Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks
Link thickness reflects how often one group's claim on a victim was followed by another's. Based on 58 victims discovered in 2026 and claimed by 2 or more groups — showing only the top 20 most common paths for readability.
Graph concept by Valéry Rieß-Marchive
| Added | Name | Victims in 2026 | Victims Overall | Last Victim |
|---|---|---|---|---|
| 2026-01-05 | Sicarii | 1 | 1 | 2026-01-05 |
| 2026-01-06 | Vect | 25 | 25 | 2026-04-15 |
| 2026-02-04 | The green blood group | 2 | 2 | 2026-02-04 |
| 2026-02-07 | Insomnia | 52 | 52 | 2026-09-15 |
| 2026-02-11 | Reynolds | 1 | 1 | 2026-02-11 |
| 2026-02-11 | Bravox | 29 | 29 | 2026-09-20 |
| 2026-02-17 | Payload | 76 | 76 | 2026-09-28 |
| 2026-02-23 | Cipherforce | 6 | 6 | 2026-02-23 |
| 2026-02-23 | Kittykatkrew | 2 | 2 | 2026-02-25 |
| 2026-02-25 | Shadowbyt3$ | 21 | 21 | 2026-09-16 |
| 2026-03-03 | Ailock | 51 | 51 | 2026-08-26 |
| 2026-03-12 | Loki | 1 | 1 | 2026-03-12 |
| 2026-03-17 | Exitium | 4 | 4 | 2026-04-14 |
| 2026-03-21 | Alp-001 | 17 | 17 | 2026-04-08 |
| 2026-04-03 | Netrunner | 8 | 8 | 2026-09-30 |
| 2026-04-03 | Krybit | 153 | 153 | 2026-09-24 |
| 2026-04-08 | Auditteam | 49 | 49 | 2026-09-29 |
| 2026-04-09 | Timc | 3 | 3 | 2026-04-09 |
| 2026-04-13 | Lamashtu | 44 | 44 | 2026-09-30 |
| 2026-04-29 | Aurora | 39 | 39 | 2026-09-07 |
| 2026-04-29 | M3rx | 45 | 45 | 2026-09-29 |
| 2026-04-30 | Mnt6 | 3 | 3 | 2026-05-02 |
| 2026-05-01 | Fulcrumsec | 27 | 27 | 2026-09-11 |
| 2026-05-02 | Cmdorganization | 43 | 43 | 2026-07-31 |
| 2026-05-02 | Blackwater | 12 | 12 | 2026-08-24 |
| 2026-05-04 | Prinzeugen | 5 | 5 | 2026-06-28 |
| 2026-05-05 | Icarus | 12 | 12 | 2026-06-23 |
| 2026-05-10 | Leakbazaar | 9 | 9 | 2026-05-10 |
| 2026-05-18 | Titan | 26 | 26 | 2026-09-22 |
| 2026-05-28 | 0day syndicate | 5 | 5 | 2026-05-29 |
| 2026-06-02 | Black x | 11 | 11 | 2026-09-01 |
| 2026-06-09 | Ulose | 6 | 6 | 2026-09-30 |
| 2026-06-13 | Triple x | 4 | 4 | 2026-08-05 |
| 2026-06-15 | Deadlock | 101 | 101 | 2026-08-24 |
| 2026-06-26 | Wallstreet | 25 | 25 | 2026-09-29 |
| 2026-06-28 | Settra | 78 | 78 | 2026-09-30 |
| 2026-06-28 | Redact | 2 | 2 | 2026-06-28 |
| 2026-06-29 | Blackfield | 2 | 2 | 2026-07-03 |
| 2026-07-06 | Cry0 | 4 | 4 | 2026-09-28 |
| 2026-07-06 | Doommageddon | 14 | 14 | 2026-09-28 |
| 2026-07-06 | Booba project | 24 | 24 | 2026-09-23 |
| 2026-07-09 | Crpxo | 37 | 37 | 2026-08-02 |
| 2026-07-13 | D1r | 3 | 3 | 2026-07-13 |
| 2026-07-26 | Exfilsquad | 15 | 15 | 2026-07-26 |
| 2026-07-26 | Global secret group | 48 | 48 | 2026-09-21 |
| 2026-07-30 | Gammax | 7 | 7 | 2026-09-29 |
| 2026-07-30 | Kyber | 1 | 1 | 2026-07-30 |
| 2026-08-04 | Orova | 47 | 47 | 2026-09-20 |
| 2026-08-05 | Panzer | 35 | 35 | 2026-09-28 |
| 2026-08-05 | Orion | 14 | 14 | 2026-08-05 |
| 2026-08-05 | Dark project | 30 | 30 | 2026-09-15 |
| 2026-08-06 | Barracuda | 12 | 12 | 2026-09-26 |
| 2026-08-07 | L group | 28 | 28 | 2026-08-23 |
| 2026-08-07 | Helix | 8 | 8 | 2026-08-22 |
| 2026-08-07 | Storm | 78 | 78 | 2026-09-30 |
| 2026-08-09 | Sovcali | 1 | 1 | 2026-08-09 |
| 2026-08-12 | Majinahanashi | 22 | 22 | 2026-09-01 |
| 2026-08-12 | Emperador | 33 | 33 | 2026-09-30 |
| 2026-08-12 | Ethics | 3 | 3 | 2026-08-12 |
| 2026-08-14 | Bluewhale | 2 | 2 | 2026-08-14 |
| 2026-08-15 | Xpl0itrs | 8 | 8 | 2026-08-20 |
| 2026-08-16 | Eclipse | 10 | 10 | 2026-09-14 |
| 2026-08-20 | Iah6477 | 8 | 8 | 2026-09-15 |
| 2026-08-20 | Dysphor1a | 11 | 11 | 2026-09-06 |
| 2026-08-30 | Zawoo | 25 | 25 | 2026-09-24 |
| 2026-08-30 | Falcon | 3 | 3 | 2026-08-31 |
| 2026-09-03 | Vexy ransomware | 17 | 17 | 2026-09-29 |
| 2026-09-05 | Blacklocks | 3 | 3 | 2026-09-26 |
| 2026-09-18 | Spirals | 4 | 4 | 2026-09-24 |
| 2026-09-18 | N0n | 17 | 17 | 2026-09-30 |
| 2026-09-18 | Endzone | 5 | 5 | 2026-09-24 |
| 2026-09-24 | Imnotavillain | 2 | 2 | 2026-09-24 |