Security Intelligence

Ransomware Groups

A directory of known ransomware threat groups. Browse active and historical groups, their tactics, and associated attacks.

Understanding Ransomware Threat Groups

The ransomware ecosystem is run by organized threat groups that operate like businesses — with affiliate programs, negotiation teams, and dedicated leak sites. Each group has its own tactics, preferred targets, and level of sophistication. Understanding who these actors are is essential for threat intelligence teams building detection rules, incident responders attributing an attack, and risk analysts evaluating exposure to specific adversaries.

This directory catalogs every known ransomware group tracked by the community, ranked by confirmed victim count. Use it to research a group’s history, compare their activity levels, and identify which threat actors are most active right now. If your organization or industry appears among a group’s recent victims, that is an immediate signal to harden defenses against their known techniques and tooling.