Live Feed
Ransomware & Cyberattack Threat Intel
Real-world ransomware activity, tracked and updated continuously — presented here so the scale of the threat is something you can see, not just read about.
All-Time Tracked
34,017 victims across 422 tracked groups
Last 7 Days
378 attacks disclosed
Data refreshed hourly — last pulled Nov 14, 2026 3:32am UTC
By Group
Top 10 ransomware groups
Show full group ranking (50)
#1
N0n
91
#2
incransom
56
#3
thegentlemen
22
#4
Climax Inc
17
#5
qilin
14
#6
Vortex
14
#7
interlock
13
#8
Curious Worm
12
#9
metaencryptor
10
#10
osiris
8
#11
akira
7
#12
krybit
7
#13
play
6
#14
settra
6
#15
BYOD
6
#16
Booba Project
6
#17
Deadlock
6
#18
Aoqin
5
#19
Vexy Ransomware
5
#20
Panzer
4
#21
Majinahanashi
4
#22
SilentRansomGroup
4
#23
AuditTeam
4
#24
lockbit5
4
#25
payload
4
#26
Dark Project
3
#27
Black X
3
#28
rhysida
3
#29
everest
2
#30
bravox
2
#31
Doommageddon
2
#32
safepay
2
#33
payoutsking
2
#34
Barracuda
2
#35
medusalocker
2
#36
everstake
2
#37
HYFLOCK
2
#38
Orova
2
#39
Global Secret Group
2
#40
Eclipse
2
#41
netrunner
1
#42
Wallstreet
1
#43
emperador
1
#44
iah6477
1
#45
PixelLeaks
1
#46
aurora
1
#47
morpheus
1
#48
Scarlettgroup
1
#49
anubis
1
#50
Whitearmor
1
Distribution
Group share of attacks
378attacks
N0n24.1%
incransom14.8%
thegentlemen5.8%
Climax Inc4.5%
qilin3.7%
Vortex3.7%
interlock3.4%
Curious Worm3.2%
Other36.8%
By Sector
Top 10 sectors
Recent Activity
Most recently disclosed attacks in this range
Organization
Sector / Country
Group
Discovered
Grundbaulabor Trier GmbH
everest
Nov 14, 2026 3:32am UTC
I****** A*****
netrunner
Nov 14, 2026 1:30am UTC
K&A Industries
interlock
Nov 13, 2026 10:46pm UTC
Final Notice Before Publication
everest
Nov 13, 2026 10:44pm UTC
RE/MAX Germany
Panzer
Nov 13, 2026 9:51pm UTC
i*t*r***t.com
Curious Worm
Nov 13, 2026 8:53pm UTC
t**a.com
Curious Worm
Nov 13, 2026 8:53pm UTC
Frey Properties of Highland LLC
play
Nov 13, 2026 8:29pm UTC
ARRB Group
play
Nov 13, 2026 8:29pm UTC
Advantage Archives
incransom
Nov 13, 2026 8:14pm UTC
This data reflects publicly disclosed ransomware activity. Cyber Insights presents it purely for public awareness — to make the scale and pace of ransomware activity tangible, not to sell any product or service.
Data source: Ransomware.live