State now. Changed: 0 tier promotions, +4 known-exploited vulnerability additions, 27 leak-site claims, and 0 confirmed breaches since yesterday.
Why today matters · Threat actor directory
Threat Actors
Claim-backed actors and actors named only in the site's reporting are kept visibly separate. Claim-backed profiles retain leak-site and verified ATT&CK evidence; reporting-only profiles contain only stories carrying an exact canonical actor tag.
Why now: this site build separates 109 claim-backed profiles from 25 profiles seen in news reporting only.
109 claim-backed actor profiles, all time16 claim-backed profiles with no surviving claims, all time4 of those with a verified ATT&CK mapping
25 profiles seen in news reporting only, all time
What changed
This page does not publish a page-specific change count. Open the daily comparison for newly observed leak-site claims and other material tracker changes.
Details
The directory keeps claim-backed profiles separate from names found only in news reporting, with filters beside the main table.
| Actor | Kind | Most-claimed sectors | ATT&CK | Claims | Latest observed leak-site post |
|---|---|---|---|---|---|
| Emperador | ransomware | GovernmentEducationTechnologyEnergy & UtilitiesManufacturing | not yet mapped | 17 | |
| Rhysida | ransomware | HealthcareBusiness & Professional ServicesGovernmentRetailEducation | not yet mapped | 13 | |
| Unsafe | ransomware | TechnologyHealthcareBusiness & Professional ServicesFinancial ServicesManufacturing | not yet mapped | 11 | |
| AuditTeam | ransomware | TechnologyFinancial Services | not yet mapped | 13 | |
| KryBit | ransomware | ManufacturingBusiness & Professional ServicesHealthcareEducationGovernment | not yet mapped | 149 | |
| Global | ransomware | EducationGovernmentTechnology | not yet mapped | 3 | |
| Medusalocker | ransomware | ManufacturingRetailTechnologyAgricultureConstruction & Engineering | not yet mapped | 16 | |
| Securotrop | ransomware | Construction & EngineeringManufacturingBusiness & Professional ServicesLegalMedia & Entertainment | not yet mapped | 15 | |
| Safepay | ransomware | ManufacturingConstruction & EngineeringBusiness & Professional ServicesTransportation & LogisticsHealthcare | not yet mapped | 147 | |
| Qilin | ransomware | ManufacturingBusiness & Professional ServicesConstruction & EngineeringRetailHealthcare | G1050 · 3 techniques | 985 | |
| Direwolf | ransomware | HealthcareTechnologyBusiness & Professional ServicesFinancial ServicesEducation | not yet mapped | 58 | |
| Pear | ransomware | HealthcareBusiness & Professional ServicesLegalConstruction & EngineeringRetail | not yet mapped | 66 | |
| Fulcrumsec | ransomware | Business & Professional ServicesTechnology | not yet mapped | 2 | |
| Panzer | ransomware | GovernmentManufacturingTechnologyAgricultureEducation | not yet mapped | 25 | |
| Dragonforce | ransomware | ManufacturingConstruction & EngineeringBusiness & Professional ServicesRetailFinancial Services | not yet mapped | 319 | |
| Global Secret Group | ransomware | TechnologyRetailManufacturingBusiness & Professional ServicesFinancial Services | not yet mapped | 50 | |
| Vexy Ransomware | ransomware | TechnologyManufacturingRetailHospitalityReal Estate | not yet mapped | 11 | |
| Play | ransomware | Construction & EngineeringManufacturingBusiness & Professional ServicesRetailTechnology | G1040 · 26 techniques | 205 | |
| LockBitaka lockbit5 | ransomware | ManufacturingBusiness & Professional ServicesHealthcareConstruction & EngineeringRetail | not yet mapped | 245 | |
| Chaos | ransomware | ManufacturingBusiness & Professional ServicesHealthcarePharmaceuticals & Life SciencesTransportation & Logistics | not yet mapped | 60 | |
| Wallstreet | ransomware | HealthcareAutomotiveEducationGovernmentEnergy & Utilities | not yet mapped | 15 | |
| INC Ransomaka incransom | ransomware | LegalManufacturingBusiness & Professional ServicesHealthcareNonprofit | G1032 · 25 techniques | 339 | |
| Akira | ransomware | ManufacturingBusiness & Professional ServicesConstruction & EngineeringRetailLegal | G1024 · 17 techniques | 371 | |
| Clop | ransomware | ManufacturingTechnologyRetailFinancial ServicesAerospace & Defense | not yet mapped | 93 | |
| ShadowByt3$ | ransomware | RetailAgricultureBusiness & Professional ServicesReal EstateTechnology | not yet mapped | 6 | |
| Embargo | ransomware | Agriculture | not yet mapped | 1 | |
