025.
- The GentlemenLatest 13 Nov 2026148
- QilinLatest 14 Nov 2026121
- N0nLatest 13 Nov 2026108
- Inc RansomLatest 13 Nov 202653
- AkiraLatest 14 Nov 202644
- Booba TeamLatest 10 Nov 202632
- PlayLatest 13 Nov 202626
- Lockbit5Latest 8 Nov 202625
- SoulLatest 6 Nov 202625
- EverestLatest 13 Nov 202623
- EmperadorLatest 13 Nov 202623
- InterlockLatest 13 Nov 202621
- RhysidaLatest 9 Nov 202621
- Brain CipherLatest 6 Nov 202621
- WallstreetLatest 13 Nov 202620
- VortexLatest 10 Nov 202620
- SafepayLatest 7 Nov 202620
- PixelleaksLatest 14 Nov 202619
- OrovaLatest 10 Nov 202619
- WhitearmorLatest 8 Nov 202619
- Audit TeamLatest 9 Nov 202618
- LeakeddataLatest 13 Nov 202616
- ClimaxLatest 10 Nov 202616
- HyflockLatest 13 Nov 202615
- AuroraLatest 9 Nov 202615
- MajinahanashiLatest 8 Nov 202615
- PayloadLatest 7 Nov 202615
- MetaencryptorLatest 10 Nov 202614
- DeadlockLatest 11 Nov 202612
- Dark ProjectLatest 11 Nov 202612
- NightspireLatest 7 Nov 202612
- GenesisLatest 6 Nov 202612
- ByodLatest 13 Nov 202611
- PearLatest 5 Nov 202611
- Aoqin LeaksLatest 13 Nov 202610
- VexyLatest 9 Nov 202610
- KrybitLatest 13 Nov 20269
- Curious WormLatest 11 Nov 20269
- Iah647Latest 9 Nov 20269
- EverstakeLatest 9 Nov 20269
- Global Secret GroupLatest 9 Nov 20268
- PanzerLatest 9 Nov 20268
- RansomhouseLatest 4 Nov 20268
- DragonforceLatest 30 Oct 20268
- RedactLatest 13 Nov 20267
- CloakLatest 8 Nov 20267
- LamashtuLatest 24 Oct 20267
- SovcaliLatest 21 Oct 20267
- The Seven Deadly SinsLatest 15 Oct 20267
- AnubisLatest 14 Nov 20266
- BravoxLatest 13 Nov 20266
- ScarlettgroupLatest 26 Oct 20266
- PayoutskingLatest 14 Nov 20265
- DirewolfLatest 6 Nov 20265
- ShibaLatest 6 Nov 20265
- StormLatest 19 Oct 20265
- DoommageddonLatest 13 Nov 20264
- EclipseLatest 9 Nov 20264
- FalconLatest 3 Nov 20264
- Black XLatest 9 Nov 20263
- LeaknetLatest 9 Nov 20263
- SecurotropLatest 25 Oct 20263
- Space BearsLatest 22 Oct 20263
- ChaosLatest 3 Nov 20262
- Crypto24Latest 27 Oct 20262
- UloseLatest 27 Oct 20262
- FulcrumsecLatest 23 Oct 20262
- MimoriLatest 20 Oct 20262
- MorpheusLatest 10 Nov 20261
- BeastLatest 5 Nov 20261
- DestelloLatest 4 Nov 20261
- ClopLatest 21 Oct 20261
- 0x00Latest 15 Oct 20261
- Black NevasLatest 15 Oct 20261
- KairosLatest 14 Oct 20261
- ExitiumLatest 12 Oct 20261
- UmbraLatest 10 Oct 20261
Under attack? Call the incident line.
Black Shard's team can check your exposure, take a fix off your plate or step in on a live incident.