Threat Actor Database
alphv
CriticalThe operators of the ALPHV/BlackCat ransomware began their activity in December 2021, making posts on Dark Web forums t…
bianlian
CriticalBianLian ransomware operations began in late 2021. The group practices multi-pronged extortion, demanding payment for a…
blackbasta
Critical"Black Basta" is a new ransomware strain discovered during April 2022 - looks in dev since at least early February 2022…
clop
CriticalThe ransomware group known as Cl0p is a variant of a previously known strain dubbed CryptoMix. It is worth noting that …
dragonforce
Criticalincransom
Criticallockbit2
Criticallockbit3
CriticalLockBit, also recognized as LockBit Black or Lockbit 3.0, is one of the largest Ransomware Groups in the world and has …
medusa
Criticalqilin
CriticalQilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryp…
ransomhub
CriticalThe group emerged in mid-February 2024 and has already listed several organizations as alleged victims of their attacks…
8base
HighThe 8base Ransomware group made its first appearance in early March 2022, remaining somewhat quiet after the attacks. T…
ALLANITE
HighALLANITEis a suspected Russian cyber espionage group, that has primarily targeted the electric utility sector within th…
APT-C-23
HighAPT-C-23is a threat group that has been active since at least 2014.[1]APT-C-23has primarily focused its operations on t…
APT-C-36
HighAPT-C-36is a suspected South American threat group that has engaged in espionage and financially motivated operations s…
APT1
HighAPT1is a Chinese threat group that has been attributed to the 2nd Bureau of the People’s Liberation Army (PLA) General …
APT12
HighAPT12is a threat group that has been attributed to China. The group has targeted a variety of victims including but not…
APT16
HighAPT16is a China-based threat group that has launched spearphishing campaigns targeting Japanese and Taiwanese organizat…
APT17
HighAPT17is a China-based threat group that has conducted network intrusions against U.S. government entities, the defense …
APT18
HighAPT18is a threat group that has operated since at least 2009 and has targeted a range of industries, including technolo…
APT19
HighAPT19is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pha…
APT28
HighAPT28is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main…
APT29
HighAPT29is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).[1][2]They have operated s…
APT3
HighAPT3is a China-based threat group that researchers have attributed to China's Ministry of State Security.[1][2]This gro…
APT30
HighAPT30is a threat group suspected to be associated with the Chinese government. WhileNaikonshares some characteristics w…
APT32
HighAPT32is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multipl…
APT33
HighAPT33is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted or…
APT34
HighAPT37
HighAPT37is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has ta…
APT38
High[APT38](https://attack.mitre.org/groups/G0082) is a North Korean state-sponsored threat group that specializes in finan…
APT39
High[APT39](https://attack.mitre.org/groups/G0087) is one of several names for cyber espionage activity conducted by the Ir…
APT41
High[APT41](https://attack.mitre.org/groups/G0096) is a threat group that researchers have assessed as Chinese state-sponso…
APT42
High[APT42](https://attack.mitre.org/groups/G1044) is an Iranian-sponsored threat group that conducts cyber espionage and s…
APT5
High[APT5](https://attack.mitre.org/groups/G1023) is a China-based espionage actor that has been active since at least 2007…
Agrius
HighAgriusis an Iranian threat actor active since 2020 notable for a series of ransomware and wiper operations in the Middl…
Ajax Security Team
HighAjax Security Teamis a group that has been active since at least 2010 and believed to be operating out of Iran. By 2014…
Akira
HighAkirais a ransomware variant and ransomware deployment entity active since at least March 2023.[1]Akirauses compromised…
Andariel
HighAndarielis a North Korean state-sponsored threat group that has been active since at least 2009.Andarielhas primarily f…
Aoqin Dragon
HighAoqin Dragonis a suspected Chinese cyber espionage threat group that has been active since at least 2013.Aoqin Dragonha…
AppleJeus
HighAppleJeusis a North Korean state-sponsored threat group attributed to the Reconnaissance General Bureau. Associated wit…
Aquatic Panda
High[Aquatic Panda](https://attack.mitre.org/groups/G0143) is a suspected China-based threat group with a dual mission of i…
Axiom
High[Axiom](https://attack.mitre.org/groups/G0001) is a suspected Chinese cyber espionage group that has targeted the aeros…
BITTER
High[BITTER](https://attack.mitre.org/groups/G1002) is a suspected South Asian cyber espionage threat group that has been a…
BRONZE BUTLER
High[BRONZE BUTLER](https://attack.mitre.org/groups/G0060) is a cyber espionage group with likely Chinese origins that has …
BackdoorDiplomacy
High[BackdoorDiplomacy](https://attack.mitre.org/groups/G0135) is a cyber espionage threat group that has been active since…
BlackByte
High[BlackByte](https://attack.mitre.org/groups/G1043) is a ransomware threat actor operating since at least 2021. [BlackBy…
BlackOasis
