Ransomware crews publish their victims to pressure them into paying. Those leak sites are public, so counting what appears on them gives a usable read on which groups are active right now, how fast they are posting, and who they are hitting. This tracker follows the groups, their recent claims, and the sectors and countries showing up in them.
Updated 05:02 UTC
| Victim | Group | Sector | Claimed |
|---|---|---|---|
| Quest Group | anubis | Technology | Sep 18, 2026 23:55 UTC |
| 🇧🇷 K3G Solutions Brazil | Panzer | Other | Sep 18, 2026 22:23 UTC |
| 🇩🇪 hygear.com | lockbit5 | Healthcare | Sep 18, 2026 21:49 UTC |
| 🇨🇱 forus.cl | lockbit5 | Professional Services | Sep 18, 2026 21:48 UTC |
| 🇺🇸 Vista Plastic Solutions | play | Manufacturing | Sep 18, 2026 20:44 UTC |
| 🇨🇦 Inglewood Golf | play | Hospitality | Sep 18, 2026 20:43 UTC |
| 🇮🇪 Barrett Mahony Consulting Engineers | play | Professional Services | Sep 18, 2026 20:43 UTC |
| 🇺🇸 PITTSRAD | Spirals | Healthcare | Sep 18, 2026 20:24 UTC |
| 🇻🇪 Inter (Venezuela's largest internet provider) | N0n | Technology | Sep 18, 2026 19:51 UTC |
| 🇺🇸 Premier Lighting & Controls | Gammax | Manufacturing | Sep 18, 2026 17:52 UTC |
| 🇯🇵 kit-e.jp | AuditTeam | Technology | Sep 18, 2026 15:50 UTC |
| 🇷🇺 Paid Victim 192EB2B6AD7B98D9 | AuditTeam | Not Found | Sep 18, 2026 15:50 UTC |
| 🇺🇸 Prefix Corp | securotrop | Other | Sep 18, 2026 15:45 UTC |
| 🇸🇪 PayPal support operations (Transcom WorldWide) | N0n | Financial Services | Sep 18, 2026 15:27 UTC |
| 🇦🇷 Ministry of Education — Argentina | N0n | Government & Defense | Sep 18, 2026 15:26 UTC |
| 🇺🇸 Argentem Creek Partners (investment firm) | N0n | Financial Services | Sep 18, 2026 15:26 UTC |
| 🇹🇷 AstraZeneca Türkiye | N0n | Healthcare | Sep 18, 2026 15:25 UTC |
| 🇱🇺 STOKR (digital securities platform) | N0n | Financial Services | Sep 18, 2026 15:25 UTC |
| 🇧🇷 Konnatus (usucapião legal services) | N0n | Professional Services | Sep 18, 2026 15:24 UTC |
| 🇻🇳 BeLi Teacher / FSC education centers (AWS) | N0n | Education | Sep 18, 2026 15:23 UTC |
| 🇻🇳 Vietnamese betting operator (GC789 network / Boundless TE) | N0n | Other | Sep 18, 2026 15:23 UTC |
| 🇺🇸 United Federation of Teachers | N0n | Education | Sep 18, 2026 15:22 UTC |
| 🇩🇪 MPA Pharma | rhysida | Healthcare | Sep 18, 2026 13:48 UTC |
| 🇺🇸 Anderson Industries | akira | Manufacturing | Sep 18, 2026 13:24 UTC |
| 🇳🇱 www.roancampingholidays.com | incransom | Hospitality | Sep 18, 2026 12:42 UTC |
| 🇺🇸 www.kendallhunt.com | incransom | Education | Sep 18, 2026 12:42 UTC |
| 🇸🇬 Ascend Com | qilin | Technology | Sep 18, 2026 10:12 UTC |
| 🇦🇷 Ceres Tolvas | qilin | Agriculture and Food Production | Sep 18, 2026 10:11 UTC |
| 🇨🇱 Futuro Forestal | qilin | Agriculture and Food Production | Sep 18, 2026 10:10 UTC |
| 🇲🇽 Grupo Juste | qilin | Other | Sep 18, 2026 10:09 UTC |
