Ransomware crews publish their victims to pressure them into paying. Those leak sites are public, so counting what appears on them gives a usable read on which groups are active right now, how fast they are posting, and who they are hitting. This tracker follows the groups, their recent claims, and the sectors and countries showing up in them.
Updated 05:00 UTC
| Victim | Group | Sector | Claimed |
|---|---|---|---|
| 🇺🇸 lantisnet.com | incransom | Technology | Aug 5, 2026 00:25 UTC |
| 🇨🇦 Loyalist College | incransom | Education | Aug 4, 2026 23:54 UTC |
| 🇹🇷 Arkın Group / Arkın Casino, The Arkın Colony, The Arkın Iskele, and Arkın Palm Beach | blacknevas | Hospitality | Aug 4, 2026 22:22 UTC |
| 🇮🇪 Galvin Brothers | qilin | Manufacturing | Aug 4, 2026 18:01 UTC |
| 🇩🇪 RUPP Spritzguss | qilin | Manufacturing | Aug 4, 2026 18:00 UTC |
| 🇧🇷 cesmac.edu.br | krybit | Education | Aug 4, 2026 17:57 UTC |
| 🇺🇸 TRULITE GLASS & ALUMINUM SOLUTIONS | incransom | Manufacturing | Aug 4, 2026 17:57 UTC |
| 🇹🇼 First Tek | play | Technology | Aug 4, 2026 16:26 UTC |
| 🇺🇸 Preferred Financial Group | play | Financial Services | Aug 4, 2026 16:25 UTC |
| 🇺🇸 TopMark Funding | thegentlemen | Financial Services | Aug 4, 2026 16:03 UTC |
| 🇺🇸 Control Concepts Technology | thegentlemen | Technology | Aug 4, 2026 16:03 UTC |
| 🇺🇸 healthcarehighways.com | chaos | Healthcare | Aug 4, 2026 15:57 UTC |
| 🇪🇬 ADG Healthcare | Orova | Healthcare | Aug 4, 2026 15:55 UTC |
| 🇧🇷 eSysTech | Orova | Technology | Aug 4, 2026 15:55 UTC |
| 🇺🇸 Northeastern Communications & Electrical | Orova | Energy & Utilities | Aug 4, 2026 15:54 UTC |
| 🇯🇵 Apollo Office System | Orova | Other | Aug 4, 2026 15:54 UTC |
| 🇹🇼 EMPYREAN INT’L TECHNO DEVICES | Orova | Technology | Aug 4, 2026 15:53 UTC |
| 🇺🇸 Texas Medical Screening | Orova | Healthcare | Aug 4, 2026 15:53 UTC |
| 🇺🇸 Sc Regional Housing Authority | Orova | Government & Defense | Aug 4, 2026 15:52 UTC |
| 🇺🇸 Bjs Insurance & Financial | Orova | Financial Services | Aug 4, 2026 15:51 UTC |
| 🇺🇸 Wisdom Oral Surgery | Orova | Healthcare | Aug 4, 2026 15:51 UTC |
| ðŸ‡ðŸ‡° SURE TRAVEL COMPANY | Orova | Hospitality | Aug 4, 2026 15:50 UTC |
| 🇰🇷 worldtube | gunra | Technology | Aug 4, 2026 13:23 UTC |
| 🇺🇸 WD Masonry & Concrete | qilin | Other | Aug 4, 2026 12:56 UTC |
| University SprinklerSystems | akira | Manufacturing | Aug 4, 2026 12:51 UTC |
| 🇺🇸 SBI Manufacturing | Orova | Manufacturing | Aug 4, 2026 12:28 UTC |