High[BlackOasis](https://attack.mitre.org/groups/G0063) is a Middle Eastern threat group that is believed to be a customer …
BlackTech
High[BlackTech](https://attack.mitre.org/groups/G0098) is a suspected Chinese cyber espionage group that has primarily targ…
Blue Mockingbird
High[Blue Mockingbird](https://attack.mitre.org/groups/G0108) is a cluster of observed activity involving Monero cryptocurr…
CURIUM
High[CURIUM](https://attack.mitre.org/groups/G1012) is an Iranian threat group, first reported in September 2019 and active…
Carbanak
High[Carbanak](https://attack.mitre.org/groups/G0008) is a cybercriminal group that has used [Carbanak](https://attack.mitr…
Charming Kitten
High[Charming Kitten](https://attack.mitre.org/groups/G0058) is an Iranian cyber espionage group that has been active since…
Chimera
High[Chimera](https://attack.mitre.org/groups/G0114) is a suspected China-based threat group that has been active since at …
Cinnamon Tempest
High[Cinnamon Tempest](https://attack.mitre.org/groups/G1021) is a China-based threat group that has been active since at l…
Cleaver
High[Cleaver](https://attack.mitre.org/groups/G0003) is a threat group that has been attributed to Iranian actors and is re…
Cobalt Group
High[Cobalt Group](https://attack.mitre.org/groups/G0080) is a financially motivated threat group that has primarily target…
Confucius
High[Confucius](https://attack.mitre.org/groups/G0142) is a cyber espionage group that has primarily targeted military pers…
Contagious Interview
High[Contagious Interview](https://attack.mitre.org/groups/G1052) is a North Korea–aligned threat group active since 2023. …
CopyKittens
High[CopyKittens](https://attack.mitre.org/groups/G0052) is an Iranian cyber espionage group that has been operating since …
CostaRicto
High[CostaRicto](https://attack.mitre.org/groups/G0132) is a suspected hacker-for-hire cyber espionage campaign that has ta…
Daggerfly
High[Daggerfly](https://attack.mitre.org/groups/G1034) is a People's Republic of China-linked APT entity active since at le…
Dark Caracal
High[Dark Caracal](https://attack.mitre.org/groups/G0070) is threat group that has been attributed to the Lebanese General …
DarkHydrus
High[DarkHydrus](https://attack.mitre.org/groups/G0079) is a threat group that has targeted government agencies and educati…
DarkVishnya
High[DarkVishnya](https://attack.mitre.org/groups/G0105) is a financially motivated threat actor targeting financial instit…
Darkhotel
High[Darkhotel](https://attack.mitre.org/groups/G0012) is a suspected South Korean threat group that has targeted victims p…
Deep Panda
High[Deep Panda](https://attack.mitre.org/groups/G0009) is a suspected Chinese threat group known to target many industries…
DragonOK
High[DragonOK](https://attack.mitre.org/groups/G0017) is a threat group that has targeted Japanese organizations with phish…
Dragonfly
High[Dragonfly](https://attack.mitre.org/groups/G0035) is a cyber espionage group that has been attributed to Russia's Fede…
Dragonfly 2.0
High[Dragonfly 2.0](https://attack.mitre.org/groups/G0074) is a suspected Russian group that has targeted government entiti…
Dust Storm
High[Dust Storm](https://attack.mitre.org/groups/G0031) is a threat group that has targeted multiple industries in Japan, S…
EXOTIC LILY
High[EXOTIC LILY](https://attack.mitre.org/groups/G1011) is a financially motivated group that has been closely linked with…
Earth Lusca
High[Earth Lusca](https://attack.mitre.org/groups/G1006) is a suspected China-based cyber espionage group that has been act…
Elderwood
High[Elderwood](https://attack.mitre.org/groups/G0066) is a suspected Chinese cyber espionage group that was reportedly res…
Ember Bear
High[Ember Bear](https://attack.mitre.org/groups/G1003) is a Russian state-sponsored cyber espionage group that has been ac…
Equation
High[Equation](https://attack.mitre.org/groups/G0020) is a sophisticated threat group that employs multiple remote access t…
Evilnum
High[Evilnum](https://attack.mitre.org/groups/G0120) is a financially motivated threat group that has been active since at …
FIN10
High[FIN10](https://attack.mitre.org/groups/G0051) is a financially motivated threat group that has targeted organizations …
FIN13
High[FIN13](https://attack.mitre.org/groups/G1016) is a financially motivated cyber threat group that has targeted the fina…
FIN4
High[FIN4](https://attack.mitre.org/groups/G0085) is a financially-motivated threat group that has targeted confidential in…
FIN5
High[FIN5](https://attack.mitre.org/groups/G0053) is a financially motivated threat group that has targeted personally iden…
FIN6
High[FIN6](https://attack.mitre.org/groups/G0037) is a cyber crime group that has stolen payment card data and sold it for …
FIN7
High[FIN7](https://attack.mitre.org/groups/G0046) is a financially-motivated threat group that has been active since 2013. …
FIN8
High[FIN8](https://attack.mitre.org/groups/G0061) is a financially motivated threat group that has been active since at lea…
Ferocious Kitten
High[Ferocious Kitten](https://attack.mitre.org/groups/G0137) is a threat group that has primarily targeted Persian-speakin…
Fox Kitten
High[Fox Kitten](https://attack.mitre.org/groups/G0117) is threat actor with a suspected nexus to the Iranian government th…
Frankenstein
