Live Feed
Ransomware & Cyberattack Threat Intel
Real-world ransomware activity, tracked and updated continuously — presented here so the scale of the threat is something you can see, not just read about.
All-Time Tracked
32,146 victims across 403 tracked groups
Last 7 Days
196 attacks disclosed
Data refreshed hourly — last pulled Sep 28, 2026 6:53pm UTC
By Group
Top 10 ransomware groups
Show full group ranking (46)
#1
thegentlemen
20
#2
qilin
18
#3
akira
10
#4
SilentRansomGroup
9
#5
safepay
9
#6
incransom
8
#7
threeam
7
#8
medusalocker
7
#9
emperador
7
#10
Wallstreet
7
#11
settra
7
#12
everest
6
#13
Booba Project
6
#14
dragonforce
5
#15
play
4
#16
pear
4
#17
N0n
4
#18
termite
4
#19
metaencryptor
4
#20
Panzer
3
#21
Storm
3
#22
Barracuda
3
#23
lockbit5
3
#24
krybit
3
#25
ZaWoo
3
#26
shinyhunters
3
#27
Doommageddon
2
#28
arcusmedia
2
#29
BlackLocks
2
#30
Spirals
2
#31
rhysida
2
#32
ImNotAVillain
2
#33
EndZone
2
#34
titan
2
#35
AuditTeam
2
#36
payload
1
#37
interlock
1
#38
m3rx
1
#39
payoutsking
1
#40
Vexy Ransomware
1
#41
BrainCipher
1
#42
spacebears
1
#43
anubis
1
#44
kairos
1
#45
secp0
1
#46
unsafe
1
Distribution
Group share of attacks
196attacks
thegentlemen10.2%
qilin9.2%
akira5.1%
SilentRansomGroup4.6%
safepay4.6%
incransom4.1%
threeam3.6%
medusalocker3.6%
Other55.1%
By Sector
Top 10 sectors
Recent Activity
Most recently disclosed attacks in this range
Organization
Sector / Country
Group
Discovered
safescaffolding.net
threeam
Sep 28, 2026 6:53pm UTC
coosalud.com
threeam
Sep 28, 2026 6:52pm UTC
pistonespersan.com.ar
threeam
Sep 28, 2026 6:52pm UTC
midwestbit.com
threeam
Sep 28, 2026 6:51pm UTC
apexus.com
threeam
Sep 28, 2026 6:50pm UTC
bhn-expertise.com
threeam
Sep 28, 2026 6:50pm UTC
stjames.wa.edu.au
threeam
Sep 28, 2026 6:49pm UTC
Goodrich Logistics
Doommageddon
Sep 28, 2026 6:46pm UTC
Chem Process Systems Pvt. Ltd.
Doommageddon
Sep 28, 2026 6:46pm UTC
Starr Whitehouse Landscape Architects
play
Sep 28, 2026 6:33pm UTC
This data reflects publicly disclosed ransomware activity. Cyber Insights presents it purely for public awareness — to make the scale and pace of ransomware activity tangible, not to sell any product or service.
Data source: Ransomware.live