| 🇺🇸 Agricultural Chemical Solutions | Orova | Agriculture and Food Production | Aug 4, 2026 12:27 UTC |
| 🇹🇼 DBM Reflex | Orova | Other | Aug 4, 2026 12:27 UTC |
| 🇹🇼 Ultra Fame | Orova | Other | Aug 4, 2026 12:26 UTC |
| 🇺🇸 Cardiology Associates | Orova | Healthcare | Aug 4, 2026 12:24 UTC |
| 🇺🇸 Yost Home Improvements | Orova | Retail & E-Commerce | Aug 4, 2026 12:23 UTC |
| 🇹🇼 KINGSSON | Orova | Other | Aug 4, 2026 12:23 UTC |
| ðŸ‡ðŸ‡° SSI HOLDING (FAR EAST) LIMITED | Orova | Other | Aug 4, 2026 12:22 UTC |
| ðŸ‡ðŸ‡° Sanrio Hong Kong Co., Ltd | Orova | Retail & E-Commerce | Aug 4, 2026 12:22 UTC |
| ðŸ‡ðŸ‡° Tat Fung Textile Co., Ltd. | Orova | Manufacturing | Aug 4, 2026 12:21 UTC |
| 🇺🇸 Integrated Site Management | Orova | Professional Services | Aug 4, 2026 12:21 UTC |
| 🇺🇸 Conceptual Designs, Inc. | Orova | Other | Aug 4, 2026 12:20 UTC |
| ðŸ‡ðŸ‡° JK Capital Management Limited | Orova | Financial Services | Aug 4, 2026 12:20 UTC |
| 🇺🇸 Global Friction Products, Inc | Orova | Manufacturing | Aug 4, 2026 12:19 UTC |
| 🇩🇪 GILDE Handwerk Macrander GmbH & Co. KG | aurora | Manufacturing | Aug 4, 2026 06:21 UTC |
| 🇺🇸 US Installation Group, Inc. | aurora | Manufacturing | Aug 4, 2026 05:51 UTC |
| 🇮🇩 pushidrosal.id | incransom | Other | Aug 4, 2026 03:27 UTC |
| 🇵🇠lccgroup.com | incransom | Professional Services | Aug 4, 2026 03:27 UTC |
| 🇻🇳 https://geleximco.vn/ | incransom | Manufacturing | Aug 4, 2026 03:26 UTC |
| 🇺🇸 clintonhealthaccess.org | incransom | Healthcare | Aug 4, 2026 02:24 UTC |
| 🇦🇷 Oleoductos del Valle | incransom | Energy & Utilities | Aug 4, 2026 00:24 UTC |
| 🇷🇴 Universitatea De Vest Vasile Goldi Din Arad | qilin | Education | Aug 3, 2026 19:55 UTC |
| 🇺🇸 pradotuylaw.com | safepay | Professional Services | Aug 3, 2026 18:29 UTC |
| 🇺🇸 naskdoorinc.com | safepay | Manufacturing | Aug 3, 2026 18:28 UTC |
| 🇮🇹 new-point.it | safepay | Technology | Aug 3, 2026 18:28 UTC |
| Group | 24h | 7d | 30d | All Time | Last Seen |
|---|---|---|---|---|---|
| The Gentlemen | 2 | 44 | 139 | 698 | Aug 4, 2026 First Feb 28, 2023 |
| Qilin | 3 | 30 | 131 | 2,102 | Aug 4, 2026 First Oct 8, 2022 |
| DeadLock | 0 | 0 | 85 | 95 | Jul 28, 2026 First May 22, 2026 |
| DragonForce | 0 | 5 | 44 | 632 | Aug 3, 2026 First Oct 20, 2022 |
| Incransom | 3 | 13 | 39 | 891 | Aug 5, 2026 First Aug 6, 2023 |
| SafePay | 0 | 9 | 39 | 546 | Aug 3, 2026 First Nov 10, 2023 |
| CRPxO | 0 | 11 | 37 | 37 | Aug 2, 2026 First Jul 9, 2026 |
| GSG | 0 | 1 | 32 | 32 | Aug 1, 2026 First Jan 17, 2026 |
