Skip to main content
Darkfield
Groups · ransomware operators we track

499 ransomware operators,
263 of them currently active.

Every actor that has claimed a victim on a public leak site, with sector focus, country breakdown, and time-since-last-post.

Of 499 tracked operators, 263 are currently active. LockBit leads with 3,536 claimed victims, and Business Services is the most-targeted industry.

LockBit
Most active operator
3,536 victims
44,581
Victims claimed
across all operators
263
Active now
of 499 tracked
Business Services
Most-targeted sector
3,796 victims
Sort by

Top by claimed victims

#1

active

LockBit

3,536victims

▁▁▁▁▁▁▂▁█▁▃▁

Business Services · United States · last 5 months ago

#2

active

Cl0p

2,744victims

█▁▁▁▁▁▃▁▁▂▁▁

Technology · United States · last 4 months ago

#3

active

Qilin

2,195victims

▃▃▃█▄▆▄▄▅▄▅▂

Not Found · United States · last 3 hours ago

#4

active

lockbit3

2,016victims

█▇▃▁▁▁▂▂▁▃▁▁

Business Services · US · last 9 months ago

#5

active

Incransom

1,758victims

█▃▇▅▇▅▆▅▇▃▃▂

Not Found · United States · last 6 hours ago

#6

active

Akira

1,696victims

▄▅▅▆█▆▅▄▇▄▄▂

Not Found · United States · last 3 days ago

#7

active

Play

1,352victims

▄▄█▄▄▃▅▆▇▁▆▃

Manufacturing · United States · last 4 hours ago

#8

active

clop

1,343victims

█▁▁▁▁▁▃▁▁▂▁▁

Technology · US · last 4 days ago

#9

active

thegentlemen

756victims

▃▁▂▂▄█▄

Not Found · US · last 4 days ago

All operators

Showing the top 100 of 490.