High[Frankenstein](https://attack.mitre.org/groups/G0101) is a campaign carried out between January and April 2019 by unkno…
GALLIUM
High[GALLIUM](https://attack.mitre.org/groups/G0093) is a cyberespionage group that has been active since at least 2012, pr…
GCMAN
High[GCMAN](https://attack.mitre.org/groups/G0036) is a threat group that focuses on targeting banks for the purpose of tra…
GOLD SOUTHFIELD
High[GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) is a financially motivated threat group active since at least …
Gallmaker
High[Gallmaker](https://attack.mitre.org/groups/G0084) is a cyberespionage group that has targeted victims in the Middle Ea…
Gamaredon Group
High[Gamaredon Group](https://attack.mitre.org/groups/G0047) is a suspected Russian cyber espionage group that has targeted…
Gelsemium
High[Gelsemium](https://attack.mitre.org/groups/G0141) is a cyberespionage group that has been active since at least 2014, …
Gorgon Group
High[Gorgon Group](https://attack.mitre.org/groups/G0078) is a threat group consisting of members who are suspected to be P…
Group5
High[Group5](https://attack.mitre.org/groups/G0043) is a threat group with a suspected Iranian nexus, though this attributi…
HAFNIUM
High[HAFNIUM](https://attack.mitre.org/groups/G0125) is a likely state-sponsored cyber espionage group operating out of Chi…
HEXANE
High[HEXANE](https://attack.mitre.org/groups/G1001) is a cyber espionage threat group that has targeted oil & gas, telecomm…
Higaisa
High[Higaisa](https://attack.mitre.org/groups/G0126) is a threat group suspected to have South Korean origins. [Higaisa](ht…
Honeybee
High[Honeybee](https://attack.mitre.org/groups/G0072) is a campaign led by an unknown actor that targets humanitarian aid o…
INC Ransom
High[INC Ransom](https://attack.mitre.org/groups/G1032) is a ransomware and data extortion threat group associated with the…
Inception
High[Inception](https://attack.mitre.org/groups/G0100) is a cyber espionage group active since at least 2014. The group has…
IndigoZebra
High[IndigoZebra](https://attack.mitre.org/groups/G0136) is a suspected Chinese cyber espionage group that has been targeti…
Indrik Spider
High[Indrik Spider](https://attack.mitre.org/groups/G0119) is a Russia-based cybercriminal group that has been active since…
Ke3chang
High[Ke3chang](https://attack.mitre.org/groups/G0004) is a threat group attributed to actors operating out of China. [Ke3ch…
Kimsuky
High[Kimsuky](https://attack.mitre.org/groups/G0094) is a North Korea-based cyber espionage group that has been active sinc…
LAPSUS$
High[LAPSUS$](https://attack.mitre.org/groups/G1004) is cyber criminal threat group that has been active since at least mid…
Lazarus Group
High[Lazarus Group](https://attack.mitre.org/groups/G0032) is a North Korean state-sponsored cyber threat group attributed …
LazyScripter
High[LazyScripter](https://attack.mitre.org/groups/G0140) is threat group that has mainly targeted the airlines industry si…
Leafminer
High[Leafminer](https://attack.mitre.org/groups/G0077) is an Iranian threat group that has targeted government organization…
Leviathan
High[Leviathan](https://attack.mitre.org/groups/G0065) is a Chinese state-sponsored cyber espionage group that has been att…
Lotus Blossom
High[Lotus Blossom](https://attack.mitre.org/groups/G0030) is a long-standing threat group largely targeting various entiti…
LuminousMoth
High[LuminousMoth](https://attack.mitre.org/groups/G1014) is a Chinese-speaking cyber espionage group that has been active …
MONSOON
HighMachete
High[Machete](https://attack.mitre.org/groups/G0095) is a suspected Spanish-speaking cyber espionage group that has been ac…
Magic Hound
High[Magic Hound](https://attack.mitre.org/groups/G0059) is an Iranian-sponsored threat group that conducts long term, reso…
Malteiro
High[Malteiro](https://attack.mitre.org/groups/G1026) is a financially motivated criminal group that is likely based in Bra…
Medusa Group
High[Medusa Group](https://attack.mitre.org/groups/G1051) has been active since at least 2021 and was initially operated as…
Metador
High[Metador](https://attack.mitre.org/groups/G1013) is a suspected cyber espionage group that was first reported in Septem…
Moafee
High[Moafee](https://attack.mitre.org/groups/G0002) is a threat group that appears to operate from the Guandong Province of…
Mofang
High[Mofang](https://attack.mitre.org/groups/G0103) is a likely China-based cyber espionage group, named for its frequent p…
Molerats
High[Molerats](https://attack.mitre.org/groups/G0021) is an Arabic-speaking, politically-motivated threat group that has be…
Moonstone Sleet
High[Moonstone Sleet](https://attack.mitre.org/groups/G1036) is a North Korean-linked threat actor executing both financial…
Moses Staff
High[Moses Staff](https://attack.mitre.org/groups/G1009) is a suspected Iranian threat group that has primarily targeted Is…
MoustachedBouncer
High[MoustachedBouncer](https://attack.mitre.org/groups/G1019) is a cyberespionage group that has been active since at leas…
MuddyWater
High[MuddyWater](https://attack.mitre.org/groups/G0069) is a cyber espionage group assessed to be a subordinate element wit…
Mustang Panda
High[Mustang Panda](https://attack.mitre.org/groups/G0129) is a China-based cyber espionage threat actor that has been cond…
