Ransomware
Incident feed
Newest first · derived from each report's own text| Time | Victim / report | Group | Country | Source |
|---|---|---|---|---|
| Victim listed PIC GROUP, INC | Akira | — | ransomware.live | |
| Report Etairos Health Settles Ransomware-Related Class Action Lawsuit Etairos Health has agreed to settle class action litigation stemming from a February 20, 2024, ransomware… | — | — | HIPAA Journal | |
| Victim listed Canadian Mennonite University (CMU) | DragonForce | Canada | ransomware.live | |
| Report CVE-2026-102255: Critical SonicWall SMA1000 SSRF CVE-2026-102255: Critical SonicWall SMA1000 SSRF SonicWall has patched CVE-2026-102255, a critical… | — | — | SOCRadar | |
| Report Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe The suspect is believed to be Edward Dubrovsky, a Canadian cybersecurity executive who was visiting the… | ShinyHunters | Canada, United States | SecurityWeek | |
| Report Inside ICMacOS: From an Infostealer to a Persistent RAT Inside ICMacOS: From an Infostealer to a Persistent RAT Over the past few years, Apple’s enterprise footprint… | — | United States | SOCRadar | |
| Report Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups ReliaQuest confirmed that the Qilin and Settra ransomware groups are actively exploiting a Palo Alto… | Qilin | — | Infosecurity Magazine | |
| Report Angi Data Sale, The Tour Guy Breach, Healthcare Leads, KPN Leak, and CafeMom Data Resurface Angi Data Sale, The Tour Guy Breach, Healthcare Leads, KPN Leak, and CafeMom Data Resurface SOCRadar Dark Web… | — | Australia, South Korea | SOCRadar | |
| Victim listed Placer AI | Thegentlemen | — | ransomware.live | |
| Victim listed BigID | Thegentlemen | — | ransomware.live |
- Reports this week
- 277
- Victim posts this week
- 239
- Groups named this week
- 48
- Latest report
- 5 hours ago
Groups named this week
- Thegentlemen42
- N0n31
- SafePay19
- Akira15
- Medusalocker15
- Silent Ransom Group11
- Braincipher8
- Settra8
- Orova7
- Genesis6
- Aoqin5
- Pear5
Most named countries this week
- United States55
- Germany15
- United Kingdom10
- Indonesia5
- Switzerland5
- Belgium5
Live radars and open resources
Live victim trackers
- ransomware.live open sourceLeak-site monitor with victims by day, group profiles, a world map, statistics and a free JSON API.
- RansomLook open sourceWatches leak sites, Telegram channels and forums. Recent posts and per-group pages.
- ransomwatch open sourceLeak-site scraper with a public dashboard; the raw JSON lives on GitHub.
- Ransomfeed open sourceItalian community tracker of leak-site claims with charts per group and country.
- ecrime.chLeak-site tracker with daily counts and per-group victim listings.
- DarkfeedDark-web ransomware feed and group tracker with a public overview.
- The Record ransomware trackerMonthly figures on claimed attacks, compiled by Recorded Future's newsroom.
Groups, payments and data
- ransomware.live groups open sourceProfiles of active groups with their leak-site status and recent activity.
- Ransomwhere open dataCrowdsourced, open dataset of ransomware payments traced on the blockchain.
- DeepDarkCTI open sourceCurated list of ransomware gang sites, forums, markets and Telegram channels.
- ransomwatch on GitHub open sourceSource code and the machine-readable posts and groups data behind ransomwatch.
- ransomware.live API open sourceFree JSON endpoints for recent victims, groups, statistics and negotiations.
- ThreatFox open dataabuse.ch community IOC database: C2 servers, hashes and URLs tagged by family.
- MalwareBazaar open dataabuse.ch sample repository with ransomware family tags and YARA matches.
Identify, recover, report
- ID RansomwareUpload a ransom note or an encrypted file to identify the strain (MalwareHunterTeam).
- No More RansomFree decryptors and advice from Europol, national police and security vendors.
- Emsisoft decryptorsFree decryption tools for dozens of ransomware families.
- CISA #StopRansomwareJoint advisories on active groups, the StopRansomware guide and where to report.