Ransomware groups are criminal gangs that lock or steal an organization’s data and demand payment. This post first looked at Conti, LockBit, Cl0p, Stormous and Lapsus$ in 2022, and each profile now notes what has happened since. Several of these groups named victims on a Tor website or a Telegram channel. Free services such as No More Ransom and ID Ransomware help victims identify the ransomware and look for a decryption tool.
What Changed in the Ransomware Scene in 2022?
Ransomware attacks cause serious financial and reputational damage. Most groups no longer only encrypt files. They also steal data and threaten to leak it, a pressure tactic known as multi-extortion.
Several high-profile groups of 2021, such as DarkSide, BlackMatter and Avaddon, stopped their operations that year. Law enforcement also hit REvil (Sodinokibi). In November 2021 the US Department of Justice announced charges and the arrest of REvil actors.
These exits did not reduce the threat. New groups soon took their place and attacked large companies in many sectors.
In 2022, Lapsus$ and Stormous were among the newer names. Conti, LockBit and Cl0p had been active since 2019 or 2020. These groups used malware, legitimate tools such as PsExec and Cobalt Strike, and built-in operating system features to carry out attacks and stay inside networks.
Which Ransomware Groups Led in 2022, and Where Are They Now?
Conti
Conti ransomware was first detected in 2019. Its malware targeted Windows systems. After Russia invaded Ukraine in February 2022, Conti operators pledged support to the Russian government, according to the US Rewards for Justice program.
Conti is no longer active under that name. In September 2023 the US Department of Justice said Russian nationals were charged over Conti attacks that began in 2020 and continued through June 2022. It put the number of Conti victims worldwide at more than 900.
Conti actors used these methods to spread their malware and get in:
- Phishing emails with malicious attachments and links
- Weak or stolen Remote Desktop Protocol (RDP) credentials
- Fake software promoted through search engine results
- Common security vulnerabilities
- Other malware distribution networks, such as Zloader
Conti named the organizations it attacked on a website served over the Tor network.
LockBit
LockBit ransomware grew out of ABCD ransomware, first seen in September 2019, and the LockBit name appeared in January 2020. It works as Ransomware-as-a-Service (RaaS). Affiliates pay to use the ransomware, and the income is shared with the developers. In its AA23-165A advisory, CISA called LockBit the most deployed ransomware variant in the world in 2022.
LockBit also used a Tor website to name the organizations it attacked. In 2022 it released LockBit 3.0 with a bug bounty program.
On 20 February 2024 the UK National Crime Agency (NCA) said it had taken control of LockBit’s main administration environment and its leak site. Two LockBit actors were arrested in Poland and Ukraine, and the NCA obtained over 1,000 decryption keys. In May 2024 the NCA said the group was trying to rebuild but was running at limited capacity.
Cl0p
Cl0p ransomware first appeared in February 2019 and evolved from the CryptoMix ransomware, according to CISA. It mostly targets organizations rather than individual users. CISA links Cl0p to the TA505 group.
Cl0p is best known for stealing data from many organizations at once through flaws in file transfer software. In 2023 it exploited a zero-day in MOVEit Transfer (CVE-2023-34362), starting on 27 May 2023, according to CISA advisory AA23-158A. The same advisory ties earlier campaigns to Accellion FTA and GoAnywhere MFT.
The brand was still in use in 2025. From 29 September 2025, extortion emails claiming a link to Cl0p reached Oracle E-Business Suite customers, as Google Threat Intelligence Group reported. Like other groups, Cl0p announces victims and shares data on a Tor website.
Stormous
Stormous was one of the newer names in 2022. We could not confirm the attacks it claimed that year, so we do not repeat those names here.
The group stayed active after 2022. In March 2024, Cisco Talos reported that Stormous had worked with GhostSec since at least July 2023. The two were jointly running double extortion attacks, Talos said, and in February 2024 they started a ransomware-as-a-service program. Talos noted that the group posted its claims on Telegram channels and a data leak site.
Lapsus$
Lapsus$ has been active since at least mid-2021, according to MITRE ATT&CK. Between late 2021 and 2022 it hit large technology companies, including Microsoft and NVIDIA, as well as government bodies in Brazil. It stole sensitive data and threatened to leak it unless the victim paid.
Lapsus$ did not act like a classic ransomware group. It did not deploy ransomware to encrypt files. After stealing data it often deleted the victim’s systems and resources, according to Microsoft. It also had no Tor website and made its announcements through a Telegram channel instead.
The group’s activity did not last. City of London Police arrested seven people linked to it in March 2022 and charged two teenagers on 1 April 2022. The US Cyber Safety Review Board said Lapsus$ appears to have become inactive after September 2022. Two teenagers were later convicted, as the force reported in February 2024.
- 2019Cl0p and Conti first detectedCl0p evolved from the CryptoMix family.
- 2019ABCD ransomware appearsIt becomes LockBit in January 2020.
- 2021Lapsus$ first seenActive from at least mid-2021.
- 2022Conti and Lapsus$ fadeConti attacks ran through June 2022; Lapsus$ went quiet after September 2022.
- 2023Cl0p exploits MOVEit TransferCISA advisory AA23-158A.
- 2024LockBit disruptedThe NCA took control of its leak site in February 2024.
How Do You Monitor Ransomware Groups?
Monitoring ransomware covers three jobs:
- Tracking what ransomware groups do, such as the organizations they name and the data they share
- Identifying the ransomware that infected a system
- Finding existing decryption or recovery tools
No More Ransom Project
No More Ransom helps victims get their files back without paying a ransom. It is an initiative of the Dutch police’s National High Tech Crime Unit and Europol’s European Cybercrime Centre, together with Kaspersky and McAfee. It also explains how ransomware works and how to prevent an infection.
Its Crypto Sheriff tool helps you find out which ransomware infected you. You upload files encrypted by the ransomware or the ransom note. Then you can check the “Decryption Tools” page to see whether a tool exists for that ransomware.
ID Ransomware
ID Ransomware is a free service from the MalwareHunterTeam researchers. It also tries to identify the ransomware that infected a system.
You can search with the ransom note, encrypted file samples or contact addresses in the ransom note. If the ransomware can be decrypted, it points you to a link with next steps.
Monitoring Leak Sites
Many ransomware groups run a leak site, where they publish details about the organizations they target. These sites run on the Tor network, so normal browsers cannot open them. A basic way to track a group is to visit its leak site and check for new entries.
This is done with web scraping. A script visits the leak sites through a Tor proxy, reads the HTML of each page and pulls out the fields it needs.
Two open-source projects used this method, and both repositories are now archived:
- ransomwatch by Josh Highet (formerly thetanz/ransomwatch)
- ransomwatch by captainGeech42
Brandefense Ransomware Intelligence monitors leak sites, dark web forums and access markets for early warning signals about your company.
Who’s Been Ransomware’d
ransom.wiki lets you check whether a ransomware group has claimed an organization. You can search by group name to see the organizations it claimed, or by organization name to see which group claimed it. Its own notice says the database holds claims up to 3 April 2024, so newer claims will be missing.
What Should You Do Next?
Ransomware hits everyone from home users to large companies and government agencies. If you are hit, check No More Ransom and ID Ransomware before you think about paying. A free decryption tool may already exist.
To stay ahead, follow what these groups do: who they target, which countries and sectors they hit and why. Start with our ransomware group profiles, which track each group’s status with dated sources.