Ransomware Threat Database
Track 393+ ransomware groups. Monitor victims, IOCs, and TTPs in real-time. Get specific intelligence to protect your organization.
Active Groups
Total Victims
This Month
This Year
Check If Your Domain Was Compromised
Search our database to see if your organization appears in any ransomware leak sites.
risk score · threat categories · sources · age · confidence — in one request
Active Ransomware Groups
Ranked by total victim count
qilin
2240 victims
lockbit3
2016 victims
akira
1584 victims
play
1304 victims
clop
1300 victims
lockbit2
1002 victims
incransom
919 victims
ransomhub
842 victims
thegentlemen
790 victims
alphv
731 victims
dragonforce
645 victims
bianlian
552 victims
safepay
549 victims
blackbasta
523 victims
medusa
517 victims
8base
455 victims
lynx
417 victims
everest
392 victims
conti
351 victims
lockbit5
345 victims
Showing top 20 of 393 tracked ransomware groups
Ransomware intelligence facts
Buyer-facing details for teams evaluating ransomware intelligence coverage, delivery, and limitations.
- Covered entities
- Ransomware groups, victim organizations, sectors, countries, leak-site activity, and related infrastructure signals.
- Operational use
- Prioritize exposed sectors, enrich incident response, monitor brand mentions, and brief executives on active group behavior.
- Refresh model
- Ransomware source data is fetched dynamically and revalidated regularly so the hub stays aligned with active campaigns.
- API paths
- Ransomware intelligence is available through dashboard views and supporting API routes for feeds, groups, press, and sector risk.
- Best fit
- SOC, CTI, incident response, insurance, legal, and risk teams that need campaign context beyond raw IOCs.
- Limitations
- Leak-site presence is a risk signal, not final attribution. Validate claims before public disclosure or enforcement decisions.
Ransomware cluster guides
Practical guides that connect ransomware tracking with C2 detection, initial access, backups, and response.
Most Targeted Sectors
5947 attacks
5484 attacks
3932 attacks
2614 attacks
2181 attacks
1780 attacks
1405 attacks
1371 attacks
1343 attacks
1304 attacks
Most Targeted Countries
10153 victims
8034 victims
1099 victims
1066 victims
1053 victims
691 victims
671 victims
539 victims
518 victims
516 victims
Protect Your Organization
Get real-time alerts when ransomware groups target your industry or region.