Skip to content
Cyber Threat
CTI Academy Sponsor CTI Academy
RS

Ransomware attacks in Serbia

12 organisations in Serbia have been listed on ransomware leak sites, ranking #81 worldwide. Updated .

Victims
12
0% of global total
Global rank
#81
of 185 countries
Active groups
9
Most: Play
Sectors
9
Most: Energy & Utilities

ThreatAI analysis

Compiled from this database and the ransomware.live profiles of the groups active in Serbia. Figures are computed from the tracked records, not inferred.

Serbia suffers 12 recorded ransomware attacks globally ranking 81st; notable threat actors include Play, Apt73, and Ransomhub targeting Energy & Utilities, Technology and Agriculture.

Serbia in the global picture

Serbia accounts for 12 of the ransomware disclosures tracked here, ranking #81 worldwide and making up 0% of the global total. The sectors listed most often are Energy & Utilities, Technology, Agriculture and Food Production.

Who is most active in Serbia

Play — 2 victims in Serbia. Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Apt73 — 2 victims in Serbia. Ransomhub — 2 victims in Serbia. The group emerged in mid-February 2024 and has already listed several organizations as alleged victims of their attacks, resulting from extortion through encryption and data leaks.

Where to report an incident in Serbia

National computer emergency response teams for Serbia, as registered with ENISA and the teams themselves. Regional, sectoral and vendor response teams are excluded; verify current contact details before relying on them in an incident.

Ransomware threat profile: Serbia

Serbia ranks #81 worldwide for ransomware disclosures, with 12 victims in this database — 0% of the global total. The groups listing the most organisations here are Play, Apt73 and Ransomhub.

The most frequently listed industries in Serbia are Energy & Utilities, Technology, Agriculture and Food Production. These sectors hold sensitive data and run operations that are costly to interrupt.

The volume reflects Serbia's integration into the global economy and the reach of ransomware operations that target organisations of every size. Organisations here should weigh the active groups documented on this page when prioritising detection rules and incident-response planning.

Victims in Serbia 12

Organization Disclosed
Red Star Oil
Play
Red Star Oil
Play
Government of Vojvodina
Panzer
bg.ac.rs
Apt73
dunav.com
Apt73
roamingnetworks.rs
Lockbit5
proton-system_Serbia
Incransom
Informatika A.D.
Worldleaks
Triple Jump
Ransomhouse
centerracoop.com
Akira
www.psgbdvor.rs
Ransomhub
PSG BANATSKI DVOR D.O.O. NOVI SAD (SERBIA)
Ransomhub

Frequently asked questions

How many ransomware attacks have occurred in Serbia?

Serbia has recorded 12 ransomware victim disclosures in this database, ranking #81 globally. This represents 0% of all tracked ransomware attacks worldwide.

Which ransomware groups target Serbia?

The ransomware groups most active in Serbia are Play, Apt73, Ransomhub, Panzer. These groups collectively account for the majority of victim disclosures attributed to Serbia.

Which industries are most targeted by ransomware in Serbia?

In Serbia, the most frequently targeted sectors are Energy & Utilities, Technology, Agriculture and Food Production. These industries hold valuable data and often have critical operational requirements that make them attractive ransomware targets.

How does Serbia rank globally for ransomware attacks?

Serbia ranks #81 globally for ransomware attacks with 12 victim disclosures, representing 0% of the worldwide total of 24,065 tracked victims.

How can organisations in Serbia protect against ransomware?

Organisations in Serbia should implement a layered security approach including regular offline backups, network segmentation, multi-factor authentication, endpoint detection and response (EDR) tools, and employee security awareness training. Monitoring threat intelligence feeds for active groups targeting Serbia is also recommended.