| Dark Project | ransomware | ManufacturingBusiness & Professional ServicesHealthcareTransportation & LogisticsAutomotive | not yet mapped | 30 | |
| Storm | ransomware | Financial ServicesManufacturingHealthcareAgricultureBusiness & Professional Services | not yet mapped | 57 | |
| Anubis | ransomware | HealthcareLegalManufacturingBusiness & Professional ServicesFinancial Services | not yet mapped | 72 | |
| Eclipse | ransomware | HospitalityTechnologyBusiness & Professional ServicesHealthcareManufacturing | not yet mapped | 8 | |
| The Gentlemenaka thegentlemen | ransomware | ManufacturingTechnologyRetailBusiness & Professional ServicesHealthcare | not yet mapped | 775 | |
| Shinyhunters | extortion | TechnologyBusiness & Professional ServicesEducationFinancial ServicesHealthcare | not yet mapped | 121 | |
| Interlock | ransomware | EducationHealthcareNonprofitBusiness & Professional ServicesGovernment | not yet mapped | 36 | |
| Everest | ransomware | TechnologyBusiness & Professional ServicesManufacturingFinancial ServicesHealthcare | not yet mapped | 33 | |
| Aurora | ransomware | RetailBusiness & Professional ServicesManufacturingTransportation & LogisticsTechnology | not yet mapped | 16 | |
| Metaencryptor | ransomware | ManufacturingEnergy & UtilitiesHealthcareAgricultureBusiness & Professional Services | not yet mapped | 10 | |
| Kazu | ransomware | HealthcareEducationBusiness & Professional Services | not yet mapped | 11 | |
| DYSPHOR1A | ransomware | EducationFinancial ServicesGovernmentBusiness & Professional ServicesTechnology | not yet mapped | 9 | |
| Space Bearsaka spacebears | ransomware | ManufacturingBusiness & Professional ServicesConstruction & EngineeringHealthcareTechnology | not yet mapped | 56 | |
| SilentRansomGroup | ransomware | Business & Professional Services | not yet mapped | 28 | |
| Tridentlocker | ransomware | Not reported | not yet mapped | 1 | |
| Gunra | ransomware | ManufacturingBusiness & Professional ServicesPharmaceuticals & Life SciencesEnergy & UtilitiesHealthcare | not yet mapped | 39 | |
| Kairos | ransomware | ManufacturingEducationGovernmentReal Estate | not yet mapped | 8 | |
| Insomnia | ransomware | HealthcareManufacturingLegalReal EstateTelecommunications | not yet mapped | 7 | |
| Nightspire | ransomware | ManufacturingHealthcareBusiness & Professional ServicesConstruction & EngineeringLegal | not yet mapped | 229 | |
| Bravox | ransomware | ManufacturingHealthcareRetailBusiness & Professional ServicesConstruction & Engineering | not yet mapped | 30 | |
| Majinahanashi | ransomware | HospitalityManufacturingTechnologyEnergy & UtilitiesHealthcare | not yet mapped | 14 | |
| BrainCipher | ransomware | TechnologyBusiness & Professional ServicesHealthcare | not yet mapped | 9 | |
| Orova | ransomware | ManufacturingHealthcareBusiness & Professional ServicesRetailFinancial Services | not yet mapped | 45 | |
| Falcon | ransomware | ManufacturingHealthcare | not yet mapped | 3 | |
| Crypto24 | ransomware | Not reported | not yet mapped | 1 | |
| Threeam | ransomware | Business & Professional ServicesHospitalityMedia & Entertainment | not yet mapped | 4 | |
| Black X | ransomware | Financial ServicesHealthcareAutomotiveEnergy & UtilitiesGovernment | not yet mapped | 13 | |
| M3rx | ransomware | ManufacturingBusiness & Professional ServicesConstruction & EngineeringTransportation & LogisticsConsumer Services | not yet mapped | 38 | |
| Iah6477 | ransomware | ManufacturingBusiness & Professional ServicesFinancial ServicesRetailTechnology | not yet mapped | 7 | |
| Lynx | ransomware | Financial ServicesGovernmentRetail | not yet mapped | 3 | |
| Doommageddon | ransomware | HealthcareManufacturingReal EstateAutomotiveFinancial Services | not yet mapped | 11 | |
| Moneymessage | ransomware | Energy & UtilitiesHealthcareTransportation & Logistics | not yet mapped | 3 | |
| Abyss | ransomware | Manufacturing | not yet mapped | 1 | |
| Ailock | ransomware | ManufacturingBusiness & Professional ServicesRetailConstruction & EngineeringTechnology | not yet mapped | 51 | |
| Genesis | ransomware | HealthcareBusiness & Professional ServicesConstruction & EngineeringManufacturingLegal | not yet mapped | 96 | |
| Deadlock | ransomware | ManufacturingBusiness & Professional ServicesConstruction & EngineeringTransportation & LogisticsFinancial Services | not yet mapped | 177 | |
