Threat Intelligence Database
INTELLIGENCE REPORTS
Group profiles, campaign alerts, and strategic intelligence on the ransomware threat landscape.
Filter: All Group Profile Intel Report Campaign Alert Space Bears Underground Termite Hunters International INC Ransom ElDorado LockBit Sarcoma Anubis KillSec VanHelsing RA World Embargo NightSpire 3AM ALPHV Hellcat Osiris Cactus Scattered Spider Dark Angels Abyss Locker FulcrumSec Everest 8Base / Phobos Cicada3301 Akira DragonForce Bavacai BlackSuit Lynx BianLian Luna Moth Interlock Vect Fog NOVA Cl0p Qilin The Gentlemen Medusa Black Basta RansomHub
LVL
Report / Group
Type
Sectors
Date
8
Space Bears: The Data Extortion Group With a Corporate Aesthetic and MSSQL Focus
Space Bears
Group Profile
financehealthcare +2 more
8
Underground Ransomware: Group Profile
Underground
Group Profile
governmenthealthcare +2 more
8
Termite Ransomware: Group Profile, Babuk Origins, and High-Impact Supply Chain Targeting
Termite
Group Profile
healthcarefinance +1 more
6
How Ransomware TTPs Are Evolving in 2026: BYOVD, Supply Chain Credentials, and ESXi Targeting
Intel Report
cross-sector
8
Hunters International / World Leaks: From Hive Successor to Pure Extortion
Hunters International
Group Profile
healthcaremanufacturing +4 more
9
INC Ransom's Law Firm Campaign: 20 Victims in 48 Hours and What It Means for the Legal Sector
INC Ransom
Campaign Alert
legalprofessional-services
8
ElDorado Ransomware: Group Profile and VMware ESXi Targeting Analysis
ElDorado
Group Profile
financehealthcare +4 more
8
LockBit 5.0 (ChuongDong): Group Profile and 2026 Activity Assessment
LockBit
Group Profile
financehealthcare +5 more
8
Sarcoma: The Ransomware Group That Became a Major Threat in Under a Year
Sarcoma
Group Profile
manufacturingtechnology +3 more
8
Anubis Ransomware: Group Profile
Anubis
Group Profile
healthcarefinance +1 more
8
KillSec: The RaaS Group That Treats Data Extortion as a Managed Service
KillSec
Group Profile
healthcaremanufacturing +4 more
8
VanHelsing RaaS: Multi-Platform Ransomware Targeting Windows, Linux, and ESXi
VanHelsing
Group Profile
manufacturinghealthcare +3 more
8
RA World: Babuk's Successor Targeting Healthcare, Pharma, and Finance
RA World
Group Profile
healthcarefinance +3 more
8
Embargo Ransomware: Rust-Based Toolchain, EDR Killing, and Double Extortion
Embargo
Group Profile
healthcaremanufacturing +3 more
8
NightSpire: 175 Victims in Q1 2026 and Growing
NightSpire
Group Profile
governmenthealthcare +4 more
8
3AM Ransomware: The Rust-Written LockBit Backup That Became Its Own Operation
3AM
Group Profile
manufacturingprofessional-services +3 more
8
ALPHV/BlackCat: From Rust-Powered Innovation to the Ransomware Exit Scam of the Decade
ALPHV
Group Profile
healthcarefinancial-services +3 more
8
Hellcat Ransomware: AI-Assisted Operations and Multi-Sector Targeting
Hellcat
Group Profile
educationgovernment +4 more
8
Osiris Ransomware: BYOVD EDR Killer, Poortry Driver, and the INC Connection
Osiris
Group Profile
manufacturingcritical-infrastructure +2 more
8
Cactus Ransomware: Self-Encrypting Payloads, VPN Exploitation, and Enterprise Targeting
Cactus
Group Profile
manufacturingenergy +4 more
8
Scattered Spider (UNC3944): The Social Engineering Threat That Bypasses Technical Defenses
Scattered Spider
Group Profile
hospitalityfinancial-services +3 more
8
Dark Angels: The Ransomware Group That Prefers Silence to Headlines
Dark Angels
Group Profile
healthcaretechnology +2 more
8
Abyss Locker: The Ransomware Group Systematically Targeting VMware ESXi Infrastructure
Abyss Locker
Group Profile
healthcaremanufacturing +2 more
8
FulcrumSec: The Data Extortion Group Targeting Developer Credential Sprawl
FulcrumSec
Group Profile
technologyhealthcare +2 more
8
Everest Ransomware Group Profile: Data Extortion, Access Sales, and Government Targeting
Everest
Group Profile
governmenthealthcare +3 more
6
