🎯 Threat Actors¶
Ransomware / extortion leaderboard ranked by recent leak-site activity in the last 9 days (since Jun 16), with each group's all-time victim total alongside (source: ransomware.live). Flag shows attributed country of origin. Click any actor for its battle card.
6
🏴☠️Icarus (tracked by some as UNC6395 (overlap disputed); extortion alias "mr bean"/"mb")
10 recent · 12 total
8
Stormous
8 recent · 185 total
9
Aurora
8 recent · 20 total
11
Krybit
6 recent · 56 total
12
Cmdorganization
6 recent · 25 total
13
🏴☠️ShinyHunters (UNC6240, "Scattered Lapsus$ Hunters" (claimed collective branding))
4 recent · 129 total
14
Pear (Pure Extraction And Ransom)
4 recent · 96 total
15
Payload
4 recent · 59 total
🃏 Battle cards¶
Maintained from verifiable industry sources; refreshed by the daily routine.
🇷🇺 LockBit
Ransomware-as-a-Service
Ransomware-as-a-Service · #1 · 311 total
🇷🇺 Qilin
Ransomware-as-a-Service
Ransomware-as-a-Service · #2 · 1947 total
Nova
Ransomware
Ransomware · #3 · 155 total
🇷🇺 The Gentlemen
Ransomware-as-a-Service
Ransomware-as-a-Service · #4 · 517 total
🇷🇺 Akira
Ransomware-as-a-Service
Ransomware-as-a-Service · #5 · 1531 total
🏴☠️ Icarus
Data-theft extortion
Data-theft extortion · #6 · 12 total
🇷🇺 INC Ransom
Ransomware-as-a-Service
Ransomware-as-a-Service · #7 · 836 total
SafePay
Ransomware
Ransomware · #10 · 503 total
🏴☠️ ShinyHunters
Data-theft extortion
Data-theft extortion · #13 · 129 total
Play
Ransomware
Ransomware · #16 · 1268 total
NightSpire
Ransomware
Ransomware · #18 · 296 total
🇲🇾 DragonForce
Ransomware cartel (RaaS)
Ransomware cartel (RaaS) · #22 · 582 total
🏴☠️ WorldLeaks
Data-theft extortion
Data-theft extortion · #24 · 169 total
Bavaqai
Ransomware
Ransomware
🇷🇺 Cl0p
Ransomware-as-a-Service
Ransomware-as-a-Service · 1254 total
🇨🇳 Salt Typhoon
Nation-state APT (espionage)
Nation-state APT (espionage)
🇺🇸🇬🇧 Scattered Spider
Data-extortion / social engineering
Data-extortion / social engineering