Mustard Tempest
High[Mustard Tempest](https://attack.mitre.org/groups/G1020) is an initial access broker that has operated the [SocGholish]…
NEODYMIUM
High[NEODYMIUM](https://attack.mitre.org/groups/G0055) is an activity group that conducted a campaign in May 2016 and has h…
Naikon
High[Naikon](https://attack.mitre.org/groups/G0019) is assessed to be a state-sponsored cyber espionage group attributed to…
Night Dragon
High[Night Dragon](https://attack.mitre.org/groups/G0014) is a campaign name for activity involving a threat group that has…
Nomadic Octopus
High[Nomadic Octopus](https://attack.mitre.org/groups/G0133) is a Russian-speaking cyber espionage threat group that has p…
OilRig
High[OilRig](https://attack.mitre.org/groups/G0049) is a suspected Iranian threat group that has targeted Middle Eastern an…
Operation Wocao
High[Operation Wocao](https://attack.mitre.org/groups/G0116) described activities carried out by a China-based cyber espion…
Orangeworm
High[Orangeworm](https://attack.mitre.org/groups/G0071) is a group that has targeted organizations in the healthcare sector…
PLATINUM
High[PLATINUM](https://attack.mitre.org/groups/G0068) is an activity group that has targeted victims since at least 2009. T…
POLONIUM
High[POLONIUM](https://attack.mitre.org/groups/G1005) is a Lebanon-based group that has primarily targeted Israeli organiza…
PROMETHIUM
High[PROMETHIUM](https://attack.mitre.org/groups/G0056) is an activity group focused on espionage that has been active sinc…
Patchwork
High[Patchwork](https://attack.mitre.org/groups/G0040) is a cyber espionage group that was first observed in December 2015.…
PittyTiger
High[PittyTiger](https://attack.mitre.org/groups/G0011) is a threat group believed to operate out of China that uses multip…
Play
High[Play](https://attack.mitre.org/groups/G1040) is a ransomware group that has been active since at least 2022 deploying …
Poseidon Group
High[Poseidon Group](https://attack.mitre.org/groups/G0033) is a Portuguese-speaking threat group that has been active sinc…
Putter Panda
High[Putter Panda](https://attack.mitre.org/groups/G0024) is a Chinese threat group that has been attributed to Unit 61486 …
RTM
High[RTM](https://attack.mitre.org/groups/G0048) is a cybercriminal group that has been active since at least 2015 and is p…
Rancor
High[Rancor](https://attack.mitre.org/groups/G0075) is a threat group that has led targeted campaigns against the South Eas…
RedCurl
High[RedCurl](https://attack.mitre.org/groups/G1039) is a threat actor active since 2018 notable for corporate espionage ta…
RedEcho
High[RedEcho](https://attack.mitre.org/groups/G1042) is a People’s Republic of China-related threat actor associated with l…
Rocke
High[Rocke](https://attack.mitre.org/groups/G0106) is an alleged Chinese-speaking adversary whose primary objective appeare…
Saint Bear
High[Saint Bear](https://attack.mitre.org/groups/G1031) is a Russian-nexus threat actor active since early 2021, primarily …
Salt Typhoon
High[Salt Typhoon](https://attack.mitre.org/groups/G1045) is a People's Republic of China (PRC) state-backed actor that has…
Sandworm Team
High[Sandworm Team](https://attack.mitre.org/groups/G0034) is a destructive threat group that has been attributed to Russia…
Scarlet Mimic
High[Scarlet Mimic](https://attack.mitre.org/groups/G0029) is a threat group that has targeted minority rights activists. T…
Scattered Spider
High[Scattered Spider](https://attack.mitre.org/groups/G1015) is a native English-speaking cybercriminal group active since…
Sea Turtle
High[Sea Turtle](https://attack.mitre.org/groups/G1041) is a Türkiye-linked threat actor active since at least 2017 perform…
Sharpshooter
HighOperation [Sharpshooter](https://attack.mitre.org/groups/G0104) is the name of a cyber espionage campaign discovered in…
SideCopy
High[SideCopy](https://attack.mitre.org/groups/G1008) is a Pakistani threat group that has primarily targeted South Asian c…
Sidewinder
High[Sidewinder](https://attack.mitre.org/groups/G0121) is a suspected Indian threat actor group that has been active since…
Silence
High[Silence](https://attack.mitre.org/groups/G0091) is a financially motivated threat actor targeting financial institutio…
Silent Librarian
High[Silent Librarian](https://attack.mitre.org/groups/G0122) is a group that has targeted research and proprietary data at…
SilverTerrier
High[SilverTerrier](https://attack.mitre.org/groups/G0083) is a Nigerian threat group that has been seen active since 2014.…
Sowbug
High[Sowbug](https://attack.mitre.org/groups/G0054) is a threat group that has conducted targeted attacks against organizat…
Star Blizzard
High[Star Blizzard](https://attack.mitre.org/groups/G1033) is a cyber espionage and influence group originating in Russia t…
Stealth Falcon
High[Stealth Falcon](https://attack.mitre.org/groups/G0038) is a threat group that has conducted targeted spyware attacks a…
Stolen Pencil
High[Stolen Pencil](https://attack.mitre.org/groups/G0086) is a threat group likely originating from DPRK that has been act…
Storm-0501
High[Storm-0501](https://attack.mitre.org/groups/G1053) is a financially motivated cyber criminal group that uses commodity…
Storm-1811
