Russia
RURansomware victim intelligence profile · Ranked #51 globally · Updated: May 11, 2026
Ransomware Threat Profile: Russia
Russia ranks #51 globally for ransomware attacks, with 23 confirmed victims in this database — representing 0.1% of the worldwide total. The most active ransomware groups targeting Russia include Warlock, Clop, Lockbit5.
The most frequently targeted industries in Russia are Technology, Business Services, Financial Services. Manufacturing organisations are attractive targets because production downtime directly impacts revenue, creating strong incentives to restore operations by paying the ransom.
Russia's attack volume reflects broader trends in ransomware targeting: the volume of attacks reflects the country's integration into the global economy and the proliferation of ransomware operations that target organisations of all sizes worldwide.
Organisations in Russia should consider the active threat groups documented here when assessing their cybersecurity posture, implementing detection rules, and prioritising incident response planning.
Recent Victims in Russia (20 cached of 23 total)
| # | Organization | Group | Sector | Date |
|---|---|---|---|---|
| 1 | vilati.com | Lockbit5 | Manufacturing | Feb 23, 2026 |
| 2 | prommgroup.com | Lockbit5 | Business Services | Dec 26, 2025 |
| 3 | MSK | Silentransomgroup | Business Services | Nov 25, 2025 |
| 4 | energogroup.net | Warlock | Energy | Nov 6, 2025 |
| 5 | bel.quadra.ru | Warlock | — | Nov 6, 2025 |
| 6 | nartis.ru | Warlock | — | Nov 6, 2025 |
| 7 | siball.net | Warlock | Technology | Sep 23, 2025 |
| 8 | okan.ru | Warlock | Financial Services | Sep 8, 2025 |
| 9 | 099 ISP | Handala | Telecommunication | Jun 14, 2025 |
| 10 | rusindustries.com | Safepay | — | Jun 14, 2025 |
| 11 | Novosit | Play | — | May 5, 2025 |
| 12 | Synesis Surveillance System | Babuk2 | Technology | Mar 22, 2025 |
| 13 | Kotliva | Fog | Technology | Mar 6, 2025 |
| 14 | andreyevengineering.com | Ransomhub | Construction | Mar 3, 2025 |
| 15 | FASHION.PRI | Clop | Consumer Services | Feb 27, 2025 |
| 16 | FFL-GROUP.COM | Clop | Financial Services | Feb 27, 2025 |
| 17 | d2go.io | Clop | Technology | Feb 10, 2025 |
| 18 | kuzstu-nf.ru | Funksec | — | Jan 13, 2025 |
| 19 | Kazyon | Moneymessage | Business Services | Dec 13, 2024 |
| 20 | SMARTS-ENGINEER | Helldown | Technology | Nov 6, 2024 |
Frequently Asked Questions
How many ransomware attacks have occurred in Russia?
Russia has recorded 23 ransomware victim disclosures in this database, ranking #51 globally. This represents 0.1% of all tracked ransomware attacks worldwide.
Which ransomware groups target Russia?
The ransomware groups most active in Russia are Warlock, Clop, Lockbit5, Silentransomgroup. These groups collectively account for the majority of victim disclosures attributed to Russia.
Which industries are most targeted by ransomware in Russia?
In Russia, the most frequently targeted sectors are Technology, Business Services, Financial Services. These industries hold valuable data and often have critical operational requirements that make them attractive ransomware targets.
How does Russia rank globally for ransomware attacks?
Russia ranks #51 globally for ransomware attacks with 23 victim disclosures, representing 0.1% of the worldwide total of 17,781 tracked victims.
How can organisations in Russia protect against ransomware?
Organisations in Russia should implement a layered security approach including regular offline backups, network segmentation, multi-factor authentication, endpoint detection and response (EDR) tools, and employee security awareness training. Monitoring threat intelligence feeds for active groups targeting Russia is also recommended.