Ransomware Intelligence / Groups
Ransomware groups
Ranked by leak-site claims in the last 30 days. Each group page shows its weekly trend, the sectors and countries it is claiming, and the vulnerabilities to patch.
Opening ransom demands
Across all 196 chats: median $525k, middle half $200k–$1.5M.
| Group | Range | Median opening demand | Chats | Years | Came down to |
|---|---|---|---|---|---|
| Akira | $100k–$10M | $400k | 62 | 2023–2026 | 45% |
| Conti | $100k–$15M | $980k | 27 | 2020–2021 | 46% |
| LockBit 3.0 | $45k–$19M | $1M | 23 | 2022–2025 | — |
| DragonForce | $100k–$7M | $1M | 18 | 2024–2026 | — |
| REvil | $25k–$9M | $500k | 11 | 2020–2021 | 59% |
"Came down to" is the median lowest offer as a share of the opening demand, shown where at least 5 chats record one. 18 other groups with fewer than 10 chats are not broken out.
From 196 leaked negotiation chats (Ransomchats, MIT licence). Leaked and contributed chats are not a representative sample: a few groups and years dominate, and big cases are over-represented. Amounts are the group's first stated total demand in US dollars. 10 of these demands were made in bitcoin and are converted at the bitcoin price on the day of the chat. Crypto demands from chats with no known date are not included. How these figures are extracted.
Active in the last 30 days
89 groups with at least one claim.
| Group | Claims, 30 days | Last seen |
|---|---|---|
| the gentlemen | 155 | 2026-10-17 |
| n0n | 116 | 2026-10-18 |
| qilin | 86 | 2026-10-17 |
| killsec3 | 46 | 2026-09-27 |
| inc ransom | 38 | 2026-10-16 |
| nightspire | 35 | 2026-10-15 |
| storm | 32 | 2026-10-16 |
| akira | 32 | 2026-10-15 |
| majinahanashi | 28 | 2026-10-17 |
| wallstreet | 26 | 2026-10-16 |
| lockbit5 | 25 | 2026-10-17 |
| safepay | 25 | 2026-10-12 |
| audit team | 24 | 2026-10-13 |
| metaencryptor | 23 | 2026-10-12 |
| clop | 23 | 2026-09-23 |
| emperador | 22 | 2026-10-15 |
| play | 21 | 2026-10-17 |
| everest | 18 | 2026-10-17 |
| SilentRansomGroup | 16 | 2026-10-08 |
| panzer | 15 | 2026-10-13 |
| settra | 15 | 2026-10-09 |
| leakeddata | 15 | 2026-10-09 |
| rhysida | 14 | 2026-10-11 |
| vypr | 14 | 2026-10-07 |
| lamashtu | 14 | 2026-10-05 |
| dragonforce | 13 | 2026-10-17 |
| orova | 13 | 2026-10-14 |
| interlock | 13 | 2026-10-12 |
| booba team | 13 | 2026-10-04 |
| imnotavillian | 13 | 2026-09-28 |
| krybit | 12 | 2026-10-04 |
| brain cipher | 11 | 2026-10-12 |
| vexy | 10 | 2026-10-17 |
| byod | 10 | 2026-10-17 |
| umbra | 10 | 2026-10-10 |
| zawoo | 10 | 2026-09-24 |
| deadlock | 9 | 2026-10-16 |
| hyflock | 9 | 2026-10-13 |
| 3am | 9 | 2026-10-09 |
| medusalocker | 9 | 2026-10-05 |
| eclipse | 8 | 2026-10-17 |
| aurora | 8 | 2026-10-16 |
| pear | 8 | 2026-10-16 |
| the seven deadly sins | 8 | 2026-10-16 |
| endzone | 8 | 2026-10-06 |
| shinyhunters | 8 | 2026-10-02 |
| iah647 | 7 | 2026-10-15 |
| payoutsking | 7 | 2026-10-14 |
| arcus media | 7 | 2026-10-09 |
| m3rx | 7 | 2026-09-29 |
| global cybernetic collective | 7 | 2026-09-28 |
| ransomhouse | 6 | 2026-10-13 |
| termite | 6 | 2026-10-09 |
| redact | 5 | 2026-10-16 |
| kairos | 5 | 2026-10-14 |
| anubis | 5 | 2026-10-09 |
| black x | 5 | 2026-10-09 |
| barracuda | 5 | 2026-10-09 |
| doommageddon | 5 | 2026-10-05 |
| spirals | 5 | 2026-10-03 |
| helix | 4 | 2026-10-17 |
| shiba | 4 | 2026-10-11 |
| chaos | 4 | 2026-10-10 |
| netrunner | 4 | 2026-10-08 |
| genesis | 4 | 2026-10-01 |
| bravox | 3 | 2026-10-17 |
| scarlettgroup | 3 | 2026-10-15 |
| space bears | 3 | 2026-10-15 |
| dark project | 3 | 2026-10-12 |
| cry0 | 3 | 2026-10-09 |
| global secret group | 3 | 2026-10-05 |
| gammax | 3 | 2026-09-29 |
| direwolf | 2 | 2026-10-13 |
| payload | 2 | 2026-10-08 |
| blacklocks | 2 | 2026-09-26 |
| titan | 2 | 2026-09-22 |
| unsafe | 2 | 2026-09-21 |
| 0x00 | 1 | 2026-10-15 |
| black nevas | 1 | 2026-10-15 |
| sarcoma | 1 | 2026-10-13 |
| exitium | 1 | 2026-10-12 |
| run some wares | 1 | 2026-10-08 |
| insomnia | 1 | 2026-10-05 |
| morpheus | 1 | 2026-10-01 |
| ulose | 1 | 2026-09-30 |
| vladivostok | 1 | 2026-09-28 |
| secp0 | 1 | 2026-09-22 |
| money message | 1 | 2026-09-21 |
| securotrop | 1 | 2026-09-18 |
35 groups with no claims in the last 30 days
Data sources
- Source: CISA KEVupdated 2 hours ago
- Opening demands are read from leaked ransomware negotiation chats collected by Ransomchats (MIT licence), using an OpenAI language model. These chats are not a representative sample.updated 2 hours ago
- Source: RansomLookupdated 2 hours ago
- Source: Ransomware.liveupdated 2 hours ago
- Sector, country and region labels are inferred by SecuritySnares from the published organisation name using an OpenAI language model; treat them as estimates.updated 2 hours ago
Leak-site listings reflect claims by threat actors and are not independently verified. Victims are never named on this site unless they have disclosed the incident themselves. Read the methodology.