High[Storm-1811](https://attack.mitre.org/groups/G1046) is a financially-motivated entity linked to [Black Basta](https://a…
Strider
High[Strider](https://attack.mitre.org/groups/G0041) is a threat group that has been active since at least 2011 and has tar…
Suckfly
High[Suckfly](https://attack.mitre.org/groups/G0039) is a China-based threat group that has been active since at least 2014…
TA2541
High[TA2541](https://attack.mitre.org/groups/G1018) is a cybercriminal group that has been targeting the aviation, aerospac…
TA459
High[TA459](https://attack.mitre.org/groups/G0062) is a threat group believed to operate out of China that has targeted cou…
TA505
High[TA505](https://attack.mitre.org/groups/G0092) is a cyber criminal group that has been active since at least 2014. [TA5…
TA551
High[TA551](https://attack.mitre.org/groups/G0127) is a financially-motivated threat group that has been active since at le…
TA577
High[TA577](https://attack.mitre.org/groups/G1037) is an initial access broker (IAB) that has distributed [QakBot](https://…
TA578
High[TA578](https://attack.mitre.org/groups/G1038) is a threat actor that has used contact forms and email to initiate comm…
TEMP.Veles
High[TEMP.Veles](https://attack.mitre.org/groups/G0088) is a Russia-based threat group that has targeted critical infrastru…
Taidoor
High[Taidoor](https://attack.mitre.org/groups/G0015) has been deprecated, as the only technique it was linked to was deprec…
TeamTNT
High[TeamTNT](https://attack.mitre.org/groups/G0139) is a threat group that has primarily targeted cloud and containerized …
The White Company
High[The White Company](https://attack.mitre.org/groups/G0089) is a likely state-sponsored threat actor with advanced capab…
Threat Group-1314
High[Threat Group-1314](https://attack.mitre.org/groups/G0028) is an unattributed threat group that has used compromised cr…
Threat Group-3390
High[Threat Group-3390](https://attack.mitre.org/groups/G0027) is a Chinese threat group that has extensively used strategi…
Thrip
High[Thrip](https://attack.mitre.org/groups/G0076) is an espionage group that has targeted satellite communications, teleco…
ToddyCat
High[ToddyCat](https://attack.mitre.org/groups/G1022) is a sophisticated threat group that has been active since at least 2…
Tonto Team
High[Tonto Team](https://attack.mitre.org/groups/G0131) is a suspected Chinese state-sponsored cyber espionage threat group…
Transparent Tribe
High[Transparent Tribe](https://attack.mitre.org/groups/G0134) is a suspected Pakistan-based threat group that has been act…
Tropic Trooper
High[Tropic Trooper](https://attack.mitre.org/groups/G0081) is an unaffiliated threat group that has led targeted campaigns…
Turla
High[Turla](https://attack.mitre.org/groups/G0010) is a cyber espionage threat group that has been attributed to Russia's F…
UNC2452
High[UNC2452](https://attack.mitre.org/groups/G0118) is a suspected Russian state-sponsored threat group responsible for th…
UNC3886
High[UNC3886](https://attack.mitre.org/groups/G1048) is a China-nexus cyberespionage group that has been active since at le…
Velvet Ant
High[Velvet Ant](https://attack.mitre.org/groups/G1047) is a threat actor operating since at least 2021. [Velvet Ant](https…
Volatile Cedar
High[Volatile Cedar](https://attack.mitre.org/groups/G0123) is a Lebanese threat group that has targeted individuals, compa…
Volt Typhoon
High[Volt Typhoon](https://attack.mitre.org/groups/G1017) is a People's Republic of China (PRC) state-sponsored actor that …
WIRTE
High[WIRTE](https://attack.mitre.org/groups/G0090) is a threat group that has been active since at least August 2018. [WIRT…
Water Galura
High[Water Galura](https://attack.mitre.org/groups/G1050) are the operators of the [Qilin](https://attack.mitre.org/softwar…
Whitefly
High[Whitefly](https://attack.mitre.org/groups/G0107) is a cyber espionage group that has been operating since at least 201…
Windigo
HighThe [Windigo](https://attack.mitre.org/groups/G0124) group has been operating since at least 2011, compromising thousan…
Windshift
High[Windshift](https://attack.mitre.org/groups/G0112) is a threat group that has been active since at least 2017, targetin…
Winnti Group
High[Winnti Group](https://attack.mitre.org/groups/G0044) is a threat group with Chinese origins that has been active since…
Winter Vivern
HighWinter Vivern is a group linked to Russian and Belorussian interests active since at least 2020 targeting various Europ…
Wizard Spider
High[Wizard Spider](https://attack.mitre.org/groups/G0102) is a Russia-based financially motivated threat group originally …
ZIRCONIUM
High[ZIRCONIUM](https://attack.mitre.org/groups/G0128) is a threat group operating out of China, active since at least 2017…
admin@338
Highadmin@338is a China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and …
apt73
HighA new ransomware group is said to have emerged in mid-April 2024, under the name 'APT73.' It's worth noting that the gr…
avaddon
HighAvaddon is a ransomware malware targeting Windows systems often spread via malicious spam. The first known attack where…
babuk2
HighBabuk Locker 2.0, also known as Bjorka or SkyWave, after failing to make any profit from selling public databases on fo…
blacksuit
HighAccording to Trend Micro, this ransomware has significant code overlap with Royal Ransomware.
