Threat actor directory
Threat Actors
Every actor this tracker follows, most recently active first. Actors come from leak-site monitoring; where a verified MITRE ATT&CK group mapping exists, the profile carries the group's techniques and the automated defensive actions that counter them. Mappings are strict: an actor is only linked to a MITRE group whose own name, aliases, or MITRE-published description match, and most leak-site brands have no MITRE entry yet, which the directory says plainly rather than guessing.
70 tracked actors4 with a verified ATT&CK mapping
| Actor | Kind | Targeted sectors | ATT&CK | Claims | Last active |
|---|---|---|---|---|---|
| Deadlock | ransomware | ManufacturingBusiness & Professional ServicesConstruction & EngineeringFinancial ServicesTransportation & Logistics | not yet mapped | 164 | 2026-07-26 |
| Dragonforce | ransomware | ManufacturingConstruction & EngineeringBusiness & Professional ServicesRetailEnergy & Utilities | not yet mapped | 301 | 2026-07-26 |
| Chaos | ransomware | ManufacturingBusiness & Professional ServicesPharmaceuticals & Life SciencesTechnologyTransportation & Logistics | not yet mapped | 47 | 2026-07-26 |
| Qilin | ransomware | Business & Professional ServicesManufacturingConstruction & EngineeringRetailHealthcare | G1050 · 3 techniques | 779 | 2026-07-26 |
| ExfilSquad | ransomware | GovernmentTechnologyEducationFinancial ServicesRetail | not yet mapped | 28 | 2026-07-26 |
| Global Secret Group | ransomware | TechnologyRetailBusiness & Professional ServicesEnergy & UtilitiesFinancial Services | not yet mapped | 28 | 2026-07-26 |
| Doommageddon | ransomware | HealthcareManufacturingAutomotiveFinancial ServicesReal Estate | not yet mapped | 9 | 2026-07-26 |
| M3rx | ransomware | Business & Professional ServicesManufacturingTransportation & LogisticsConstruction & EngineeringConsumer Services | not yet mapped | 39 | 2026-07-26 |
| INC Ransom | ransomware | LegalHealthcareBusiness & Professional ServicesManufacturingGovernment | G1032 · 25 techniques | 272 | 2026-07-26 |
| Anubis | ransomware | HealthcareLegalManufacturingBusiness & Professional ServicesTechnology | not yet mapped | 60 | 2026-07-26 |
| Incransom | ransomware | Business & Professional ServicesAgricultureFinancial ServicesHealthcareManufacturing | not yet mapped | 15 | 2026-07-26 |
| Arcusmedia | ransomware | Business & Professional ServicesConsumer ServicesEnergy & UtilitiesGovernmentHospitality | not yet mapped | 8 | 2026-07-26 |
| Section9 | ransomware | Energy & Utilities | not yet mapped | 1 | 2026-07-26 |
| Arcus Media | ransomware | Business & Professional ServicesConstruction & EngineeringConsumer ServicesEnergy & UtilitiesHospitality | not yet mapped | 9 | 2026-07-25 |
| Kairos | ransomware | EducationManufacturingReal Estate | not yet mapped | 4 | 2026-07-25 |
| Bravox | ransomware | HealthcareRetailBusiness & Professional ServicesConstruction & EngineeringTechnology | not yet mapped | 22 | 2026-07-25 |
| Blackwater | ransomware | HealthcareAutomotiveEnergy & UtilitiesHospitalityNonprofit | not yet mapped | 9 | 2026-07-25 |
| Money Message | ransomware | Energy & UtilitiesNonprofitTransportation & Logistics | not yet mapped | 6 | 2026-07-25 |
| Nova | ransomware | TechnologyGovernmentEducationBusiness & Professional ServicesManufacturing | not yet mapped | 107 | 2026-07-25 |
