Ransomware

0apt

The group appears unreliable. Most, if not all, of its alleged victims cannot be verified and appear to be randomly selected organizations. WE HAVE DE...

0mega

8base

The 8base Ransomware group made its first appearance in early March 2022, remaining somewhat quiet after the attacks. This group operates like other r...

Abrahams_Ax

abyss

adminlocker

againstthewest

aGl0bGVyCg

AiLock

akira

The Akira ransomware group is said to have emerged in March 2023, and there's much speculation about its ties to the former CONTI ransomware group.<br...

ako

A Windows ransomware that will run certain tasks to prepare the target system for the encryption of files. MedusaLocker avoids executable files, proba...

alphalocker

alphv

The operators of the ALPHV/BlackCat ransomware began their activity in December 2021, making posts on Dark Web forums to promote their affiliate progr...

anubis

apos

apt73

A new ransomware group is said to have emerged in mid-April 2024, under the name 'APT73.' It's worth noting that the group reportedly self-proclaimed ...

arcusmedia

argonauts

arkana

arvinclub

atomsilo

avaddon

Avaddon is a ransomware malware targeting Windows systems often spread via malicious spam. The first known attack where Avaddon ransomware was distrib...

avos

avoslocker

aware

aztroteam

babuk

Babuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most used compiled versions, but ESX ...

babuk2

Babuk Locker 2.0, also known as Bjorka or SkyWave, after failing to make any profit from selling public databases on forums, decided to impersonate Ba...

babyduck

beast

Beast is a Ransomware-as-a-service (RaaS) product which provides functionality such as SMB scanning, file encryption, service and process starting and...

benzona

bert

bianlian

BianLian ransomware operations began in late 2021. The group practices multi-pronged extortion, demanding payment for a decryptor, as well as the non-...

blackbasta

"Black Basta" is a new ransomware strain discovered during April 2022 - looks in dev since at least early February 2022 - and due to their ability to ...

blackbyte

Ransomware. Uses dropper written in JavaScript to deploy a .NET payload.

blacklock

BlackLock is a rebranded version of another ransomware group known as Eldorado. It has since become one of the most active extortion syndicates in 202...

blackmatter

Ransomware-as-a-Service

blacknevas

blackout

blackshadow

blackshrantac

blacksuit

According to Trend Micro, this ransomware has significant code overlap with Royal Ransomware.

blacktor

bluebox

bluelocker

Blue Locker targets Pakistan’s vital energy sector, particularly Pakistan Petroleum

bluesky

bonacigroup

bqtlock

BrainCipher

Brain Cipher emerged in July 2024. Both Windows and Linux variants are available. Brain Cipher using the leaked build of LockBit Black for their opera...

bravox

brotherhood

cactus

The CACTUS ransomware is said to have emerged around March 2023. The group became known for exploiting vulnerabilities to gain initial access and main...

cephalus

chaos

cheers

chilelocker

chort

cicada3301

ciphbit

cipherforce

cloak

clop

The ransomware group known as Cl0p is a variant of a previously known strain dubbed CryptoMix. It is worth noting that this variant was delivered as t...

coinbasecartel

CoinbaseCartel specializes in data acquisition through system access and strategic partnerships. It focus exclusively on data exfiltration—our operati...

ContFR

RAAS - Ransomware intégré à un fichier PDF, à faire ouvrir à vos victimes ou à insérer vous-même, Windows et Mac, ne fonctionne pas sur Linux. Tableau...

conti

Conti is an extremely damaging ransomware due to the speed with which it encrypts data and spreads to other systems. It was first observed in 2020 and...

cooming

crazyhunter

crosslock

cry0

crylock

cryp70n1c0d3

cryptbb

cryptnet

According to OALabs, this ransomware has the following features: * Files are encrypted with AES CBC using a generated 256 bit key and IV.* The genera...

crypto24

cuba

The Cuba Ransomware, also known as Colddraw Ransomware, was first identified in the threat landscape in 2019 and built a relatively small but selected...

cyclops

d4rk4rmy

dagonlocker

daixin

dAn0n

darkangels

darkbit

darkleakmarket

darkpower

darkrace

darkside

Darkside ransomware group has started its operation in August of 2020 with the model of RaaS (Ransomware-as-a-Service). They have become known for the...

darkvault

datacarry

datakeeper

dataleak

desolator

devman

Former RansomHub and INC Ransom affiliate.

diavol

A ransomware with potential ties to Wizard Spider.

direwolf

dispossessor

This is not a ransomware group but a data broker

donex

donutleaks

doppelpaymer

Doppelpaymer is a ransomware family that encrypts user data and later on it asks for a ransom in order to restore original files. It is recognizable b...

dragonforce

dragonransomware

Dragon Ransomware, is promising rapid and customizable ransomware operations for Windows systems. Key features include a compact 50KB file size, ultra...

dread

dunghill

ech0raix

The QNAPCrypt ransomware works similarly to other ransomware, including encrypting all files and delivering a ransom note. However, there are several ...

