CYBERSECURITYTRACKER
TRACKING3,014 stories541 vuln stories
Threat actor directory

Threat Actors

Every actor this tracker follows, most recently active first. Actors come from leak-site monitoring; where a verified MITRE ATT&CK group mapping exists, the profile carries the group's techniques and the automated defensive actions that counter them. Mappings are strict: an actor is only linked to a MITRE group whose own name, aliases, or MITRE-published description match, and most leak-site brands have no MITRE entry yet, which the directory says plainly rather than guessing.

70 tracked actors4 with a verified ATT&CK mapping
ActorKindTargeted sectorsATT&CKClaimsLast active
DeadlockransomwareManufacturingBusiness & Professional ServicesConstruction & EngineeringFinancial ServicesTransportation & Logisticsnot yet mapped1642026-07-26
DragonforceransomwareManufacturingConstruction & EngineeringBusiness & Professional ServicesRetailEnergy & Utilitiesnot yet mapped3012026-07-26
ChaosransomwareManufacturingBusiness & Professional ServicesPharmaceuticals & Life SciencesTechnologyTransportation & Logisticsnot yet mapped472026-07-26
QilinransomwareBusiness & Professional ServicesManufacturingConstruction & EngineeringRetailHealthcareG1050 · 3 techniques7792026-07-26
ExfilSquadransomwareGovernmentTechnologyEducationFinancial ServicesRetailnot yet mapped282026-07-26
Global Secret GroupransomwareTechnologyRetailBusiness & Professional ServicesEnergy & UtilitiesFinancial Servicesnot yet mapped282026-07-26
DoommageddonransomwareHealthcareManufacturingAutomotiveFinancial ServicesReal Estatenot yet mapped92026-07-26
M3rxransomwareBusiness & Professional ServicesManufacturingTransportation & LogisticsConstruction & EngineeringConsumer Servicesnot yet mapped392026-07-26
INC RansomransomwareLegalHealthcareBusiness & Professional ServicesManufacturingGovernmentG1032 · 25 techniques2722026-07-26
AnubisransomwareHealthcareLegalManufacturingBusiness & Professional ServicesTechnologynot yet mapped602026-07-26
IncransomransomwareBusiness & Professional ServicesAgricultureFinancial ServicesHealthcareManufacturingnot yet mapped152026-07-26
ArcusmediaransomwareBusiness & Professional ServicesConsumer ServicesEnergy & UtilitiesGovernmentHospitalitynot yet mapped82026-07-26
Section9ransomwareEnergy & Utilitiesnot yet mapped12026-07-26
Arcus MediaransomwareBusiness & Professional ServicesConstruction & EngineeringConsumer ServicesEnergy & UtilitiesHospitalitynot yet mapped92026-07-25
KairosransomwareEducationManufacturingReal Estatenot yet mapped42026-07-25
BravoxransomwareHealthcareRetailBusiness & Professional ServicesConstruction & EngineeringTechnologynot yet mapped222026-07-25
BlackwaterransomwareHealthcareAutomotiveEnergy & UtilitiesHospitalityNonprofitnot yet mapped92026-07-25
Money MessageransomwareEnergy & UtilitiesNonprofitTransportation & Logisticsnot yet mapped62026-07-25
NovaransomwareTechnologyGovernmentEducationBusiness & Professional ServicesManufacturingnot yet mapped1072026-07-25
ShinyhuntersextortionEducationFinancial ServicesTechnologyBusiness & Professional ServicesRetailnot yet mapped992026-07-25
SecurotropransomwareConstruction & EngineeringBusiness & Professional ServicesManufacturingLegalMedia & Entertainmentnot yet mapped122026-07-25
PayoutskingransomwareManufacturingBusiness & Professional ServicesRetailHospitalityTechnologynot yet mapped772026-07-25
ThegentlemenransomwareManufacturingBusiness & Professional ServicesFinancial ServicesAgricultureTransportation & Logisticsnot yet mapped552026-07-25
MoneymessageransomwareEnergy & UtilitiesTransportation & Logisticsnot yet mapped22026-07-25
SafepayransomwareManufacturingBusiness & Professional ServicesConstruction & EngineeringTransportation & LogisticsHealthcarenot yet mapped1152026-07-24
Triple XransomwareFinancial Servicesnot yet mapped12026-07-24
InsomniaransomwareLegalnot yet mapped12026-07-24
PearransomwareHealthcareLegalBusiness & Professional ServicesConstruction & EngineeringRetailnot yet mapped562026-07-24
AkiraransomwareManufacturingBusiness & Professional ServicesConstruction & EngineeringRetailLegalG1024 · 17 techniques3282026-07-24
The GentlemenransomwareManufacturingHealthcareRetailTechnologyBusiness & Professional Servicesnot yet mapped5822026-07-24
