Ransomware
Ransomware groups, incidents, extortion trends and recovery practice.
- Reports
- 69
- Victim posts on this page
- 0
- Groups named
- 1
- Latest
- 14 min ago
Groups in the latest reports
- Cl0p1
Most named countries
- United States2
- Italy2
- Germany2
- Spain2
- India1
- Brazil1
Live radars and open resources
Independent trackers · claims by criminal groups are not confirmed incidentsLive victim trackers
- ransomware.live open sourceLeak-site monitor with victims by day, group profiles, a world map, statistics and a free JSON API.
- RansomLook open sourceWatches leak sites, Telegram channels and forums; recent posts and per-group pages.
- ransomwatch open sourceLeak-site scraper with a public dashboard; the raw JSON lives on GitHub.
- Ransomfeed open sourceItalian community tracker of leak-site claims with charts per group and country.
- ecrime.chLeak-site tracker with daily counts and per-group victim listings.
- DarkfeedDark-web ransomware feed and group tracker with a public overview.
- The Record ransomware trackerMonthly figures on claimed attacks, compiled by Recorded Future's newsroom.
Groups, payments and data
- ransomware.live groups open sourceProfiles of active groups with their leak-site status and recent activity.
- Ransomwhere open dataCrowdsourced, open dataset of ransomware payments traced on the blockchain.
- DeepDarkCTI open sourceCurated list of ransomware gang sites, forums, markets and Telegram channels.
- ransomwatch on GitHub open sourceSource code and the machine-readable posts and groups data behind ransomwatch.
- ransomware.live API open sourceFree JSON endpoints for recent victims, groups, statistics and negotiations.
- ThreatFox open dataabuse.ch community IOC database: C2 servers, hashes and URLs tagged by family.
- MalwareBazaar open dataabuse.ch sample repository with ransomware family tags and YARA matches.
Identify, recover, report
- ID RansomwareUpload a ransom note or an encrypted file to identify the strain (MalwareHunterTeam).
- No More RansomFree decryptors and advice from Europol, national police and security vendors.
- Emsisoft decryptorsFree decryption tools for dozens of ransomware families.
- CISA #StopRansomwareJoint advisories on active groups, the StopRansomware guide and where to report.
Incident feed
Newest first · derived from each report's own text| Time | Victim / report | Group | Country | Source |
|---|---|---|---|---|
| Report Hacking Group Claims Attack on Cedar County Memorial Hospital A hacking group has claimed responsibility for an August 2026 cyberattack on Cedar County Memorial Hospital… | — | United States | HIPAA Journal | |
| Report ShinyHunters hacks Clop leak site, threatens to extort ransomware gang Lawrence Abrams reports: The ShinyHunters extortion gang breached the Clop (aka Cl0p) ransomware operation’s… | Cl0p | — | DataBreaches.net | |
| Report Ransomware attack on Kansas county will affect some services Joseph McCarty reports: A Kansas county’s government says it has been hit by a ransomware attack. Ellis… | — | United States | DataBreaches.net | |
| Report How Attackers Abuse Legitimate RMM Tools In September 2026, a Chase-themed campaign delivered more than 80,000 messages in a few hours. The email… | — | — | Hornetsecurity | |
| Report International investigation identifies over 70 potential victims exploited in Indian restaurants The coordinated action conducted on 18 September 2026 led to two arrests. Allegedly, the traffickers forced… | — | India | Europol | |
| Report Two-week Europol task force identifies 18 sexually abused children worldwide The Victim Identification Task Force brings together experts from across the globe to combat child sexual… | — | — | Europol | |
| Report Seven arrests in Brazil during crackdown on South America-Europe cocaine pipeline Europol has supported law enforcement agencies from Italy and Brazil in dismantling a major drug trafficking… | — | Brazil, Italy | Europol | |
| Report SIRIUS SPoC network meets as EU enters new era for electronic evidence The 7th SIRIUS Single Point of Contact (SPoC) Network Meeting, organised by Europol’s EU Internet Referral… | — | Germany | Europol | |
| Report Andorran Police joins Europol’s secure communication network Through this connection, the Andorran Police will be able to securely share law enforcement information with… | — | — | Europol | |
| Report Crackdown on Italian organised criminal network involved in large-scale euro counterfeiting Europol has supported an international operation targeting a criminal network linked to the Italian… | — | Germany, Italy | Europol | |
| Report Thousands of horses caught up in Europe-wide trafficking scheme Europol has supported a major operation against a criminal network suspected of trafficking horses across… | — | — | Europol | |
| Report Drug trafficking investigation leads to some of the world’s biggest underground bankers The investigation, led by the Spanish National Police (Policía Nacional) and supported by Europol, has… | — | Spain | Europol | |
| Report Europol celebrates the International Day of Police Cooperation On 7 September, Europol is marking the International Day of Police Cooperation together with its partners to… | — | — | Europol | |
| Report Europol and European Labour Authority strengthen cooperation against labour exploitation The Working Arrangement formalises cooperation that has already demonstrated its value through joint… | — | — | Europol | |
| Report EtherHiding Exposed: Inside a Blockchain-powered Malware Campaign Hiding in Plain Sight EtherHiding Exposed: Inside a Blockchain-powered Malware Campaign Hiding in Plain Sight September 17, 2026… | — | — | GuidePoint Security | |
| Report The Next Evolution of Identity: Extending IAM Across People, Machines, and AI The Next Evolution of Identity: Extending IAM Across People, Machines and AI September 15, 2026 Elizabeth… | — | — | GuidePoint Security | |
| Report The Risks Behind AI AI can deliver remarkable benefits for businesses, but before rushing to adopt it, organizations should… | — | — | Emsisoft | |
| Report CVE-2026-76460: Cisco ISE Flaw Actively Exploited CVE-2026-76460: Cisco ISE Flaw Actively Exploited CVE-2026-76460 represents a critical security flaw in… | — | — | SOCRadar | |
| Report Manage SOCRadar Alerts Where Your Team Already Works with SOCRadar and Zendesk Manage SOCRadar Alerts Where Your Team Already Works with SOCRadar and Zendesk A new high-severity alert… | — | — | SOCRadar | |
| Report CVE-2026-76461: Cisco Email Gateway Flaw Exploited CVE-2026-76461: Cisco Email Gateway Flaw Exploited Cisco has confirmed active exploitation of CVE-2026-76461… | — | — | SOCRadar |