ElDorado

In September The El Dorado ransomware group have been rebrand as BlackLock

embargo

entropy

Entropy is a ransomware first seen in 1st quarter of 2022, is being used in conjunction of Dridex infection. The ransomware uses a custom packer to pa...

ep918

everest

Everest ransom group collects and analyzes information about their victims. They specialize in customer privacy data, financial information, databases...

exitium

exorcist

According to PCrisk, Exorcist is a ransomware-type malicious program. Systems infected with this malware experience data encryption and users receive ...

fletchen

flocker

fog

Fog, which uses the .flocked extension for encrypted files, was first observed in May in campaigns by Storm-0844, a threat actor known for distributin...

frag

freecivilian

fsteam

New possible leak site posted to a forum on November 20th, 2022, no victims at present. Unclear if its for a ransomware or extortion group

funksec

GDLockerSec

Our team members are from different countries and we are not interested in anything else, we are only interested in dollars. We do not allow CIS, Cuba...

genesis

global

grief

Doppelpaymer is a ransomware family that encrypts user data and later on it asks for a ransom in order to restore original files. It is recognizable b...

groove

gunra

hades

According to PCrisk, Hades Locker is an updated version of WildFire Locker ransomware that infiltrates systems and encrypts a variety of data types us...

handala

Not a Ransomware Group

haron

hellcat

helldown

hellogookie

hellokitty

Unit42 states that HelloKitty is a ransomware family that first surfaced at the end of 2020, primarily targeting Windows systems. The malware family g...

hive

Hive is a strain of ransomware that was first discovered in June 2021. Hive was designed to be used by Ransomware-as-a-service providers, to enable no...

holyghost

hotarus

hunters

In mid-October 2023, just a few days before the Europol operation, the source code of the Ransomware Hive was sold, along with its website and older v...

icefire

IMNCrew

incransom

insane

insomnia

interlock

J

kairos

karakurt

karma

kawa4096

kazu

kelvinsecurity

killsec

kittykatkrew

knight

[Cyclops](group/cyclops) rebrand

kraken

kryptos

kyber

la_piovra

ℹ️ La Piovra Ransomware is an exercise of the company Offensive Security (also known as OffSec)

lapsus$

leaktheanalyst

lilith

linkc

lockbit

lockbit2

lockbit3

LockBit, also recognized as LockBit Black or Lockbit 3.0, is one of the largest Ransomware Groups in the world and has orchestrated extensive cyberatt...

lockbit3_fs

lockbit5

lockdata

lolnek

lorenz

Tesorion describes Lorenz as a ransomware with design and implementation flaws, leading to impossible decryption with tools provided by the attackers....

losttrust

lunalock

lv

LV ransomware group main message: "Here are companies which didn't meet consumer data protection obligations. They rejected to fix their mistakes, the...

lynx

madcat

madliberator

malas

malekteam

mallox

This ransomware uses a combination of different crypto algorithms (ChaCha20, AES-128, Curve25519). The activity of this malware is dated to mid-June 2...

mamona

marketo

maze

Maze ransomware group is one of the most known ransomware gangs, they targeted organizations worldwide across many industries. Security researchers be...

mbc

medusa

medusalocker

Medusa is a DDoS bot written in .NET 2.0. In its current incarnation its C&C protocol is based on HTTP, while its predecessor made use of IRC.

meow

metaencryptor

midas

This malware written in C# is a variant of the Thanos ransomware family and emerged in October 2021 and is obfuscated using SmartAssembly. In 2022, Th...

mindware

Ransomware, potential rebranding of win.sfile.

minteye

mogilevich

moneymessage

monti

morpheus

mosesstaff

Cybereason Nocturnus describes Moses Staff as an Iranian hacker group, first spotted in October 2021. Their motivation appears to be to harm Israeli c...

mountlocker

ms13089

mydecryptor

n3tworm

N3tw0rm ransomware group is linked to Iran by many security researchers especially for the fact that the group targeting only Israeli companies. Like ...

nasirsecurity

nefilim

According to Vitali Kremez and Michael Gillespie, this ransomware shares much code with Nemty 2.5. A difference is removal of the RaaS component, whic...

nemty

Nemty is a ransomware that was discovered in September 2019. Fortinet states that they found it being distributed through similar ways as Sodinokibi a...

netwalker

NetWalker ransomware group operates by the threat actor known as "CIRCUS SPIDER". The NetWalker ransomware was discovered in 2019. The group mainly ta...

nevada

nightsky

nightspire

nitrogen

noescape

nokoyawa

noname

nova

Nova (formerly RALord) is a ransomware-as-a-service (RaaS) group that encrypts victims’files and uses double-extortion tactics to pressure organizatio...

obscura

onepercent

onyx

orca

orion

osiris

pandora

Pandora ransomware was obtained by vx-underground at 2022-03-14.

pay2key

Pay2Key is ransomware that has been used by the threat actor Fox Kitten. The group seems to operate since July 2020, targetting mainly Israeli compani...