8Base and Phobos: Inside Operation PHOBOS AETOR and What Happened After
8Base / Phobos
Intel Report
healthcaremanufacturing +3 more
8
Cicada3301: The ALPHV/BlackCat Successor Targeting Critical Sectors in the US and UK
Cicada3301
Group Profile
critical-infrastructurehealthcare +3 more
8
Akira Ransomware: VMware ESXi Targeting, Linux Encryptors, and 300+ Victims in 18 Months
Akira
Group Profile
healthcaremanufacturing +4 more
8
DragonForce: From Malaysian Hacktivism to Top-Three Global Ransomware Operator
DragonForce
Group Profile
retailmanufacturing +3 more
8
Bavacai: The MedusaLocker Rebrand That Quietly Entered the Ransomware Top 10
Bavacai
Group Profile
healthcaremanufacturing +2 more
8
SafePay Ransomware: The Non-RaaS Group Claiming 400+ Victims with Conti-Derived TTPs
Group Profile
8
BlackSuit Ransomware: The Royal Successor Targeting Healthcare and Critical Infrastructure
BlackSuit
Group Profile
healthcareeducation +3 more
8
Rhysida Ransomware: Healthcare and Education Sector Specialist with NHS, British Library Victims
Group Profile
8
Lynx Ransomware Group Profile: INC Ransom Successor Targeting Critical Infrastructure and Healthcare
Lynx
Group Profile
healthcarecritical-infrastructure +3 more
8
BianLian Ransomware Group Profile: The Shift to Pure Extortion
BianLian
Group Profile
healthcareprofessional-services +3 more
8
Luna Moth / Silent Ransom Group: Callback Phishing, No Malware, and the Jones Day Breach
Luna Moth
Group Profile
legalfinance +2 more
8
Play Ransomware: Group Profile, TTPs, and 2026 Campaign Activity
Group Profile
8
Interlock Ransomware: Healthcare and Government Targeting, ClickFix Delivery, and CISA Joint Alert
Interlock
Group Profile
healthcaregovernment +1 more
8
Vect Ransomware: Industrialised RaaS with a Fatal Encryption Flaw That Makes Data Unrecoverable
Vect
Group Profile
technologymanufacturing +2 more
8
Fog Ransomware: Group Profile, Toolset, and Why Education and Financial Services Are Primary Targets
Fog
Group Profile
educationfinance +1 more
8
Hunters International / World Leaks: From Hive Successor to Pure Data Extortion
Hunters International
Group Profile
healthcaremanufacturing +2 more
8
INC Ransom Group Profile: NHS Data Leaks, Healthcare Targeting, and the Pure Extortion Model
INC Ransom
Group Profile
healthcareeducation +2 more
8
NOVA Ransomware: The Rust-Based RaaS That Rebranded from RALord and Went Cross-Platform
NOVA
Group Profile
manufacturingtechnology +2 more
8
Cl0p Ransomware Group Profile: Mass Exploitation at Scale
Cl0p
Group Profile
financehealthcare +4 more
8
Qilin: The Ransomware Group That Turned Chrome Credentials Into a Weapon
Qilin
Group Profile
healthcarecritical-infrastructure +2 more
9
Cl0p's Oracle EBS Campaign: Mass Exploitation via CVE-2025-61882
Campaign Alert
8
The Gentlemen: The RaaS Group That Outran Its Origins
The Gentlemen
Group Profile
governmenthealthcare +2 more
8
DragonForce 2026: Inside the Ransomware Cartel Reshaping the RaaS Ecosystem
DragonForce
Group Profile
retailhealthcare +2 more
8
Medusa Ransomware 2026: The Operation That Recruited a Nation-State
Medusa
Group Profile
healthcareeducation +3 more
8
Black Basta -- The Ransomware Group That Thinks Like a Penetration Tester
Black Basta
Group Profile
healthcaremanufacturing +2 more
8
LockBit 4.0: Resurgence After Operation Cronos Featured
LockBit
Group Profile
financemanufacturing +2 more
8
RansomHub: Anatomy of the Dominant RaaS Affiliate Program
RansomHub
Group Profile
healthcaregovernment +2 more
9
Akira Ransomware: VMware ESXi Campaigns Targeting Healthcare and Manufacturing
Akira
Campaign Alert
healthcaremanufacturing
9
Cl0p's CLEO MFT Exploitation: Mass Data Theft at Scale
Cl0p
Campaign Alert
financelogistics
6
2026 Ransomware Payment Trends: Demands, Negotiations, and Sector Breakdown
Intel Report
cross-sector
6
Initial Access Brokers: The Supply Chain Enabling Ransomware
Intel Report
cross-sector
56 reports indexed
RSS Feed