Cyber Insights
Live Feed

Ransomware & Cyberattack Threat Intel

Real-world ransomware activity, tracked and updated continuously — presented here so the scale of the threat is something you can see, not just read about.

Viewing
Hour Day Week Month
All-Time Tracked
32,146 victims across 403 tracked groups
Last 24 Hours
42 attacks disclosed
Data refreshed hourly — last pulled Sep 28, 2026 6:53pm UTC
By Group

Top 10 ransomware groups

safepay 9
threeam 7
medusalocker 4
emperador 3
qilin 3
Panzer 3
Doommageddon 2
play 2
akira 2
incransom 2
Show full group ranking (15)
#1 safepay 9
#2 threeam 7
#3 medusalocker 4
#4 emperador 3
#5 qilin 3
#6 Panzer 3
#7 Doommageddon 2
#8 play 2
#9 akira 2
#10 incransom 2
#11 payload 1
#12 interlock 1
#13 SilentRansomGroup 1
#14 pear 1
#15 N0n 1
Distribution

Group share of attacks

safepaythreeammedusalockeremperadorqilinPanzerDoommageddonplayOther
42attacks
safepay21.4%
threeam16.7%
medusalocker9.5%
emperador7.1%
qilin7.1%
Panzer7.1%
Doommageddon4.8%
play4.8%
Other21.4%
By Sector

Top 10 sectors

Manufacturing 8
Healthcare 6
Technology 5
Professional Services 4
Not Found 3
Retail & E-Commerce 3
Other 3
Government & Defense 2
Agriculture and Food Production 2
Hospitality 2
Recent Activity

Most recently disclosed attacks in this range

Organization Sector / Country Group Discovered
safescaffolding.net Manufacturing · GB threeam Sep 28, 2026 6:53pm UTC
coosalud.com Healthcare · CO threeam Sep 28, 2026 6:52pm UTC
pistonespersan.com.ar Manufacturing · AR threeam Sep 28, 2026 6:52pm UTC
midwestbit.com Technology · US threeam Sep 28, 2026 6:51pm UTC
apexus.com Technology · US threeam Sep 28, 2026 6:50pm UTC
bhn-expertise.com Professional Services · DE threeam Sep 28, 2026 6:50pm UTC
stjames.wa.edu.au Education · AU threeam Sep 28, 2026 6:49pm UTC
Goodrich Logistics Transportation · Doommageddon Sep 28, 2026 6:46pm UTC
Chem Process Systems Pvt. Ltd. Manufacturing · IN Doommageddon Sep 28, 2026 6:46pm UTC
Starr Whitehouse Landscape Architects Professional Services · US play Sep 28, 2026 6:33pm UTC

This data reflects publicly disclosed ransomware activity. Cyber Insights presents it purely for public awareness — to make the scale and pace of ransomware activity tangible, not to sell any product or service.

Data source: Ransomware.live