| Booba Project | ransomware | Business & Professional ServicesManufacturingTechnologyFinancial ServicesHealthcare | not yet mapped | 10 | |
| Arcusmedia | ransomware | Business & Professional ServicesTechnologyConsumer ServicesEnergy & UtilitiesGovernment | not yet mapped | 10 | |
| Blackwater | ransomware | HealthcareAutomotiveBusiness & Professional ServicesEnergy & UtilitiesHospitality | not yet mapped | 12 | |
| Coinbasecartel | ransomware | Business & Professional ServicesFinancial ServicesManufacturingAgricultureHealthcare | not yet mapped | 29 | |
| Killsec | ransomware | Consumer ServicesFinancial ServicesHealthcareTransportation & Logistics | not yet mapped | 4 | |
| L Group | ransomware | Business & Professional ServicesRetailAgricultureConstruction & EngineeringManufacturing | not yet mapped | 27 | |
| Barracuda | ransomware | ManufacturingHealthcareBusiness & Professional Services | not yet mapped | 8 | |
| Helix | ransomware | Real EstateTransportation & LogisticsEnergy & UtilitiesBusiness & Professional ServicesFinancial Services | not yet mapped | 13 | |
| Xpl0itrs | ransomware | ManufacturingRetailEducationFinancial ServicesTechnology | not yet mapped | 7 | |
| Payload | ransomware | ManufacturingHealthcareTechnologyBusiness & Professional ServicesEnergy & Utilities | not yet mapped | 75 | |
| Titan | ransomware | ManufacturingHealthcareBusiness & Professional ServicesConstruction & EngineeringAgriculture | not yet mapped | 24 | |
| Ms13089 | ransomware | Transportation & Logistics | not yet mapped | 1 | |
| Blacknevas | ransomware | Consumer ServicesTechnologyAgricultureBusiness & Professional ServicesHealthcare | not yet mapped | 8 | |
| Leakeddata | ransomware | Legal | not yet mapped | 11 | |
| Coinbase Cartel | ransomware | TechnologyRetailBusiness & Professional ServicesManufacturingConstruction & Engineering | not yet mapped | 136 | |
| Ransomhouse | ransomware | Construction & EngineeringGovernmentManufacturingFinancial ServicesTechnology | not yet mapped | 44 | |
| Gammax | ransomware | AgricultureConsumer ServicesReal Estate | not yet mapped | 3 | |
| Cry0 | ransomware | Not reported | not yet mapped | 1 | |
| Leaknet | ransomware | GovernmentInsuranceBusiness & Professional ServicesEducationHealthcare | not yet mapped | 30 | |
| 3am | ransomware | AgricultureBusiness & Professional ServicesManufacturingAerospace & DefenseEducation | not yet mapped | 16 | |
| Orion | ransomware | Manufacturing | not yet mapped | 1 | |
| Triple X | ransomware | Financial ServicesLegal | not yet mapped | 2 | |
| Payoutsking | ransomware | ManufacturingBusiness & Professional ServicesRetailHospitalityMedia & Entertainment | not yet mapped | 78 | |
| CRPxO | ransomware | Financial ServicesHealthcareTechnologyBusiness & Professional ServicesManufacturing | not yet mapped | 31 | |
| Cmd Organization | ransomware | HealthcareManufacturingEducationBusiness & Professional ServicesConstruction & Engineering | not yet mapped | 43 | |
| Booba Team | ransomware | Business & Professional ServicesConstruction & EngineeringMedia & EntertainmentTelecommunicationsAgriculture | not yet mapped | 16 | |
| Cmdorganization | ransomware | Energy & UtilitiesBusiness & Professional ServicesEducationHealthcareManufacturing | not yet mapped | 10 | |
| ExfilSquad | ransomware | GovernmentEducationTechnologyBusiness & Professional ServicesConstruction & Engineering | not yet mapped | 24 | |
| Morpheus | ransomware | ManufacturingBusiness & Professional ServicesFinancial ServicesHospitalityInsurance | not yet mapped | 13 | |
| Section9 | ransomware | Energy & UtilitiesHospitality | not yet mapped | 3 | |
| Termite | ransomware | HealthcareBusiness & Professional ServicesFinancial Services | not yet mapped | 4 | |
| Arcus Media | ransomware | Energy & UtilitiesBusiness & Professional ServicesConstruction & EngineeringConsumer ServicesHospitality | not yet mapped | 9 | |
| Money Message | ransomware | Energy & UtilitiesNonprofitTransportation & Logistics | not yet mapped | 6 | |
| Nova | ransomware | TechnologyGovernmentBusiness & Professional ServicesEducationManufacturing | not yet mapped | 100 | |
| EraLeign (APT73) | ransomware | GovernmentManufacturingRetailTechnologyAgriculture | not yet mapped | 59 | |
| Apt73 | ransomware | Technology | not yet mapped | 1 | |
| Killsec3 | ransomware | Consumer ServicesHealthcare | not yet mapped | 3 | |