| 🇹🇹 Inland and Offshore Contractors | qilin | Energy & Utilities | Sep 18, 2026 10:09 UTC |
| 🇺🇸 American Casting Company | Storm | Manufacturing | Sep 18, 2026 07:51 UTC |
| 🇺🇸 Johnson Investment Counsel | Storm | Financial Services | Sep 18, 2026 07:51 UTC |
| 🇺🇸 First Secure Community Bank | Storm | Financial Services | Sep 18, 2026 07:50 UTC |
| 🇺🇸 The State Bank | Storm | Financial Services | Sep 18, 2026 07:50 UTC |
| 🇺🇸 First Secure Bank and Trust | Storm | Financial Services | Sep 18, 2026 07:49 UTC |
| 🇺🇸 Accela.com | EndZone | Government & Defense | Sep 18, 2026 07:06 UTC |
| 🇺🇸 AT&T | EndZone | Technology | Sep 18, 2026 07:06 UTC |
| ANYTHINGIT | Spirals | Technology | Sep 18, 2026 07:03 UTC |
| 🇸🇬 Giti Corp | killsec | Manufacturing | Sep 18, 2026 02:02 UTC |
| 🇩🇪 Universitt Hamburg | Panzer | Education | Sep 18, 2026 00:23 UTC |
| 🇵🇾 Inovapy | Panzer | Technology | Sep 18, 2026 00:23 UTC |
| 🇫🇷 Stim | Panzer | Technology | Sep 18, 2026 00:22 UTC |
| C... | SilentRansomGroup | Not Found | Sep 17, 2026 22:54 UTC |
| 🇹🇷 www.harputyapi.com | krybit | Not Found | Sep 17, 2026 22:31 UTC |
| 🇩🇪 www.diakonie-apolda.de | krybit | Healthcare | Sep 17, 2026 22:31 UTC |
| 🇩🇪 Vigatec | qilin | Technology | Sep 17, 2026 20:58 UTC |
| Invincible GG | qilin | Technology | Sep 17, 2026 19:03 UTC |
| 🇺🇸 expresspros.com | chaos | Professional Services | Sep 17, 2026 16:25 UTC |
| 🇬🇧 hoyletanner.com | BrainCipher | Professional Services | Sep 17, 2026 16:21 UTC |
| Group | 24h | 7d | 30d | All Time | Last Seen |
|---|---|---|---|---|---|
| Qilin | 5 | 29 | 113 | 2,298 | Sep 18, 2026 First Oct 8, 2022 |
| The Gentlemen | 0 | 30 | 107 | 867 | Sep 15, 2026 First Feb 28, 2023 |
| Akira | 1 | 10 | 43 | 1,612 | Sep 18, 2026 First Apr 12, 2023 |
| Krybit | 0 | 15 | 43 | 149 | Sep 17, 2026 First Mar 30, 2026 |
| DireWolf | 0 | 0 | 35 | 135 | Sep 11, 2026 First Apr 17, 2025 |
| Storm | 5 | 8 | 35 | 61 | Sep 18, 2026 First Aug 3, 2026 |
| Incransom | 2 | 5 | 29 | 941 | Sep 18, 2026 First Aug 6, 2023 |
| LockBit | 2 | 5 | 28 | 364 | Sep 18, 2026 First Apr 17, 2023 |
| auditteam | 2 | 13 | 27 | 43 | Sep 18, 2026 First Feb 21, 2026 |
| Settra | 0 | 6 | 25 | 70 | Sep 17, 2026 First Jun 2, 2026 |
| SafePay | 0 | 9 | 22 | 569 | Sep 15, 2026 First Nov 10, 2023 |
| Silent Ransom Group | 0 | 1 | 20 | 146 | Sep 17, 2026 First Jun 7, 2022 |
| Panzer | 1 | 7 | 20 | 32 | Sep 18, 2026 First Aug 5, 2026 |
| ZaWoo | 0 | 0 | 19 | 19 | Aug 31, 2026 First Jul 6, 2026 |
| emperador | 0 | 5 | 17 | 20 | Sep 17, 2026 First Aug 10, 2026 |
| Metaencryptor | 0 | 5 | 16 | 47 | Sep 17, 2026 First Aug 16, 2023 |
| Coinbase Cartel | 0 | 0 | 14 | 206 | Aug 23, 2026 First May 26, 2023 |
| Vexy Ransomware | 0 | 3 | 14 | 14 | Sep 17, 2026 First Sep 2, 2026 |
| PLAY | 3 | 3 | 13 | 1,315 | Sep 18, 2026 First Nov 26, 2022 |
| ShinyHunters | 0 | 2 | 13 | 158 | Sep 17, 2026 First Apr 23, 2024 |
