The ransomware economy,
drawn in one place.
Every operator we track, every victim disclosed, every industry hit, every country struck — six coordinated views on top of the live corpus. Click anything to drop into the dossier.
Who hits hardest
ranked by all-time claimed victimsIndustries on fire
top sectors by victim hitsNo sector data yet.
Countries hit hardest
top geographies by victim hitsNo country data yet.
Ecosystem map
every operator drawn proportional to its all-time victimsEach rectangle is a tracked ransomware operator. Area equals the group's claimed victim count; colour is the sector it targets most. Hover for details, click any rectangle to open the dossier.
Loading the ecosystem…
Methodology
Victim counts are taken from public ransomware leak sites we crawl via Tor and cross-checked against community catalogs (RansomLook, ransomwatch, MISP-galaxy). Sector and country tags are extracted from the leak post or our own AI enrichment pass. Top operators only include groups with at least one public disclosure. Updated daily.