Skip to main content
Darkfield
Groups · ransomware operators we track

467 ransomware operators,
233 of them currently active.

Every actor that has claimed a victim on a public leak site, with sector focus, country breakdown, and time-since-last-post.

Of 467 tracked operators, 233 are currently active. LockBit leads with 3,536 claimed victims, and Business Services is the most-targeted industry.

LockBit
Most active operator
3,536 victims
0
Victims claimed
across all operators
0
Active now
of 467 tracked
Business Services
Most-targeted sector
3,796 victims
Sort by

Top by claimed victims

#1

active

LockBit

3,536victims

▁▁▁▁▁▁▂▁█▁▃▁

Business Services · United States · last 3 months ago

#2

active

Cl0p

2,744victims

█▁▁▁▁▁▃▁▁▂▁▁

Technology · United States · last 2 months ago

#3

active

lockbit3

2,016victims

█▇▃▁▁▁▂▂▁▃▁▁

Business Services · US · last 7 months ago

#4

active

Qilin

1,986victims

▃▃▃█▄▆▄▄▅▄▅▂

Not Found · United States · last 2 hours ago

#5

active

Incransom

1,707victims

█▃▇▅▇▅▆▅▇▃▃▂

Not Found · United States · last 20 hours ago

#6

active

Akira

1,663victims

▄▅▅▆█▆▅▄▇▄▄▂

Not Found · United States · last 2 days ago

#7

active

Play

1,311victims

▄▄█▄▄▃▅▆▇▁▆▃

Manufacturing · United States · last 3 days ago

#8

active

clop

1,254victims

█▁▁▁▁▁▃▁▁▂▁▁

Technology · US · last 2 months ago

#9

active

Hunters International

695victims

▇█▅▃▃▂▅▂▇▂▂▃

Business Services · United States · last 3 months ago

All operators

Showing the top 100 of 458.