Skip to content
Cyber Threat
CTI Academy Sponsor CTI Academy
LK

Ransomware attacks in Sri Lanka

16 organisations in Sri Lanka have been listed on ransomware leak sites, ranking #75 worldwide. Updated .

Victims
16
0.1% of global total
Global rank
#75
of 181 countries
Active groups
14
Most: Payload
Sectors
8
Most: Technology

ThreatAI analysis

Compiled from this database and the ransomware.live profiles of the groups active in Sri Lanka. Figures are computed from the tracked records, not inferred.

Sri Lanka has been hit by ransomware, with 16 recorded cases globally placing it at rank 74, while most active attackers are groups like Payload and Cloak focusing on tech-heavy industries such as agriculture and business services.

Sri Lanka in the global picture

Sri Lanka accounts for 16 of the ransomware disclosures tracked here, ranking #75 worldwide and making up 0.1% of the global total. The sectors listed most often are Technology, Agriculture and Food Production, Business Services.

Who is most active in Sri Lanka

Payload — 2 victims in Sri Lanka. Cloak — 2 victims in Sri Lanka. Blacknevas — 1 victims in Sri Lanka.

Ransomware threat profile: Sri Lanka

Sri Lanka ranks #75 worldwide for ransomware disclosures, with 16 victims in this database — 0.1% of the global total. The groups listing the most organisations here are Payload, Cloak and Blacknevas.

The most frequently listed industries in Sri Lanka are Technology, Agriculture and Food Production, Business Services. Manufacturing is an attractive target because production downtime turns directly into lost revenue.

The volume reflects Sri Lanka's integration into the global economy and the reach of ransomware operations that target organisations of every size. Organisations here should weigh the active groups documented on this page when prioritising detection rules and incident-response planning.

Victims in Sri Lanka 16

Organization Disclosed
Abans Group
Blacknevas
Synex International Pvt Ltd
Dragonforce
SIRILAK SEAFOOD (PW) LTD.
Titan
Ceywater Consultants
Worldleaks
Marino Food Products Pvt
Payload
NKAR Travels & Tours
Payload
MASHOLDINGS.COM
Clop
Provincial Department of Health Services Sri Lanka
Kryptos
www.midcity.lk
Yurei
Pensions.gov.lk
Cloak
VS One Technology
Nova
Pe*************.lk
Cloak
Cargills Bank
Hunters
Richardson
Qilin
PeoplesHR
Meow
lankacom.net
Darkvault

Frequently asked questions

How many ransomware attacks have occurred in Sri Lanka?

Sri Lanka has recorded 16 ransomware victim disclosures in this database, ranking #75 globally. This represents 0.1% of all tracked ransomware attacks worldwide.

Which ransomware groups target Sri Lanka?

The ransomware groups most active in Sri Lanka are Payload, Cloak, Blacknevas, Dragonforce. These groups collectively account for the majority of victim disclosures attributed to Sri Lanka.

Which industries are most targeted by ransomware in Sri Lanka?

In Sri Lanka, the most frequently targeted sectors are Technology, Agriculture and Food Production, Business Services. These industries hold valuable data and often have critical operational requirements that make them attractive ransomware targets.

How does Sri Lanka rank globally for ransomware attacks?

Sri Lanka ranks #75 globally for ransomware attacks with 16 victim disclosures, representing 0.1% of the worldwide total of 23,641 tracked victims.

How can organisations in Sri Lanka protect against ransomware?

Organisations in Sri Lanka should implement a layered security approach including regular offline backups, network segmentation, multi-factor authentication, endpoint detection and response (EDR) tools, and employee security awareness training. Monitoring threat intelligence feeds for active groups targeting Sri Lanka is also recommended.