| Chaos | 0 | 3 | 13 | 92 | Sep 17, 2026 First Feb 19, 2025 |
| Rhysida | 1 | 2 | 12 | 287 | Sep 18, 2026 First Jun 5, 2023 |
| PEAR | 0 | 0 | 12 | 119 | Sep 11, 2026 First Aug 18, 2023 |
| DragonForce | 0 | 2 | 11 | 651 | Sep 16, 2026 First Oct 20, 2022 |
| MedusaLocker | 0 | 4 | 11 | 94 | Sep 12, 2026 First Nov 3, 2021 |
| BrainCipher | 0 | 3 | 11 | 80 | Sep 17, 2026 First Jul 1, 2024 |
| Dark Project | 0 | 1 | 11 | 30 | Sep 15, 2026 First Jun 8, 2026 |
| Kazu | 0 | 0 | 11 | 20 | Sep 7, 2026 First Nov 6, 2025 |
| DYSPHOR1A | 0 | 0 | 11 | 11 | Sep 6, 2026 First Aug 20, 2026 |
| Wallstreet | 0 | 2 | 10 | 17 | Sep 16, 2026 First Jun 16, 2026 |
| N0n | 0 | 10 | 10 | 10 | Sep 18, 2026 First Sep 18, 2026 |
| titan | 0 | 0 | 9 | 24 | Aug 20, 2026 First Apr 14, 2026 |
| ShadowByt3$ | 0 | 2 | 9 | 21 | Sep 16, 2026 First Feb 17, 2026 |
| Eclipse | 0 | 2 | 9 | 10 | Sep 14, 2026 First Aug 14, 2026 |
| NightSpire | 0 | 0 | 8 | 326 | Sep 11, 2026 First Feb 17, 2025 |
| iah6477 | 0 | 1 | 8 | 8 | Sep 15, 2026 First Aug 20, 2026 |
| Everest | 0 | 0 | 7 | 398 | Sep 7, 2026 First Sep 9, 2021 |
| INSOMNIA | 0 | 3 | 7 | 52 | Sep 15, 2026 First Feb 14, 2025 |
| GSG | 0 | 0 | 7 | 46 | Sep 10, 2026 First Jan 17, 2026 |
| Orova | 0 | 0 | 7 | 45 | Aug 31, 2026 First May 3, 2026 |
| Aurora | 0 | 0 | 7 | 38 | Sep 7, 2026 First Apr 17, 2026 |
| majinahanashi | 0 | 0 | 7 | 22 | Sep 1, 2026 First Jun 27, 2026 |
| Space Bears | 0 | 0 | 6 | 156 | Sep 5, 2026 First Apr 25, 2024 |
| Anubis | 1 | 2 | 6 | 110 | Sep 18, 2026 First Feb 25, 2025 |
| Global | 0 | 2 | 6 | 38 | Sep 12, 2026 First May 28, 2025 |
| Booba Project | 0 | 2 | 6 | 18 | Sep 14, 2026 First Jun 24, 2026 |
| RansomHouse | 0 | 2 | 4 | 209 | Sep 17, 2026 First Jun 1, 2021 |
| Interlock | 0 | 2 | 4 | 126 | Sep 15, 2026 First Dec 1, 2023 |
| Genesis | 0 | 2 | 4 | 117 | Sep 14, 2026 First May 7, 2024 |
| arcusmedia | 0 | 2 | 4 | 111 | Sep 16, 2026 First May 8, 2024 |
| Barracuda | 0 | 1 | 4 | 9 | Sep 13, 2026 First Aug 5, 2026 |
| Payouts King | 0 | 0 | 3 | 110 | Sep 2, 2026 First Apr 17, 2025 |
| DeadLock | 0 | 0 | 3 | 101 | Aug 24, 2026 First May 22, 2026 |
| Kairos | 0 | 1 | 3 | 96 | Sep 16, 2026 First Jun 26, 2024 |
| BEAST | 0 | 0 | 3 | 73 | Sep 10, 2026 First Dec 19, 2023 |
| Unsafe | 0 | 2 | 3 | 24 | Sep 14, 2026 First Dec 21, 2022 |
| BlackX | 0 | 0 | 3 | 11 | Sep 1, 2026 First May 7, 2025 |
| Doommageddon | 0 | 1 | 3 | 11 | Sep 13, 2026 First Mar 8, 2026 |
| Falcon | 0 | 0 | 3 | 3 | Aug 31, 2026 First Jul 14, 2026 |
| Clop | 0 | 0 | 2 | 1,302 | Sep 10, 2026 First Mar 13, 2020 |
| KillSec | 0 | 1 | 2 | 286 | Sep 18, 2026 First Feb 21, 2024 |
| Gunra | 0 | 0 | 2 | 54 | Sep 4, 2026 First Apr 7, 2025 |
| Ailock | 0 | 0 | 2 | 51 | Aug 26, 2026 First Apr 29, 2015 |
| black_nevas | 0 | 1 | 2 | 47 | Sep 16, 2026 First Apr 24, 2023 |
