Ransomware Groups

Track active ransomware operations, dark web infrastructure, and associated threat actors

637

Ransomware Groups

Malphas

Ghost

1 actor

UTG-Q-015

Evolution

1 site2026

Toufan

Pro-Palestinian Group

4 sites2026

Cryptnet

According to OALabs, this ransomware has the following features: * Files are encrypted with AES CBC using a generated 256 bit key and IV.* The generated AES keys are encrypted using a hard coded RSA key and appended to the encrypted files.

2 sites2023

Diavol

A ransomware with potential ties to Wizard Spider.

1 site2 actors2022

Wizard Spider, Gold BlackburnWIZARD SPIDER

Noescape

2 sites2023

Ragnarlocker

11 sites3 actors2021

FIN8UNC2447+1

Doppelpaymer

Doppelpaymer is a ransomware family that encrypts user data and later on it asks for a ransom in order to restore original files. It is recognizable by its trademark file extension added to encrypted files: .doppeled. It also creates a note file named: ".how2decrypt.txt".

2 sites1 actor2022

Doppel Spider