Russia
RURansomware victim intelligence profile · Ranked #47 globally · Updated: Sep 6, 2026
ThreatAI Analysis
Compiled from this database and the ransomware.live profiles of the groups active in Russia. Figures are computed from the tracked records, not inferred.
Russia ranks 47th globally for ransomware activity with 40 recorded victims, and notable groups like Auditteam and Warlock target sectors including technology and business services.
Russia in the global picture
Russia accounts for 43 of the ransomware disclosures tracked here, ranking #47 worldwide and making up 0.2% of the global total. The sectors listed most often are Technology, Business Services, Financial Services.
Who is most active in Russia
Auditteam — 10 victims in Russia. Warlock — 5 victims in Russia. The Warlock ransomware and operator(s) are believed to be attributed to Storm-2603, a China-based threat actor who is also known to have deployed LockBit ransomware. Chaos — 3 victims in Russia.
Ransomware Threat Profile: Russia
Russia ranks #47 globally for ransomware attacks, with 43 confirmed victims in this database — representing 0.2% of the worldwide total. The most active ransomware groups targeting Russia include Auditteam, Warlock, Chaos.
The most frequently targeted industries in Russia are Technology, Business Services, Financial Services. Manufacturing organisations are attractive targets because production downtime directly impacts revenue, creating strong incentives to restore operations by paying the ransom.
Russia's attack volume reflects broader trends in ransomware targeting: the volume of attacks reflects the country's integration into the global economy and the proliferation of ransomware operations that target organisations of all sizes worldwide.
Organisations in Russia should consider the active threat groups documented here when assessing their cybersecurity posture, implementing detection rules, and prioritising incident response planning.
Recent Victims in Russia (showing 43 of 43)
| # | Organization | Group | Sector | Date |
|---|---|---|---|---|
| 1 | mansurovogroup | Auditteam | Other | Sep 4, 2026 |
| 2 | Demidov Steel Group | Auditteam | Manufacturing | Aug 26, 2026 |
| 3 | ma***up | Auditteam | — | Aug 25, 2026 |
| 4 | Chernyy & Associates | Booba project | Professional Services | Aug 24, 2026 |
| 5 | De***up | Auditteam | — | Aug 18, 2026 |
| 6 | vit-best.com | Chaos | Education | Jul 27, 2026 |
| 7 | argonautms.com | Chaos | Technology | Jul 21, 2026 |
| 8 | argonautms.com | Chaos | Technology | Jul 21, 2026 |
| 9 | VASBE | Thegentlemen | Business Services | Jul 11, 2026 |
| 10 | URA Group | Booba project | Business Services | Jul 7, 2026 |
| 11 | I-SYS | Auditteam | Technology | Jun 25, 2026 |
| 12 | mihana-v.com | Dragonforce | — | Jun 22, 2026 |
| 13 | I-***YS | Auditteam | — | Jun 14, 2026 |
| 14 | sumerfaktoring.com | Lockbit5 | Financial Services | Jun 11, 2026 |
| 15 | FESCO Adecco | Thegentlemen | Business Services | Jun 8, 2026 |
| 16 | Paid Victim 111CEAA5AD9DA2F1 | Auditteam | — | Jun 4, 2026 |
| 17 | ca***lm | Auditteam | — | Jun 2, 2026 |
| 18 | On***de | Auditteam | — | May 28, 2026 |
| 19 | Paid Victim B35411691DDC2265 | Auditteam | — | May 28, 2026 |
| 20 | Hamister Group | Qilin | Business Services | May 26, 2026 |
| 21 | vilati.com | Lockbit5 | Manufacturing | Feb 23, 2026 |
| 22 | prommgroup.com | Lockbit5 | Business Services | Dec 26, 2025 |
| 23 | MSK | Silentransomgroup | Business Services | Nov 25, 2025 |
| 24 | bel.quadra.ru | Warlock | — | Nov 6, 2025 |
| 25 | energogroup.net | Warlock | Energy | Nov 6, 2025 |
| 26 | nartis.ru | Warlock | — | Nov 6, 2025 |
| 27 | siball.net | Warlock | Technology | Sep 23, 2025 |
| 28 | okan.ru | Warlock | Financial Services | Sep 8, 2025 |
| 29 | 099 ISP | Handala | Telecommunication | Jun 14, 2025 |
| 30 | rusindustries.com | Safepay | — | Jun 14, 2025 |
| 31 | Novosit | Play | — | May 5, 2025 |
| 32 | Synesis Surveillance System | Babuk2 | Technology | Mar 22, 2025 |
| 33 | Kotliva | Fog | Technology | Mar 6, 2025 |
| 34 | andreyevengineering.com | Ransomhub | Construction | Mar 3, 2025 |
| 35 | FASHION.PRI | Clop | Consumer Services | Feb 27, 2025 |
| 36 | FFL-GROUP.COM | Clop | Financial Services | Feb 27, 2025 |
| 37 | d2go.io | Clop | Technology | Feb 10, 2025 |
| 38 | kuzstu-nf.ru | Funksec | — | Jan 13, 2025 |
| 39 | Kazyon | Moneymessage | Business Services | Dec 13, 2024 |
| 40 | SMARTS-ENGINEER | Helldown | Technology | Nov 6, 2024 |
| 41 | Concord Management Services | Akira | Business Services | Sep 25, 2024 |
| 42 | level.game | Killsec | Technology | Aug 22, 2024 |
| 43 | vsexshop.ru | Werewolves | Business Services | Mar 13, 2024 |
Frequently Asked Questions
How many ransomware attacks have occurred in Russia?
Russia has recorded 43 ransomware victim disclosures in this database, ranking #47 globally. This represents 0.2% of all tracked ransomware attacks worldwide.
Which ransomware groups target Russia?
The ransomware groups most active in Russia are Auditteam, Warlock, Chaos, Lockbit5. These groups collectively account for the majority of victim disclosures attributed to Russia.
Which industries are most targeted by ransomware in Russia?
In Russia, the most frequently targeted sectors are Technology, Business Services, Financial Services. These industries hold valuable data and often have critical operational requirements that make them attractive ransomware targets.
How does Russia rank globally for ransomware attacks?
Russia ranks #47 globally for ransomware attacks with 43 victim disclosures, representing 0.2% of the worldwide total of 21,388 tracked victims.
How can organisations in Russia protect against ransomware?
Organisations in Russia should implement a layered security approach including regular offline backups, network segmentation, multi-factor authentication, endpoint detection and response (EDR) tools, and employee security awareness training. Monitoring threat intelligence feeds for active groups targeting Russia is also recommended.