Ransomware Threat Database
Track 345+ ransomware groups. Monitor victims, IOCs, and TTPs in real-time. Get actionable intelligence to protect your organization.
Active Groups
Total Victims
This Month
This Year
Check If Your Domain Was Compromised
Search our database to see if your organization appears in any ransomware leak sites.
Get instant threat analysis with risk scores, threat categories, and detailed reports.
Active Ransomware Groups
Ranked by total victim count
lockbit3
2016 victims
qilin
1854 victims
akira
1488 victims
clop
1254 victims
play
1250 victims
lockbit2
1002 victims
ransomhub
842 victims
incransom
804 victims
alphv
731 victims
bianlian
552 victims
blackbasta
523 victims
dragonforce
519 victims
medusa
517 victims
safepay
479 victims
8base
455 victims
thegentlemen
427 victims
lynx
410 victims
everest
356 victims
conti
351 victims
dispossessor
344 victims
Showing top 20 of 345 tracked ransomware groups
Ransomware intelligence facts
Buyer-facing details for teams evaluating ransomware intelligence coverage, delivery, and limitations.
- Covered entities
- Ransomware groups, victim organizations, sectors, countries, leak-site activity, and related infrastructure signals.
- Operational use
- Prioritize exposed sectors, enrich incident response, monitor brand mentions, and brief executives on active group behavior.
- Refresh model
- Ransomware source data is fetched dynamically and revalidated regularly so the hub stays aligned with active campaigns.
- API paths
- Ransomware intelligence is available through dashboard views and supporting API routes for feeds, groups, press, and sector risk.
- Best fit
- SOC, CTI, incident response, insurance, legal, and risk teams that need campaign context beyond raw IOCs.
- Limitations
- Leak-site presence is a risk signal, not final attribution. Validate claims before public disclosure or enforcement decisions.
Ransomware cluster guides
Practical guides that connect ransomware tracking with C2 detection, initial access, backups, and response.
Protect Your Organization
Get real-time alerts when ransomware groups target your industry or region.