Ransomware
Incident feed
Newest first · derived from each report's own text| Time | Victim / report | Group | Country | Source |
|---|---|---|---|---|
| Report Why Shadow AI Matters: The Business Case For Taking Action Tackling the shadow AI economy is no longer optional for cybersecurity teams. It has become a fundamental… | — | — | BlackFog | |
| Report The Silent Ransom Group Leak Shows Why Paying for Silence Fails An Open Letter to Senior Partners at Law Firms Before we dive into the trends, we would like to take a detour… | Silent Ransom Group | — | Coveware | |
| Victim listed Noelker and Hull | Rhysida | — | ransomware.live | |
| Report How To Detect Shadow AI In Your Organization: 5 Key Signs AI tools are now used across almost all business operations, often with no IT approval or security oversight… | — | — | BlackFog | |
| Report The Shadow AI Economy: Risks, Causes And How To Control It BlackFog Audio: Prefer to Listen? Play the Podcast. The Shadow AI Economy: Risks, Causes And How To Control… | Play | — | BlackFog | |
| Report Japan’s GMO Internet Urges Customers to Disconnect PCs GMO Internet has told customers to unplug their PCs in advance of a possible ransomware attack | — | Japan | Infosecurity Magazine | |
| Report Hive ransomware affiliate jailed, years after FBI infiltrated the gang’s systems A Ukrainian man who carried out ransomware attacks for both the Nefilim and Hive gangs, including attacks on… | Hive | — | Graham Cluley | |
| Report Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison Artem Stryzhak was sentenced to 70 months in prison after pleading guilty to using Nefilim ransomware in… | Hive | Ukraine | SecurityWeek | |
| Victim listed Hauhinco | Payload | Germany | ransomware.live | |
| Victim listed Marbre Design | Payload | France | ransomware.live |
- Reports this week
- 283
- Victim posts this week
- 243
- Groups named this week
- 48
- Latest report
- 1 hour ago
Groups named this week
- Thegentlemen42
- N0n36
- SafePay19
- Akira16
- Medusalocker15
- Settra11
- Silent Ransom Group11
- Braincipher8
- Orova7
- Genesis6
- Aoqin5
- Payload5
Most named countries this week
- United States60
- Germany16
- United Kingdom9
- Indonesia5
- Switzerland5
- Belgium5
Live radars and open resources
Live victim trackers
- ransomware.live open sourceLeak-site monitor with victims by day, group profiles, a world map, statistics and a free JSON API.
- RansomLook open sourceWatches leak sites, Telegram channels and forums. Recent posts and per-group pages.
- ransomwatch open sourceLeak-site scraper with a public dashboard; the raw JSON lives on GitHub.
- Ransomfeed open sourceItalian community tracker of leak-site claims with charts per group and country.
- ecrime.chLeak-site tracker with daily counts and per-group victim listings.
- DarkfeedDark-web ransomware feed and group tracker with a public overview.
- The Record ransomware trackerMonthly figures on claimed attacks, compiled by Recorded Future's newsroom.
Groups, payments and data
- ransomware.live groups open sourceProfiles of active groups with their leak-site status and recent activity.
- Ransomwhere open dataCrowdsourced, open dataset of ransomware payments traced on the blockchain.
- DeepDarkCTI open sourceCurated list of ransomware gang sites, forums, markets and Telegram channels.
- ransomwatch on GitHub open sourceSource code and the machine-readable posts and groups data behind ransomwatch.
- ransomware.live API open sourceFree JSON endpoints for recent victims, groups, statistics and negotiations.
- ThreatFox open dataabuse.ch community IOC database: C2 servers, hashes and URLs tagged by family.
- MalwareBazaar open dataabuse.ch sample repository with ransomware family tags and YARA matches.
Identify, recover, report
- ID RansomwareUpload a ransom note or an encrypted file to identify the strain (MalwareHunterTeam).
- No More RansomFree decryptors and advice from Europol, national police and security vendors.
- Emsisoft decryptorsFree decryption tools for dozens of ransomware families.
- CISA #StopRansomwareJoint advisories on active groups, the StopRansomware guide and where to report.