| Akira | 1 | 4 | 24 | 1,559 | Aug 4, 2026 First Apr 12, 2023 |
| Orova | 24 | 24 | 24 | 24 | Aug 4, 2026 First Unknown |
| Nova | 0 | 0 | 21 | 178 | Jul 25, 2026 First Mar 22, 2025 |
| Krybit | 1 | 7 | 21 | 90 | Aug 4, 2026 First Mar 30, 2026 |
| PLAY | 2 | 5 | 18 | 1,292 | Aug 4, 2026 First Nov 26, 2022 |
| LockBit | 0 | 9 | 18 | 329 | Aug 3, 2026 First Apr 17, 2023 |
| NightSpire | 0 | 0 | 16 | 313 | Jul 27, 2026 First Feb 17, 2025 |
| Chaos | 1 | 1 | 16 | 78 | Aug 4, 2026 First Feb 19, 2025 |
| ExfilSquad | 0 | 0 | 15 | 15 | Jul 26, 2026 First Jul 26, 2026 |
| CMD Organization | 0 | 4 | 12 | 43 | Jul 31, 2026 First Jan 25, 2026 |
| Booba Project | 0 | 1 | 12 | 12 | Jul 31, 2026 First Jun 24, 2026 |
| Anubis | 0 | 3 | 10 | 101 | Aug 3, 2026 First Feb 25, 2025 |
| M3RX | 0 | 0 | 10 | 36 | Jul 26, 2026 First Apr 29, 2026 |
| Coinbase Cartel | 0 | 4 | 9 | 186 | Aug 1, 2026 First May 26, 2023 |
| Genesis | 0 | 3 | 9 | 109 | Jul 31, 2026 First May 7, 2024 |
| arcusmedia | 0 | 0 | 9 | 107 | Jul 26, 2026 First May 8, 2024 |
| Settra | 0 | 0 | 9 | 31 | Jul 23, 2026 First Jun 2, 2026 |
| Space Bears | 0 | 1 | 8 | 146 | Jul 29, 2026 First Apr 25, 2024 |
| Doommageddon | 0 | 0 | 8 | 8 | Jul 26, 2026 First Mar 8, 2026 |
| ShinyHunters | 0 | 3 | 7 | 138 | Aug 2, 2026 First Apr 23, 2024 |
| Interlock | 0 | 1 | 7 | 119 | Jul 31, 2026 First Dec 1, 2023 |
| Ailock | 0 | 0 | 7 | 47 | Jul 15, 2026 First Apr 29, 2015 |
| PEAR | 0 | 1 | 6 | 107 | Jul 30, 2026 First Aug 18, 2023 |
| Aurora | 2 | 6 | 6 | 27 | Aug 4, 2026 First Apr 17, 2026 |
| titan | 0 | 0 | 6 | 15 | Jul 21, 2026 First Apr 14, 2026 |
| APT73 | 0 | 0 | 5 | 158 | Jul 24, 2026 First Nov 1, 2023 |
| Gunra | 1 | 2 | 5 | 50 | Aug 4, 2026 First Apr 7, 2025 |
| RansomHouse | 0 | 1 | 4 | 200 | Aug 3, 2026 First Jun 1, 2021 |
| Payouts King | 0 | 0 | 4 | 106 | Jul 25, 2026 First Apr 17, 2025 |
| Kairos | 0 | 1 | 4 | 92 | Jul 30, 2026 First Jun 26, 2024 |
| Payload | 0 | 1 | 4 | 69 | Aug 3, 2026 First Feb 17, 2026 |
| INSOMNIA | 0 | 3 | 4 | 41 | Jul 31, 2026 First Feb 14, 2025 |
| black_nevas | 1 | 1 | 4 | 38 | Aug 4, 2026 First Apr 24, 2023 |
| KillSec | 0 | 0 | 3 | 284 | Jul 23, 2026 First Feb 21, 2024 |
| BrainCipher | 0 | 0 | 3 | 69 | Jul 22, 2026 First Jul 1, 2024 |
| SECUROTROP | 0 | 1 | 3 | 40 | Jul 30, 2026 First Jun 11, 2025 |
| MoneyMessage | 0 | 0 | 3 | 34 | Jul 25, 2026 First Jan 4, 2023 |
| Morpheus | 0 | 1 | 3 | 23 | Jul 30, 2026 First Jan 7, 2025 |
| Blackout | 0 | 0 | 3 | 12 | Jul 19, 2026 First Feb 26, 2024 |
