🎯 Threat Actors¶
Ransomware / extortion leaderboard by claimed victims (trailing 3 months). Flag shows attributed country of origin. Click any actor for its battle card.
🃏 Battle cards¶
Maintained from verifiable industry sources; refreshed by the daily routine.
🇷🇺 Qilin
Ransomware-as-a-Service
Ransomware-as-a-Service · #1 · 546 YTD
🇷🇺 The Gentlemen
Ransomware-as-a-Service
Ransomware-as-a-Service · #2 · 335 YTD
🇷🇺 Akira
Ransomware-as-a-Service
Ransomware-as-a-Service · #3 · 228 YTD
🇲🇾 DragonForce
Ransomware cartel (RaaS)
Ransomware cartel (RaaS) · #4 · 248 YTD
🇷🇺 LockBit
Ransomware-as-a-Service
Ransomware-as-a-Service · #5 · 335 YTD
🌐 SafePay
Ransomware
Ransomware · #6 · 537+ YTD
— Bavaqai
Ransomware
Ransomware · #7 · 30+ YTD
— NightSpire
Ransomware
Ransomware · #8 · 74 YTD
— Nova
Ransomware
Ransomware · #9
— BlackSuit
Ransomware-as-a-Service
Ransomware-as-a-Service · — YTD
🇷🇺 Cl0p
Ransomware / Data Extortion
Ransomware / Data Extortion · 160+ (Oracle EBS 103+ through Q1 2026; Cleo 97+ extortion wave; PTC Windchill/FlexPLM campaign 44+ named victims Q2–Q3 2026 incl. Shell, Philips, GE, FIS Global, Zebra Technologies, Fiserv) YTD
🇷🇺 INC Ransom
Ransomware-as-a-Service
Ransomware-as-a-Service · — YTD
— Interlock
Ransomware
Ransomware
— Lynx
Ransomware-as-a-Service
Ransomware-as-a-Service
— Medusa
Ransomware-as-a-Service
Ransomware-as-a-Service
— Play
Ransomware
Ransomware · 1200+ YTD
— RansomHub
Ransomware-as-a-Service
Ransomware-as-a-Service
🇨🇳 Salt Typhoon
Nation-state APT (espionage)
Nation-state APT (espionage)
🇺🇸🇬🇧 Scattered Spider
Data-extortion / social engineering
Data-extortion / social engineering
🇫🇷 ShinyHunters
Data-theft extortion
Data-theft extortion · 55+ YTD