| SECUROTROP | 1 | 1 | 2 | 44 | Sep 18, 2026 First Jun 11, 2025 |
| L group | 0 | 0 | 2 | 28 | Aug 23, 2026 First Feb 17, 2025 |
| FulcrumSec | 0 | 0 | 2 | 27 | Sep 11, 2026 First May 1, 2026 |
| EndZone | 0 | 2 | 2 | 2 | Sep 18, 2026 First Sep 18, 2026 |
| Spirals | 0 | 2 | 2 | 2 | Sep 18, 2026 First Sep 18, 2026 |
| Lynx | 0 | 0 | 1 | 417 | Aug 29, 2026 First May 22, 2023 |
| Abyss | 0 | 0 | 1 | 91 | Aug 26, 2026 First Mar 21, 2023 |
| 3AM | 0 | 0 | 1 | 91 | Aug 30, 2026 First Aug 4, 2023 |
| Payload | 0 | 0 | 1 | 74 | Aug 20, 2026 First Feb 17, 2026 |
| Termite | 0 | 0 | 1 | 49 | Aug 22, 2026 First May 11, 2023 |
| Crypto24 | 0 | 0 | 1 | 47 | Aug 31, 2026 First Dec 13, 2023 |
| Embargo | 0 | 0 | 1 | 41 | Sep 9, 2026 First Apr 17, 2024 |
| MoneyMessage | 0 | 0 | 1 | 35 | Aug 28, 2026 First Jan 4, 2023 |
| BravoX | 0 | 0 | 1 | 28 | Sep 1, 2026 First May 15, 2025 |
| TridentLocker | 0 | 0 | 1 | 17 | Sep 4, 2026 First Oct 21, 2025 |
| Blackwater | 0 | 0 | 1 | 11 | Aug 24, 2026 First Apr 17, 2026 |
| Helix | 0 | 0 | 1 | 8 | Aug 22, 2026 First Aug 7, 2026 |
| xpl0itrs | 0 | 0 | 1 | 8 | Aug 20, 2026 First Jun 12, 2026 |
| Gammax | 1 | 1 | 1 | 5 | Sep 18, 2026 First Jul 3, 2026 |
| Blacklocks | 0 | 0 | 1 | 1 | Sep 5, 2026 First Sep 1, 2026 |
| CVE | Affected product | Groups |
|---|---|---|
| CVE-2024-37085 | VMware ESXi Active Directory Integration Authentication Bypass | 15 |
| CVE-2020-1472 | Zerologon | 14 |
| CVE-2018-13379 | FortiOS and FortiProxy SSL VPN Path Traversal | 13 |
| CVE-2024-1708 | Path Traversal in ConnectWise ScreenConnect | 13 |
| CVE-2024-55591 | FortiOS and FortiProxy Node.js WebSocket Authentication Bypass | 12 |
| CVE-2021-44228 | Log4Shell | 12 |
| CVE-2023-4966 | CitrixBleed | 10 |
| CVE-2021-34473 | ProxyShell Pre-authentication ACL Bypass in Microsoft Exchange Server | 10 |
| CVE-2019-11510 | Pulse Connect Secure Pre-Authentication Arbitrary File Read | 9 |
| CVE-2019-7481 | SQL Injection in SonicWall SMA100 | 9 |
14 min read
A VECT 2.0 Windows sample can recover small files with a static ChaCha20 key and saved 12-byte nonce, but its large-file path keeps only the final nonce and loses the rest.
9 min read
M3rx surfaced with a small leak-site burst and a Go ransomware sample using gzip+gob config data, X25519, AES-CTR file encryption, AES-GCM key wrapping, and a 0x400-byte footer.
13 min read
A Rust Kyber ransomware sample uses AES-256-CTR style file encryption, Kyber1024-sized material, active X25519 arithmetic, and a fixed 0x744 trailer.
26 min read
Teardown of the CheckQilin Windows build from 2025's top ransomware crew: BYOVD EDR killer, AES/ChaCha20 dispatch, RSA-OAEP footer, one-byte password bypass.
Derp wouldn't exist without the work these projects do for the security community. We rely on their data sources to improve the quality and depth of what we publish. Thank you, we're genuinely grateful.