| Settra | ransomware | Construction & EngineeringManufacturingRetailAgricultureBusiness & Professional Services | not yet mapped | 30 | |
| Brain Cipher | ransomware | Business & Professional ServicesAutomotiveEducationEnergy & UtilitiesFinancial Services | not yet mapped | 25 | |
| Worldleaks | extortion | ManufacturingHealthcareEducationBusiness & Professional ServicesLegal | not yet mapped | 65 | |
| Blackout | ransomware | RetailTechnology | not yet mapped | 4 | |
| Syndicate | ransomware | Financial Services | not yet mapped | 1 | |
| D1r | ransomware | TechnologyAutomotiveManufacturing | not yet mapped | 6 | |
| Crpx0 | ransomware | HealthcarePharmaceuticals & Life Sciences | not yet mapped | 6 | |
| Dataleak | ransomware | ManufacturingInsurance | not yet mapped | 5 | |
| Stormous | ransomware | Business & Professional ServicesRetailFinancial ServicesNonprofitTechnology | not yet mapped | 34 | |
| Dispossessor | ransomware | Financial Services | not yet mapped | 1 | |
| Abyss-data | ransomware | Not reported | not yet mapped | no surviving claims | Not reported |
| Audit Team | ransomware | Not reported | not yet mapped | no surviving claims | Not reported |
| Beast | ransomware | Not reported | not yet mapped | no surviving claims | Not reported |
| Black Nevas | ransomware | Not reported | not yet mapped | no surviving claims | Not reported |
| Blacklocks | ransomware | Not reported | not yet mapped | no surviving claims | Not reported |
| Bluewhale | ransomware | Not reported | not yet mapped | no surviving claims | Not reported |
| Cyberleek | ransomware | Not reported | not yet mapped | no surviving claims | Not reported |
| Ethics | ransomware | Not reported | not yet mapped | no surviving claims | Not reported |
| Iah647 | ransomware | Not reported | not yet mapped | no surviving claims | Not reported |
| Kraken | ransomware | Not reported | not yet mapped | no surviving claims | Not reported |
| Meowciety403 | ransomware | Not reported | not yet mapped | no surviving claims | Not reported |
| Ms13-089 | ransomware | Not reported | not yet mapped | no surviving claims | Not reported |
| Sovcali | ransomware | Not reported | not yet mapped | no surviving claims | Not reported |
| The Crew | ransomware | Not reported | not yet mapped | no surviving claims | Not reported |
| Vexy | ransomware | Not reported | not yet mapped | no surviving claims | Not reported |
| Zawoo | ransomware | Not reported | not yet mapped | no surviving claims | Not reported |
No actors match your current search and filters. Reset search and filters to show all actors.
Ransomware claim data is unverified: RansomLook (CC BY 4.0) and ransomware.live (No data licence; credited voluntarily). ATT&CK group data comes from MITRE ATT&CK. Mappings are validated in CI against MITRE's own group names, aliases, and published descriptions.
Separate evidence lane
News reporting only
These profiles are assembled only from stories in this tracker’s reporting corpus. Their counts describe this site’s coverage, not actor activity or attribution.
- Scattered SpiderNamed in 20 stories by this tracker
- APT29Named in 11 stories by this tracker
- Cozy BearNamed in 2 stories by this tracker
- Midnight BlizzardNamed in 11 stories by this tracker
- Black BastaNamed in 7 stories by this tracker
- SandwormNamed in 15 stories by this tracker
- Cl0pNamed in 7 stories by this tracker
- KimsukyNamed in 4 stories by this tracker
- Lazarus GroupNamed in 9 stories by this tracker
- MedusaNamed in 7 stories by this tracker
- APT28Named in 6 stories by this tracker
- BianLianNamed in 2 stories by this tracker
- Mustang PandaNamed in 3 stories by this tracker
- Volt TyphoonNamed in 4 stories by this tracker
- Fancy BearNamed in 3 stories by this tracker
- Forest BlizzardNamed in 4 stories by this tracker
- ALPHVNamed in 10 stories by this tracker
- BlackcatNamed in 9 stories by this tracker
- Salt TyphoonNamed in 3 stories by this tracker
- RansomHubNamed in 8 stories by this tracker
- APT41Named in 1 story by this tracker
- TurlaNamed in 3 stories by this tracker
- Hunters InternationalNamed in 1 story by this tracker
- FIN7Named in 1 story by this tracker
- 8BaseNamed in 1 story by this tracker
How this is computed
Claim-backed profiles use unverified leak-site observations and verified MITRE ATT&CK mappings. Reporting-only profiles count exact canonical actor tags in this site's news corpus and make no activity claim.
Method reviewed on .