EraLeign (APT73)ransomwareGovernmentManufacturingRetailTechnologyAgriculturenot yet mapped592026-07-24
Booba ProjectransomwareBusiness & Professional ServicesHealthcarenot yet mapped32026-07-24
UnsaferansomwareBusiness & Professional ServicesHealthcarenot yet mapped22026-07-24
Apt73ransomwareTechnologynot yet mapped12026-07-24
PlayransomwareConstruction & EngineeringBusiness & Professional ServicesManufacturingLegalRetailG1040 · 26 techniques1792026-07-23
Cmd OrganizationransomwareHealthcareManufacturingBusiness & Professional ServicesEducationRetailnot yet mapped382026-07-23
KryBitransomwareBusiness & Professional ServicesManufacturingGovernmentEducationHealthcarenot yet mapped862026-07-23
Killsec3ransomwareConsumer ServicesHealthcarenot yet mapped32026-07-23
NightspireransomwareManufacturingHealthcareBusiness & Professional ServicesConstruction & EngineeringHospitalitynot yet mapped2142026-07-23
SettraransomwareConstruction & EngineeringManufacturingRetailAgricultureBusiness & Professional Servicesnot yet mapped302026-07-23
CmdorganizationransomwareEnergy & UtilitiesEducationHealthcareRetailnot yet mapped52026-07-23
KillsecransomwareConsumer ServicesFinancial ServicesHealthcarenot yet mapped32026-07-23
Brain CipherransomwareBusiness & Professional ServicesAutomotiveEnergy & UtilitiesHealthcareHospitalitynot yet mapped252026-07-22
WorldleaksextortionManufacturingHealthcareEducationBusiness & Professional ServicesLegalnot yet mapped652026-07-22
RansomhouseransomwareManufacturingFinancial ServicesGovernmentTechnologyAerospace & Defensenot yet mapped382026-07-22
LeaknetransomwareGovernmentInsuranceEducationManufacturingReal Estatenot yet mapped282026-07-22
Coinbase CartelransomwareTechnologyRetailBusiness & Professional ServicesManufacturingPharmaceuticals & Life Sciencesnot yet mapped1262026-07-22
TitanransomwareHealthcareBusiness & Professional ServicesConstruction & EngineeringAgricultureAutomotivenot yet mapped172026-07-22
Space BearsransomwareManufacturingBusiness & Professional ServicesConstruction & EngineeringConsumer ServicesEnergy & Utilitiesnot yet mapped412026-07-22
MorpheusransomwareManufacturingBusiness & Professional ServicesFinancial ServicesHospitalityInsurancenot yet mapped122026-07-22
Black XransomwareHealthcareEnergy & UtilitiesGovernmentLegalManufacturingnot yet mapped102026-07-22
BlacknevasransomwareConsumer Servicesnot yet mapped22026-07-22
BrainCipherransomwareTechnologynot yet mapped12026-07-22
SpacebearsransomwareBusiness & Professional ServicesTechnologynot yet mapped32026-07-21
PayloadransomwareManufacturingHealthcareEnergy & UtilitiesBusiness & Professional ServicesConstruction & Engineeringnot yet mapped692026-07-20
CoinbasecartelransomwareManufacturingBusiness & Professional Servicesnot yet mapped42026-07-20
BlackoutransomwareRetailTechnologynot yet mapped42026-07-19
GunraransomwareBusiness & Professional ServicesLegalManufacturingPharmaceuticals & Life SciencesTransportation & Logisticsnot yet mapped282026-07-18
Threeamransomwarenot yet mapped12026-07-18
InterlockransomwareEducationHealthcareNonprofitBusiness & Professional ServicesGovernmentnot yet mapped312026-07-17
AilockransomwareManufacturingConstruction & EngineeringBusiness & Professional ServicesRetailTechnologynot yet mapped482026-07-15
SyndicateransomwareFinancial Servicesnot yet mapped12026-07-13
D1rransomwareTechnologyAutomotiveManufacturingnot yet mapped62026-07-13
LockBitransomwareManufacturingHealthcareBusiness & Professional ServicesConstruction & EngineeringGovernmentnot yet mapped2082026-07-10
Crpx0ransomwareHealthcarePharmaceuticals & Life Sciencesnot yet mapped62026-07-08
3amransomwareAgricultureBusiness & Professional ServicesManufacturingAerospace & DefenseEducationnot yet mapped152026-07-08
DataleakransomwareManufacturingInsurancenot yet mapped52026-07-08
GenesisransomwareHealthcareBusiness & Professional ServicesLegalConstruction & EngineeringManufacturingnot yet mapped92026-07-05
WallstreetransomwareAutomotiveHealthcareGovernmentnot yet mapped42026-07-05
StormousransomwareRetailBusiness & Professional ServicesFinancial ServicesNonprofitTechnologynot yet mapped342026-07-02

Actor activity data from RansomLook (leak-site monitoring); ATT&CK group data from MITRE ATT&CK. Leak-site claims are unverified. Mappings are validated in CI against MITRE's own group names, aliases, and published descriptions.