cactus
HighThe CACTUS ransomware is said to have emerged around March 2023. The group became known for exploiting vulnerabilities …
cloak
Highcoinbasecartel
HighCoinbaseCartel specializes in data acquisition through system access and strategic partnerships. It focus exclusively o…
conti
HighConti is an extremely damaging ransomware due to the speed with which it encrypts data and spreads to other systems. It…
cuba
HighThe Cuba Ransomware, also known as Colddraw Ransomware, was first identified in the threat landscape in 2019 and built …
devman
HighFormer RansomHub and INC Ransom affiliate.
dispossessor
HighThis is not a ransomware group but a data broker
eldorado
HighIn September The El Dorado ransomware group have been rebrand as BlackLock
everest
HighEverest ransom group collects and analyzes information about their victims. They specialize in customer privacy data, f…
fog
HighFog, which uses the .flocked extension for encrypted files, was first observed in May in campaigns by Storm-0844, a thr…
funksec
Highhandala
HighNot a Ransomware Group
hive
HighHive is a strain of ransomware that was first discovered in June 2021. Hive was designed to be used by Ransomware-as-a-…
hunters
HighIn mid-October 2023, just a few days before the Europol operation, the source code of the Ransomware Hive was sold, alo…
interlock
Highkillsec
Highlockbit5
Highlynx
Highmalas
HighmenuPass
High[menuPass](https://attack.mitre.org/groups/G0045) is a threat group that has been active since at least 2006. Individua…
meow
Highmonti
Highnightspire
Highnoescape
Highnova
HighNova (formerly RALord) is a ransomware-as-a-service (RaaS) group that encrypts victims’files and uses double-extortion …
pysa
HighMespinosa is a ransomware which encrypts file using an asymmetric encryption and adds .pysa as file extension. Accordin…
ragnarlocker
Highransomhouse
Highraworld
HighRA Group, also known as RA World, first surfaced in April 2023, utilizing a custom variant of the Babuk ransomware.
rhysida
HighRhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware th…
royal
HighAccording to Trendmicro, Royal ransomware was first observed in September 2022, and the threat actors behind it are bel…
safepay
Highsarcoma
Highsilentransomgroup
Higha former Conti team
sinobi
Highsnatch
HighSnatch is a ransomware which infects victims by rebooting the PC into Safe Mode. Most of the existing security protecti…
spacebears
Highstormous
Highthegentlemen
Hightoufan
HighPro-Palestinian Group
vicesociety
HighVice Society ransomware appends the .v-society extension when encrypting Linux machines. Running a leak site on the dar…
worldleaks
HighWorld Leaks emerged in January 2025 as a rebrand of the Hunters International ransomware operation, shifting its focus …
abyss
Mediumailock
Mediumalp-001
Medium⚠️ The group appears unreliable. Most, if not all, of its alleged victims cannot be verified. WE HAVE DECIDED TO REMOVE…
alphalocker
Mediumanubis
Mediumapos
Mediumarcusmedia
Mediumargonauts
Mediumarvinclub
Mediumavoslocker
Mediumbeast
MediumBeast is a Ransomware-as-a-service (RaaS) product which provides functionality such as SMB scanning, file encryption, s…
benzona
Mediumblacklock
MediumBlackLock is a rebranded version of another ransomware group known as Eldorado. It has since become one of the most act…
blackmatter
MediumRansomware-as-a-Service
blacknevas
Mediumblackshrantac
Mediumbraincipher
MediumBrain Cipher emerged in July 2024. Both Windows and Linux variants are available. Brain Cipher using the leaked build o…
bravox
Mediumbrotherhood
Mediumcephalus
Mediumchaos
Mediumcheers
Mediumcicada3301
Mediumciphbit
Mediumcrazyhunter
Mediumcryp70n1c0d3
Mediumcrypto24
Mediumd4rk4rmy
Mediumdaixin
Mediumdan0n
Mediumdarkleakmarket
Mediumdarkpower
Mediumdarkrace
Mediumdarkside
MediumDarkside ransomware group has started its operation in August of 2020 with the model of RaaS (Ransomware-as-a-Service).…
darkvault
Mediumdatacarry
Mediumdirewolf
Mediumdonutleaks
Mediumdoppelpaymer
MediumDoppelpaymer is a ransomware family that encrypts user data and later on it asks for a ransom in order to restore origi…
dragonransomware
MediumDragon Ransomware, is promising rapid and customizable ransomware operations for Windows systems. Key features include …
dunghill
Mediumembargo
Mediumflocker
Mediumfrag
Mediumfreecivilian
Mediumgenesis
Mediumglobal
Mediumgroove
Mediumgunra
Mediumhellcat
Mediumhelldown