payload

payloadbin

payoutsking

pear

Pure Extraction And Ransom (PEAR) Team is the community of highly responsible and strictly disciplined members. We are a private team and have nothing...

play

Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin Am...

playboy

projectrelic

prolock

PwndLocker is a ransomware that was observed in late 2019 and is reported to have been used to target businesses and local governments/cities. Accordi...

prometheus

Ransomware written in .NET, apparently derived from the codebase of win.hakbit (Thanos) ransomware.

promptlock

First known AI-powered ransomware. The PromptLock malware uses the gpt-oss:20b model from OpenAI locally via the Ollama API to generate malicious Lua ...

pysa

Mespinosa is a ransomware which encrypts file using an asymmetric encryption and adds .pysa as file extension. According to dissectingmalware the exte...

qilin

Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are co...

qiulong

qlocker

quantum

rabbithole

radar

radiant

ragnarlocker

ragnarok

According to Bleeping Computer, the ransomware is used in targeted attacks against unpatched Citrix servers. It excludes Russian and Chinese targets u...

ralord

ramp

rancoz

ranion

ransombay

Launched on April 24th, 2025 RansomBay is a new project operating under the DragonForce initiative

ransomcartel

ransomcortex

ransomed

ransomexx

RansomExx is a ransomware family that targeted multiple companies starting in mid-2020. It shares commonalities with Defray777.

ransomhouse

ransomhub

The group emerged in mid-February 2024 and has already listed several organizations as alleged victims of their attacks, resulting from extortion thro...

ranstreet

ranzy

Ranzy Locker, Former known as ThunderX. The group hosting a data leak site in the darknet where they posting sensitive information of victims who do n...

raworld

RA Group, also known as RA World, first surfaced in April 2023, utilizing a custom variant of the Babuk ransomware.

raznatovic

RANSOMED.VC aka Raznatovic

rebornvc

redalert

redransomware

revil

Sodinokibi ransomware group also known as REvil (Ransomware Evil) operates as a ransomware-as-a-service (RaaS) model. After the group compromised his ...

reynolds

rhysida

Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Coba...

robinhood

rook

According to PCrisk, Rook is ransomware (an updated variant of Babuk) that prevents victims from accessing/opening files by encrypting them. It also m...

royal

According to Trendmicro, Royal ransomware was first observed in September 2022, and the threat actors behind it are believed to be seasoned cybercrimi...

rransom

RunSomeWares

sabbath

safepay

sarcoma

satanlockv2

secp0

Encrypted Extension: .vanhelsing, .vanlocker. Targets Windows Platform only

securotrop

SenSayQ

shadow

ShadowByt3$

shaoleaks

shinyhunters

ShinySp1d3r

Likely associated with the cybercrime group BlingLibra (ShinyHunters)

sicarii

siegedsec

Not a ransomware group but a hacktivist group that appeared coincidentally days before Russia’s invasion of Ukraine

silent

Unlike many other groups, Silent claims to operate with a high level of anonymity and discretion. According to their own statement, they avoid public ...

SilentRansomGroup

a former Conti team

sinobi

skira

slug

snatch

Snatch is a ransomware which infects victims by rebooting the PC into Safe Mode. Most of the existing security protections do not run in Safe Mode so ...

solidbit

Ransomware, written in .NET.

spacebears

sparta

spook

stormous

sugar

Ransomware, written in Delphi.

suncrypt

synack

teamxxx

tengu

termite

thegentlemen

thegreenbloodgroup

threeam

A new Ransomware family identified by the name '3AM' or 'ThreeAM' in September 2023. The ransomware operation was observed by the Symantec team, in wh...

toufan

Pro-Palestinian Group

tridentlocker

trigona

According to PCrisk, Trigona is ransomware that encrypts files and appends the ._locked extension to filenames. Also, it drops the how_to_decrypt.hta ...

trinity

trisec

u-bomb

underground

unknown

unsafe

A group which seems to recycle leak from other ransomware groups

ValenciaLeaks

VanHelsing

vanirgroup

vect

vendetta

Ransomware, which appears to be a rebranding of win.cuba.

vfokx

vicesociety

Vice Society ransomware appends the .v-society extension when encrypting Linux machines. Running a leak site on the darkweb, Possible relations with "...

walocker

wannacry

WannaCry ransomware is a cyber attack that spreads by exploiting vulnerabilities in the Windows operating system. At its peak in May 2017, WannaCry be...

warlock

The Warlock ransomware and operator(s) are believed to be attributed to Storm-2603, a China-based threat actor who is also known to have deployed Lock...

werewolves

weyhro

worldleaks

World Leaks emerged in January 2025 as a rebrand of the Hunters International ransomware operation, shifting its focus from file encryption to solely ...

x001xs

xinglocker

xinof

xp95

yanluowang

According to PCrisk, Yanluowang is ransomware that encrypts (and renames) files, ends all running processes, stops services, and creates the README.tx...

yurei

zeon

zerolockersec

zerotolerance

ALP-001

⚠️ Verification Notice: Claims published by ALP-001 have not been independently verified. This group is believed to be an established Initial Access B...