| Shinyhunters | extortion | EducationFinancial ServicesTechnologyBusiness & Professional ServicesRetail | not yet mapped | 99 | 2026-07-25 |
| Securotrop | ransomware | Construction & EngineeringBusiness & Professional ServicesManufacturingLegalMedia & Entertainment | not yet mapped | 12 | 2026-07-25 |
| Payoutsking | ransomware | ManufacturingBusiness & Professional ServicesRetailHospitalityTechnology | not yet mapped | 77 | 2026-07-25 |
| Thegentlemen | ransomware | ManufacturingBusiness & Professional ServicesFinancial ServicesAgricultureTransportation & Logistics | not yet mapped | 55 | 2026-07-25 |
| Moneymessage | ransomware | Energy & UtilitiesTransportation & Logistics | not yet mapped | 2 | 2026-07-25 |
| Safepay | ransomware | ManufacturingBusiness & Professional ServicesConstruction & EngineeringTransportation & LogisticsHealthcare | not yet mapped | 115 | 2026-07-24 |
| Triple X | ransomware | Financial Services | not yet mapped | 1 | 2026-07-24 |
| Insomnia | ransomware | Legal | not yet mapped | 1 | 2026-07-24 |
| Pear | ransomware | HealthcareLegalBusiness & Professional ServicesConstruction & EngineeringRetail | not yet mapped | 56 | 2026-07-24 |
| Akira | ransomware | ManufacturingBusiness & Professional ServicesConstruction & EngineeringRetailLegal | G1024 · 17 techniques | 328 | 2026-07-24 |
| The Gentlemen | ransomware | ManufacturingHealthcareRetailTechnologyBusiness & Professional Services | not yet mapped | 582 | 2026-07-24 |
| EraLeign (APT73) | ransomware | GovernmentManufacturingRetailTechnologyAgriculture | not yet mapped | 59 | 2026-07-24 |
| Booba Project | ransomware | Business & Professional ServicesHealthcare | not yet mapped | 3 | 2026-07-24 |
| Unsafe | ransomware | Business & Professional ServicesHealthcare | not yet mapped | 2 | 2026-07-24 |
| Apt73 | ransomware | Technology | not yet mapped | 1 | 2026-07-24 |
| Play | ransomware | Construction & EngineeringBusiness & Professional ServicesManufacturingLegalRetail | G1040 · 26 techniques | 179 | 2026-07-23 |
| Cmd Organization | ransomware | HealthcareManufacturingBusiness & Professional ServicesEducationRetail | not yet mapped | 38 | 2026-07-23 |
| KryBit | ransomware | Business & Professional ServicesManufacturingGovernmentEducationHealthcare | not yet mapped | 86 | 2026-07-23 |
| Killsec3 | ransomware | Consumer ServicesHealthcare | not yet mapped | 3 | 2026-07-23 |
| Nightspire | ransomware | ManufacturingHealthcareBusiness & Professional ServicesConstruction & EngineeringHospitality | not yet mapped | 214 | 2026-07-23 |
| Settra | ransomware | Construction & EngineeringManufacturingRetailAgricultureBusiness & Professional Services | not yet mapped | 30 | 2026-07-23 |
| Cmdorganization | ransomware | Energy & UtilitiesEducationHealthcareRetail | not yet mapped | 5 | 2026-07-23 |
| Killsec | ransomware | Consumer ServicesFinancial ServicesHealthcare | not yet mapped | 3 | 2026-07-23 |
| Brain Cipher | ransomware | Business & Professional ServicesAutomotiveEnergy & UtilitiesHealthcareHospitality | not yet mapped | 25 | 2026-07-22 |
| Worldleaks | extortion | ManufacturingHealthcareEducationBusiness & Professional ServicesLegal | not yet mapped | 65 | 2026-07-22 |
| Ransomhouse | ransomware | ManufacturingFinancial ServicesGovernmentTechnologyAerospace & Defense | not yet mapped | 38 | 2026-07-22 |