Mediumicefire
Mediumimncrew
Mediuminsomnia
Mediumj
Mediumkairos
Mediumkarakurt
Mediumkawa4096
Mediumkelvinsecurity
Mediumknight
Medium[Cyclops](group/cyclops) rebrand
kraken
Mediumkrybit
Mediumlamashtu
Mediumleaktheanalyst
Mediumlorenz
MediumTesorion describes Lorenz as a ransomware with design and implementation flaws, leading to impossible decryption with t…
losttrust
Mediumlv
MediumLV ransomware group main message: "Here are companies which didn't meet consumer data protection obligations. They reje…
madliberator
Mediummallox
MediumThis ransomware uses a combination of different crypto algorithms (ChaCha20, AES-128, Curve25519). The activity of this…
marketo
Mediummaze
MediumMaze ransomware group is one of the most known ransomware gangs, they targeted organizations worldwide across many indu…
medusalocker
MediumMedusa is a DDoS bot written in .NET 2.0. In its current incarnation its C&C protocol is based on HTTP, while its prede…
metaencryptor
Mediummidas
MediumThis malware written in C# is a variant of the Thanos ransomware family and emerged in October 2021 and is obfuscated u…
mindware
MediumRansomware, potential rebranding of win.sfile.
moneymessage
Mediummorpheus
Mediummosesstaff
MediumCybereason Nocturnus describes Moses Staff as an Iranian hacker group, first spotted in October 2021. Their motivation …
mountlocker
Mediumnefilim
MediumAccording to Vitali Kremez and Michael Gillespie, this ransomware shares much code with Nemty 2.5. A difference is remo…
netwalker
MediumNetWalker ransomware group operates by the threat actor known as "CIRCUS SPIDER". The NetWalker ransomware was discover…
nitrogen
Mediumnokoyawa
Mediumobscura
Mediumonyx
Mediumpayload
Mediumpayloadbin
Mediumpayoutsking
Mediumpear
MediumPure Extraction And Ransom (PEAR) Team is the community of highly responsible and strictly disciplined members. We are …
quantum
Mediumradar
Mediumralord
Mediumransomed
Mediumransomexx
MediumRansomExx is a ransomware family that targeted multiple companies starting in mid-2020. It shares commonalities with De…
redransomware
Mediumrevil
MediumSodinokibi ransomware group also known as REvil (Ransomware Evil) operates as a ransomware-as-a-service (RaaS) model. A…
sabbath
Mediumsecurotrop
Mediumshinyhunters
Mediumsiegedsec
MediumNot a ransomware group but a hacktivist group that appeared coincidentally days before Russia’s invasion of Ukraine
sparta
Mediumspook
Mediumsuncrypt
Mediumteamxxx
Mediumtengu
Mediumtermite
Mediumthreeam
MediumA new Ransomware family identified by the name '3AM' or 'ThreeAM' in September 2023. The ransomware operation was obser…
tridentlocker
Mediumtrigona
MediumAccording to PCrisk, Trigona is ransomware that encrypts files and appends the ._locked extension to filenames. Also, i…
trinity
Mediumunderground
Mediumunsafe
MediumA group which seems to recycle leak from other ransomware groups
vect
Mediumwannacry
MediumWannaCry ransomware is a cyber attack that spreads by exploiting vulnerabilities in the Windows operating system. At it…
warlock
MediumThe Warlock ransomware and operator(s) are believed to be attributed to Storm-2603, a China-based threat actor who is a…
werewolves
Mediumweyhro
Mediumxinglocker
Medium0apt
LowThe group appears unreliable. Most, if not all, of its alleged victims cannot be verified and appear to be randomly sel…
0mega
Lowabrahams_ax
Lowadminlocker
Lowagainstthewest
Lowagl0bgvycg
Lowako
LowA Windows ransomware that will run certain tasks to prepare the target system for the encryption of files. MedusaLocker…
arkana
Lowatomsilo
Lowauditteam
Lowavos
Lowaware
Lowaztroteam
Lowbabuk
LowBabuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most u…
babyduck
Lowbert
Lowblackout
Lowblackshadow
Lowblacktor
Lowblackwater
Lowbluebox
Lowbluelocker
LowBlue Locker targets Pakistan’s vital energy sector, particularly Pakistan Petroleum
bluesky
Lowbonacigroup
Lowbqtlock
Lowchilelocker
Lowchort
Lowcipherforce
Lowcontfr
LowRAAS - Ransomware intégré à un fichier PDF, à faire ouvrir à vos victimes ou à insérer vous-même, Windows et Mac, ne fo…
cooming
Lowcrosslock
Lowcry0
Lowcrylock
Lowcryptbb
Lowcryptnet
LowAccording to OALabs, this ransomware has the following features: * Files are encrypted with AES CBC using a generated 2…
cyclops
Lowdagonlocker
Lowdarkangels
Lowdarkbit
Lowdatakeeper
Lowdataleak
Lowdesolator
Lowdiavol
LowA ransomware with potential ties to Wizard Spider.
