Ransomware
Incident feed
Newest first · derived from each report's own text| Time | Victim / report | Group | Country | Source |
|---|---|---|---|---|
| Report Australia’s Annual Cyber Threat Report 2025-26 Shows Cyber Incidents Up 20% Australia’s cyber security authority responded to 1,524 cyber security incidents in the 2025-26 financial… | — | Australia | SOCRadar | |
| Report PHP2Shell Weaponized After Japanese Real Estate Extortion SOCRadar Threat Research Unit identified an open directory on 96.126.130.81 that exposed the working files of… | — | Japan | SOCRadar | |
| Report Cyberattack disrupts University of New Mexico hospitals, extortion group claims attack University of New Mexico (UNM) Health Sciences Center (HSC), the academic medical arm of the University of… | — | United States | Help Net Security | |
| Victim listed GreenbergFarrow | Aurora | United States | ransomware.live | |
| Victim listed Bristol City Council | Wallstreet | United Kingdom | ransomware.live | |
| Report What happens when security tools go dark before the ransomware On Oct. 1, threat researchers reported that the China-linked group behind Warlock ransomware, which Microsoft… | Storm | — | CyberScoop | |
| Report Hornetsecurity by Proofpoint Ransomware Report 2027 reveals nearly half of companies don’t trust their own defences Hornetsecurity by Proofpoint has launched its Ransomware Report 2027, revealing that organisations are better… | — | — | Hornetsecurity | |
| Report Wasmtime Sandbox Escape Flaws Patched in Cranelift Two critical Wasmtime sandbox escape flaws, CVE-2026-115889 and CVE-2026-115893, let a crafted WebAssembly… | — | — | SOCRadar | |
| Victim listed Company #111 | N0n | United Arab Emirates | ransomware.live | |
| Victim listed Burris & MacOmber | Everest | — | ransomware.live |
- Reports this week
- 288
- Victim posts this week
- 246
- Groups named this week
- 48
- Latest report
- 23 min ago
Groups named this week
- Thegentlemen42
- N0n36
- SafePay19
- Akira16
- Medusalocker15
- Silent Ransom Group12
- Settra11
- Braincipher8
- Orova7
- Genesis6
- Aoqin5
- Payload5
Most named countries this week
- United States62
- Germany16
- United Kingdom9
- Canada5
- Indonesia5
- Switzerland5
Live radars and open resources
Live victim trackers
- ransomware.live open sourceLeak-site monitor with victims by day, group profiles, a world map, statistics and a free JSON API.
- RansomLook open sourceWatches leak sites, Telegram channels and forums. Recent posts and per-group pages.
- ransomwatch open sourceLeak-site scraper with a public dashboard; the raw JSON lives on GitHub.
- Ransomfeed open sourceItalian community tracker of leak-site claims with charts per group and country.
- ecrime.chLeak-site tracker with daily counts and per-group victim listings.
- DarkfeedDark-web ransomware feed and group tracker with a public overview.
- The Record ransomware trackerMonthly figures on claimed attacks, compiled by Recorded Future's newsroom.
Groups, payments and data
- ransomware.live groups open sourceProfiles of active groups with their leak-site status and recent activity.
- Ransomwhere open dataCrowdsourced, open dataset of ransomware payments traced on the blockchain.
- DeepDarkCTI open sourceCurated list of ransomware gang sites, forums, markets and Telegram channels.
- ransomwatch on GitHub open sourceSource code and the machine-readable posts and groups data behind ransomwatch.
- ransomware.live API open sourceFree JSON endpoints for recent victims, groups, statistics and negotiations.
- ThreatFox open dataabuse.ch community IOC database: C2 servers, hashes and URLs tagged by family.
- MalwareBazaar open dataabuse.ch sample repository with ransomware family tags and YARA matches.
Identify, recover, report
- ID RansomwareUpload a ransom note or an encrypted file to identify the strain (MalwareHunterTeam).
- No More RansomFree decryptors and advice from Europol, national police and security vendors.
- Emsisoft decryptorsFree decryption tools for dozens of ransomware families.
- CISA #StopRansomwareJoint advisories on active groups, the StopRansomware guide and where to report.