| Leaknet | ransomware | GovernmentInsuranceEducationManufacturingReal Estate | not yet mapped | 28 | 2026-07-22 |
| Coinbase Cartel | ransomware | TechnologyRetailBusiness & Professional ServicesManufacturingPharmaceuticals & Life Sciences | not yet mapped | 126 | 2026-07-22 |
| Titan | ransomware | HealthcareBusiness & Professional ServicesConstruction & EngineeringAgricultureAutomotive | not yet mapped | 17 | 2026-07-22 |
| Space Bears | ransomware | ManufacturingBusiness & Professional ServicesConstruction & EngineeringConsumer ServicesEnergy & Utilities | not yet mapped | 41 | 2026-07-22 |
| Morpheus | ransomware | ManufacturingBusiness & Professional ServicesFinancial ServicesHospitalityInsurance | not yet mapped | 12 | 2026-07-22 |
| Black X | ransomware | HealthcareEnergy & UtilitiesGovernmentLegalManufacturing | not yet mapped | 10 | 2026-07-22 |
| Blacknevas | ransomware | Consumer Services | not yet mapped | 2 | 2026-07-22 |
| BrainCipher | ransomware | Technology | not yet mapped | 1 | 2026-07-22 |
| Spacebears | ransomware | Business & Professional ServicesTechnology | not yet mapped | 3 | 2026-07-21 |
| Payload | ransomware | ManufacturingHealthcareEnergy & UtilitiesBusiness & Professional ServicesConstruction & Engineering | not yet mapped | 69 | 2026-07-20 |
| Coinbasecartel | ransomware | ManufacturingBusiness & Professional Services | not yet mapped | 4 | 2026-07-20 |
| Blackout | ransomware | RetailTechnology | not yet mapped | 4 | 2026-07-19 |
| Gunra | ransomware | Business & Professional ServicesLegalManufacturingPharmaceuticals & Life SciencesTransportation & Logistics | not yet mapped | 28 | 2026-07-18 |
| Threeam | ransomware | — | not yet mapped | 1 | 2026-07-18 |
| Interlock | ransomware | EducationHealthcareNonprofitBusiness & Professional ServicesGovernment | not yet mapped | 31 | 2026-07-17 |
| Ailock | ransomware | ManufacturingConstruction & EngineeringBusiness & Professional ServicesRetailTechnology | not yet mapped | 48 | 2026-07-15 |
| Syndicate | ransomware | Financial Services | not yet mapped | 1 | 2026-07-13 |
| D1r | ransomware | TechnologyAutomotiveManufacturing | not yet mapped | 6 | 2026-07-13 |
| LockBit | ransomware | ManufacturingHealthcareBusiness & Professional ServicesConstruction & EngineeringGovernment | not yet mapped | 208 | 2026-07-10 |
| Crpx0 | ransomware | HealthcarePharmaceuticals & Life Sciences | not yet mapped | 6 | 2026-07-08 |
| 3am | ransomware | AgricultureBusiness & Professional ServicesManufacturingAerospace & DefenseEducation | not yet mapped | 15 | 2026-07-08 |
| Dataleak | ransomware | ManufacturingInsurance | not yet mapped | 5 | 2026-07-08 |
| Genesis | ransomware | HealthcareBusiness & Professional ServicesLegalConstruction & EngineeringManufacturing | not yet mapped | 9 | 2026-07-05 |
| Wallstreet | ransomware | AutomotiveHealthcareGovernment | not yet mapped | 4 | 2026-07-05 |
| Stormous | ransomware | RetailBusiness & Professional ServicesFinancial ServicesNonprofitTechnology | not yet mapped | 34 | 2026-07-02 |
No actors match this filter.
Actor activity data from RansomLook (leak-site monitoring); ATT&CK group data from MITRE ATT&CK. Leak-site claims are unverified. Mappings are validated in CI against MITRE's own group names, aliases, and published descriptions.