donex
Lowdread
Lowech0raix
LowThe QNAPCrypt ransomware works similarly to other ransomware, including encrypting all files and delivering a ransom no…
entropy
LowEntropy is a ransomware first seen in 1st quarter of 2022, is being used in conjunction of Dridex infection. The ransom…
ep918
Lowexitium
Lowexorcist
LowAccording to PCrisk, Exorcist is a ransomware-type malicious program. Systems infected with this malware experience dat…
fletchen
Lowfsteam
LowNew possible leak site posted to a forum on November 20th, 2022, no victims at present. Unclear if its for a ransomware…
gdlockersec
LowOur team members are from different countries and we are not interested in anything else, we are only interested in dol…
grief
LowDoppelpaymer is a ransomware family that encrypts user data and later on it asks for a ransom in order to restore origi…
hades
LowAccording to PCrisk, Hades Locker is an updated version of WildFire Locker ransomware that infiltrates systems and encr…
haron
Lowhellogookie
Lowhellokitty
LowUnit42 states that HelloKitty is a ransomware family that first surfaced at the end of 2020, primarily targeting Window…
holyghost
Lowhotarus
Lowinsane
Lowkarma
Lowkazu
Lowkittykatkrew
Lowkryptos
Lowkyber
Lowla_piovra
Lowℹ️ La Piovra Ransomware is an exercise of the company Offensive Security (also known as OffSec)
lilith
Lowlinkc
Lowlockbit
Lowlockbit3_fs
Lowlockdata
Lowlolnek
Lowlunalock
Lowm3rx
Lowmadcat
Lowmalekteam
Lowmamona
Lowmbc
Lowminteye
Lowmogilevich
Lowms13089
Lowmydecryptor
Lown3tworm
LowN3tw0rm ransomware group is linked to Iran by many security researchers especially for the fact that the group targetin…
nasirsecurity
Lownemty
LowNemty is a ransomware that was discovered in September 2019. Fortinet states that they found it being distributed throu…
netrunner
Lownevada
Lownightsky
Lownoname
Lowonepercent
Loworca
Loworion
Lowosiris
Lowpandora
LowPandora ransomware was obtained by vx-underground at 2022-03-14.
pay2key
LowPay2Key is ransomware that has been used by the threat actor Fox Kitten. The group seems to operate since July 2020, ta…
playboy
Lowprojectrelic
Lowprolock
LowPwndLocker is a ransomware that was observed in late 2019 and is reported to have been used to target businesses and lo…
prometheus
LowRansomware written in .NET, apparently derived from the codebase of win.hakbit (Thanos) ransomware.
promptlock
LowFirst known AI-powered ransomware. The PromptLock malware uses the gpt-oss:20b model from OpenAI locally via the Ollama…
qiulong
Lowqlocker
Lowrabbithole
Lowradiant
Lowragnarok
LowAccording to Bleeping Computer, the ransomware is used in targeted attacks against unpatched Citrix servers. It exclude…
ramp
Lowrancoz
Lowranion
Lowransombay
LowLaunched on April 24th, 2025 RansomBay is a new project operating under the DragonForce initiative
ransomcartel
Lowransomcortex
Lowranstreet
Lowranzy
LowRanzy Locker, Former known as ThunderX. The group hosting a data leak site in the darknet where they posting sensitive …
raznatovic
LowRANSOMED.VC aka Raznatovic
rebornvc
Lowredalert
Lowreynolds
Lowrobinhood
Lowrook
LowAccording to PCrisk, Rook is ransomware (an updated variant of Babuk) that prevents victims from accessing/opening file…
rransom
Lowrunsomewares
Lowsatanlockv2
Lowsecp0
LowEncrypted Extension: .vanhelsing, .vanlocker. Targets Windows Platform only
sensayq
Lowshadow
Lowshadowbyt3$
Lowshaoleaks
Lowshinysp1d3r
LowLikely associated with the cybercrime group BlingLibra (ShinyHunters)
sicarii
Lowsilent
LowUnlike many other groups, Silent claims to operate with a high level of anonymity and discretion. According to their ow…
skira
Lowslug
Lowsolidbit
LowRansomware, written in .NET.
sugar
LowRansomware, written in Delphi.
synack
Lowthegreenbloodgroup
Lowtimc
Lowtrisec
Lowu-bomb
Lowunknown
Lowvalencialeaks
Lowvanhelsing
Lowvanirgroup
Lowvendetta
LowRansomware, which appears to be a rebranding of win.cuba.
vfokx
Lowwalocker
Lowx001xs
Lowxinof
Lowxp95
Lowyanluowang
LowAccording to PCrisk, Yanluowang is ransomware that encrypts (and renames) files, ends all running processes, stops serv…