INC Ransom triples output in 24-hour surge
The dominant story of the last 24 hours is INC Ransom's 250% activity spike, jumping from 2 to 7 posted victims in a single day and accounting for nearly 39% of all 18 new postings — a surge that demands immediate attention from defenders…
- redeplastrs.com.brBlackfield · BR4 hours ago
- aydeniz.comapt73 · TR6 hours ago
- AC Beverage, Inc.pear · US7 hours ago
- CNW Electronics Pte Ltdpear · SG7 hours ago
- majuhome.com.mykrybit · MY8 hours ago
- duflosa.comkrybit · MX9 hours ago
- oakparkmi.govincransom · US17 hours ago
- Ferrum AGanubis · CH17 hours ago
- tambasa.comincransom · BR1 day ago
- tricountyhs.orgincransom · US1 day ago
Latest disclosures
View all victims →redeplastrs.com.br
4 hours agoBlackfield
Manufacturing · BrazilData publishedaydeniz.com
6 hours agoApt73
TürkiyeData publishedAC Beverage, Inc.
7 hours agoPear
Agriculture and Food Production · United StatesData publishedCNW Electronics Pte Ltd
7 hours agoPear
Manufacturing · SingaporeData publishedmajuhome.com.my
8 hours agoKrybit
Consumer Services · MalaysiaData publishedduflosa.com
9 hours agoKrybit
MexicoData publishedoakparkmi.gov
17 hours agoIncransomPublic Sector · United StatesData publishedFerrum AG
17 hours agoAnubis
Manufacturing · SwitzerlandData publishedtambasa.com
1 day agoIncransomBrazilData published
Build on the free Darkfield feed
Pull the latest ransomware disclosures into your own tools and research — an open JSON feed and free API, no signup.
Live snapshot
Darkfield currently tracks 467 ransomware operators (233 currently active) and has indexed 42,810 public victim disclosures from their leak sites. Browse the full ransomware groups catalog, the live victims feed, or drill into sector and country breakdowns.
Most active ransomware operators
Recent public victim disclosures
- redeplastrs.com.brBlackfield · BR
- aydeniz.comapt73 · TR
- AC Beverage, Inc.pear · US
- CNW Electronics Pte Ltdpear · SG
- majuhome.com.mykrybit · MY
- duflosa.comkrybit · MX
- oakparkmi.govincransom · US
- Ferrum AGanubis · CH
- tambasa.comincransom · BR
- tricountyhs.orgincransom · US
- acworth-ga.govincransom · US
- carvalima.com.brincransom · BR
Most-targeted sectors
- Business Services3,796
- Manufacturing3,678
- Technology3,545
- Healthcare2,594
- Financial Services1,183
- Education1,082
- Transportation/Logistics1,081
- Construction988
Most-affected countries
- United States14,140
- United Kingdom1,611
- Canada1,369
- Germany1,304
- France852
- Italy838
- Australia640
- India622
What we monitor
six catalogs, all browsableRansomware operators
tracked groups, mirrors crawled daily
Public disclosures
victims indexed across leak sites
Industries
distinct sectors with observed activity
Countries hit
geographies with disclosed victims
Blocklists
wallets · phishing · breaches
Active exploitation
CVE signals + triangulated clusters
Featured this week
Most active group
LockBit
3,536 victims claimed, last seen 3 months ago. Hits Business Services hardest.
Open dossier →
Biggest recent leak
—
No sized leak in the recent set.
CVE trending in chatter
—
Loading…