Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks
Link thickness reflects how often one group's claim on a victim was followed by another's. Based on 1 victim discovered in 2021 and claimed by 2 or more groups — showing only the top 20 most common paths for readability.
Graph concept by Valéry Rieß-Marchive
| Added | Name | Victims in 2021 | Victims Overall | Last Victim |
|---|---|---|---|---|
| 2021-01-01 | Cring | 1 | 1 | 2021-01-01 |
| 2021-02-01 | Ronggolawe | 1 | 1 | 2021-02-01 |
| 2021-02-01 | Avaddon | 146 | 146 | 2021-09-09 |
| 2021-02-03 | Cuba | 13 | 103 | 2024-02-01 |
| 2021-02-07 | Mountlocker | 17 | 18 | 2022-02-08 |
| 2021-03-21 | Phoenixcryptolocker | 1 | 1 | 2021-03-21 |
| 2021-03-21 | Synack | 1 | 1 | 2021-03-21 |
| 2021-03-31 | Ragnarok | 3 | 3 | 2021-12-30 |
| 2021-04-05 | Astroteam | 1 | 1 | 2021-04-05 |
| 2021-04-29 | Xinglocker | 21 | 21 | 2021-10-26 |
| 2021-05-01 | Maui | 1 | 1 | 2021-05-01 |
| 2021-05-02 | Networm | 1 | 1 | 2021-05-02 |
| 2021-05-19 | Zeppelin | 1 | 1 | 2021-05-19 |
| 2021-05-26 | Grief | 3 | 3 | 2021-06-30 |
| 2021-05-31 | Vicesociety | 2 | 188 | 2023-06-20 |
| 2021-06-01 | Ransomhouse | 1 | 206 | 2026-09-01 |
| 2021-06-13 | Avoslocker | 19 | 70 | 2023-02-11 |
| 2021-07-22 | Deathkitty | 1 | 1 | 2021-07-22 |
| 2021-08-14 | Hive | 25 | 208 | 2023-01-16 |
| 2021-09-08 | Blackmatter | 32 | 32 | 2021-11-04 |
| 2021-09-09 | Lockbit2 | 429 | 1002 | 2022-06-28 |
| 2021-09-09 | Payloadbin | 26 | 29 | 2022-01-06 |
| 2021-09-09 | Lockdata | 5 | 5 | 2021-09-09 |
| 2021-09-09 | Quantum | 12 | 68 | 2022-12-09 |
| 2021-09-09 | Arvinclub | 13 | 35 | 2023-10-15 |
| 2021-09-09 | Groove | 13 | 13 | 2021-10-30 |
| 2021-09-09 | Azroteam | 15 | 15 | 2021-09-09 |
| 2021-09-09 | Darkleakmarket | 30 | 39 | 2022-05-25 |
| 2021-09-09 | Everest | 35 | 395 | 2026-09-01 |
| 2021-09-09 | Alphv | 14 | 731 | 2024-03-03 |
| 2021-10-04 | Karma | 7 | 7 | 2021-10-04 |
| 2021-10-04 | Spook | 35 | 35 | 2021-10-19 |
| 2021-10-04 | Bonacigroup | 3 | 3 | 2021-12-06 |
| 2021-10-04 | Blackbyte | 37 | 147 | 2025-07-30 |
| 2021-10-16 | Macaw | 1 | 1 | 2021-10-16 |
| 2021-11-22 | Lv | 17 | 63 | 2022-11-27 |
| 2021-11-22 | Sabbath | 10 | 17 | 2022-02-28 |
| 2021-11-29 | Snatch | 25 | 142 | 2024-05-16 |
| 2021-11-29 | Midas | 28 | 44 | 2022-04-14 |
| 2021-12-06 | Robinhood | 1 | 1 | 2021-12-06 |
| 2021-12-07 | Rook | 8 | 9 | 2022-01-08 |
| 2021-12-07 | Marketo | 31 | 32 | 2022-02-14 |
| 2021-12-10 | Lapsus$ | 1 | 25 | 2026-06-23 |
| 2021-12-18 | Mosesstaff | 16 | 16 | 2021-12-18 |
| 2021-12-18 | Blackshadow | 3 | 3 | 2021-12-18 |
| 2021-12-18 | Cryp70n1c0d3 | 11 | 11 | 2021-12-18 |
| 2021-12-21 | Atomsilo | 4 | 5 | 2026-02-24 |
| 2021-12-30 | Blacktor | 4 | 4 | 2021-12-30 |