Ransomware groups

A group appears here once it has published at least one victim on a leak site monitored by ransomware.live. Counts are leak-site listings, not confirmed intrusions: groups sometimes re-list old victims, claim attacks carried out by affiliates of other programmes, or rebrand under a new name, which splits their history across two entries.

“Last seen” is the most recent listing date. A group with no listings in the last 30 days may be dormant, rebranding, or simply between campaigns. Each profile page lists every victim on record for that group.