Skip to main content
Darkfield
Groups · ransomware operators we track

471 ransomware operators,
237 of them currently active.

Every actor that has claimed a victim on a public leak site, with sector focus, country breakdown, and time-since-last-post.

Of 471 tracked operators, 237 are currently active. LockBit leads with 3,536 claimed victims, and Business Services is the most-targeted industry.

LockBit
Most active operator
3,536 victims
0
Victims claimed
across all operators
0
Active now
of 471 tracked
Business Services
Most-targeted sector
3,796 victims
Sort by

Top by claimed victims

#1

active

LockBit

3,536victims

▁▁▁▁▁▁▂▁█▁▃▁

Business Services · United States · last 4 months ago

#2

active

Cl0p

2,744victims

█▁▁▁▁▁▃▁▁▂▁▁

Technology · United States · last 3 months ago

#3

active

Qilin

2,030victims

▃▃▃█▄▆▄▄▅▄▅▂

Not Found · United States · last 11 hours ago

#4

active

lockbit3

2,016victims

█▇▃▁▁▁▂▂▁▃▁▁

Business Services · US · last 7 months ago

#5

active

Incransom

1,712victims

█▃▇▅▇▅▆▅▇▃▃▂

Not Found · United States · last 1 day ago

#6

active

Akira

1,673victims

▄▅▅▆█▆▅▄▇▄▄▂

Not Found · United States · last 18 hours ago

#7

active

Play

1,316victims

▄▄█▄▄▃▅▆▇▁▆▃

Manufacturing · United States · last 9 days ago

#8

active

clop

1,254victims

█▁▁▁▁▁▃▁▁▂▁▁

Technology · US · last 3 months ago

#9

active

Hunters International

695victims

▇█▅▃▃▂▅▂▇▂▂▃

Business Services · United States · last 4 months ago

All operators

Showing the top 100 of 462.