| BlackX | 0 | 2 | 3 | 8 | Jul 29, 2026 First May 7, 2025 |
| D1R | 0 | 0 | 3 | 3 | Jul 13, 2026 First Jul 13, 2026 |
| Gammax | 0 | 3 | 3 | 3 | Aug 1, 2026 First Jul 3, 2026 |
| WorldLeaks | 0 | 0 | 2 | 175 | Jul 21, 2026 First Jun 23, 2022 |
| Termite | 0 | 0 | 2 | 48 | Jul 28, 2026 First May 11, 2023 |
| BravoX | 0 | 0 | 2 | 22 | Jul 25, 2026 First May 15, 2025 |
| Unsafe | 0 | 0 | 2 | 18 | Jul 24, 2026 First Dec 21, 2022 |
| Blackwater | 0 | 0 | 2 | 8 | Jul 25, 2026 First Apr 17, 2026 |
| Clop | 0 | 1 | 1 | 1,255 | Jul 31, 2026 First Mar 13, 2020 |
| Silent Ransom Group | 0 | 1 | 1 | 118 | Aug 2, 2026 First Jun 7, 2022 |
| 3AM | 0 | 0 | 1 | 88 | Jul 18, 2026 First Aug 4, 2023 |
| MedusaLocker | 0 | 0 | 1 | 78 | Jul 7, 2026 First Nov 3, 2021 |
| triplex | 0 | 0 | 1 | 3 | Jul 24, 2026 First May 11, 2026 |
| Cry0 | 0 | 0 | 1 | 1 | Jul 6, 2026 First Mar 30, 2026 |
| Kyber | 0 | 1 | 1 | 1 | Jul 30, 2026 First Unknown |
| CVE | Affected product | Groups |
|---|---|---|
| CVE-2024-37085 | Authentication Bypass in VMware ESXi Active Directory Integration | 15 |
| CVE-2020-1472 | ZeroLogon | 13 |
| CVE-2024-55591 | Authentication Bypass in FortiOS and FortiProxy Node.js WebSocket Module | 10 |
| CVE-2023-4966 | CitrixBleed | 9 |
| CVE-2023-46604 | Apache ActiveMQ OpenWire Unauthenticated Remote Code Execution | 8 |
| CVE-2021-44228 | Log4Shell | 8 |
| CVE-2022-41082 | ProxyNotShell RCE in Microsoft Exchange Server | 8 |
| CVE-2024-1709 | Authentication Bypass in ConnectWise ScreenConnect | 8 |
| CVE-2021-34527 | PrintNightmare | 8 |
| CVE-2025-55182 | React2Shell | 7 |
14 min read
A VECT 2.0 Windows sample can recover small files with a static ChaCha20 key and saved 12-byte nonce, but its large-file path keeps only the final nonce and loses the rest.
9 min read
M3rx surfaced with a small leak-site burst and a Go ransomware sample using gzip+gob config data, X25519, AES-CTR file encryption, AES-GCM key wrapping, and a 0x400-byte footer.
13 min read
A Rust Kyber ransomware sample uses AES-256-CTR style file encryption, Kyber1024-sized material, active X25519 arithmetic, and a fixed 0x744 trailer.
26 min read
Teardown of the CheckQilin Windows build from 2025's top ransomware crew: BYOVD EDR killer, AES/ChaCha20 dispatch, RSA-OAEP footer, one-byte password bypass.
Derp wouldn't exist without the work these projects do for the security community. We rely on their data sources to improve the quality and depth of what we publish. Thank you, we're genuinely grateful.
