Ransomware Group
8Base
Affiliate 2803, Phobos affiliate group
8Base is the name of a ransomware affiliate group that used the Phobos ransomware.
- Disrupted
- Since 2019
Profile
Threat Library
Ransomware Groups. How They Extort.
How each group gets in, how it extorts and how to defend. Written in plain language, with sources.
Ransomware Group
Akira Ransomware Group
Storm-1567, Howling Scorpius, Punk Spider
Akira is a ransomware group active since March 2023.
- Active
- Since 2023
Profile
Ransomware Group
ALPHV / BlackCat
ALPHV, BlackCat, Noberus
ALPHV Blackcat is a ransomware as a service operation.
- Disrupted
- Since 2021
- Ransomware as a service
Profile
Ransomware Group
BianLian
BianLian group
BianLian is a ransomware and data extortion group that the FBI, CISA and Australia's ACSC say is likely based in Russia.
- Active
- Since 2022
Profile
Ransomware Group
Black Basta Ransomware Group
Basta
Black Basta is a ransomware as a service operation, first identified in April 2022.
- Since 2022
- Ransomware as a service
Profile
Ransomware Group
Cl0p
CL0P, Clop, TA505
Cl0p is a ransomware operation first seen in February 2019 and, per a joint FBI and CISA advisory (AA23-158A, June 2023), also known as TA505.
- Active
- Since 2019
Profile
Ransomware Group
Conti Ransomware Group
Wizard Spider (per Rewards for Justice and the UK government)
Conti was a ransomware as a service operation first observed in December 2019, per MITRE ATT&CK.
- Inactive
- Since 2019
Profile
Ransomware Group
DarkSide
Darkside, BlackMatter (possible rebrand)
DarkSide was a ransomware as a service group that CISA and the FBI named in advisory AA21-131A, first published May 11, 2021, after an attack on a U.S.
- Inactive
- Since 2020
- Ransomware as a service
Profile
Ransomware Group
DearCry
DearCry is ransomware that CISA said, in a March 12, 2021 update, was being used on compromised on-premises Exchange servers.
- Since March 2021
Profile
Ransomware Group
DragonForce
DragonForce is a ransomware family that, per a July 29, 2025 update to a joint advisory from agencies including CISA, the FBI and the UK's NCSC, Scattered Spider actors have most recently…
- Active
Profile
Ransomware Group
Everest
Everest ransomware group, EverBe 2.0 (earlier family, per HHS HC3)
Everest is a financially motivated ransomware and data extortion group.
- Active
- Since 2020
Profile
Ransomware Group
Hive
Hive was a ransomware as a service operation active from June 2021.
- Disrupted
- Since 2021
- Ransomware as a service
Profile
Ransomware Group
Interlock
Interlock is a ransomware group first observed in late September 2024.
- Active
- Since 2024
Profile
Ransomware Group
LockBit
LockBit 2.0 (LockBit Red), LockBit 3.0 (LockBit Black), LockBit Green
LockBit is a ransomware as a service operation first seen in January 2020.
- Disrupted
- Since 2020
- Ransomware as a service
Profile
Ransomware Group
Lynx
Lynx ransomware, Lynx Group
Lynx is a ransomware group that the Cyber Security Agency of Singapore named on 16 August 2025 as one of at least eight groups using a tool that switches off endpoint security software.
- Active
Profile
Ransomware Group
Medusa
Medusa ransomware, Medusa Group
Medusa is a ransomware-as-a-service operation first identified in June 2021, according to the FBI, CISA and HHS.
- Active
- Since 2021
Profile
Ransomware Group
Play
Playcrypt
Play, also called Playcrypt, is a ransomware group active since June 2022.
- Active
- Since 2022
Profile
Ransomware Group
Qilin
Agenda, Water Galura (operators)
Qilin, also tracked as Agenda, is a ransomware as a service family that MITRE ATT&CK says has been active since at least 2022.
- Active
- Since 2022
- Ransomware as a service
Profile
Ransomware Group
RansomHub
Cyclops, Knight
RansomHub is a ransomware as a service operation, formerly known as Cyclops and Knight, according to a joint advisory (AA24-242A) from the FBI, CISA, MS-ISAC and HHS released on August 29…
- Since 2024
- Ransomware as a service
Profile
Ransomware Group
REvil Ransomware Group
Sodinokibi, Sodin
REvil, also called Sodinokibi, is a ransomware as a service operation that MITRE ATT&CK says ran since at least April 2019.
- Disrupted
- Since 2019
- Ransomware as a service
Profile
Ransomware Group
Rhysida
Rhysida ransomware
Rhysida is a ransomware operation that CISA, the FBI and the MS-ISAC say has mainly been deployed against education, healthcare, manufacturing, IT and government organizations since May…
- Active
- Since 2023
Profile
Ransomware Group
Royal
BlackSuit
Royal is a ransomware group that, according to a joint FBI and CISA advisory (AA23-061A, first published March 2, 2023), rebranded as BlackSuit.
- Rebranded
- Since 2022
Profile
Ransomware Group
Vice Society
Vice Society is an intrusion, exfiltration and extortion group that first appeared in summer 2021, per joint advisory AA22-249A (FBI, CISA and MS-ISAC, September 6, 2022).
- Since 2021
- Not stated in the advisory
Profile
Ransomware Group
Warlock
Storm-2603
Warlock is a ransomware family that Microsoft says a China-based actor it tracks as Storm-2603 deployed in July 2025 after exploiting on-premises SharePoint servers.
- Since 2025
- Not stated by the sources
Profile
Nothing matches. Try another word or filter.
More In The Library.
Counts as of 17 October 2026
- 101 Guides Short, plain guides to the main ideas in external threat protection. 21 Guides
- Glossary Security terms in plain words, A to Z, each with its own page. 135 Terms
- APT Groups State-backed hacking groups, who they go after and how they get in. 49 Profiles
- Ransomware Groups How each group gets in, how it extorts and what stops it. 24 Profiles
- Malware And Tools Malware families and abused tools, what they do and how to spot them. 46 Profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 Profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 Profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 Profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 Profiles
- Agentic Security Best practices for securing AI agents and for using agents in security work, from the main public frameworks. 12 Articles
- How To Defend A playbook for every alert: the first 24 hours, the checklist and the fix. 18 Playbooks
Brandefense
Stay Ahead Of Digital Threats.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.