Curated, citation-backed profiles (high/medium confidence), plus provisional entries auto-tracked from leak-site claims — clearly badged and not analyst-vetted. Ransomware entries reflect a group's claimed victim, not a confirmed breach.
ALPHV / BlackCatSourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareEgypt, Saudi ArabiaModerate⋮
apt73Provisional profile auto-created from leak-site claims — not analyst-vetted. A group's self-claim of a victim, not a confirmed breach.FinancialRansomwareProvisional—Provisional⋮
BlackNevasSourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareSaudi Arabia, UAE, OmanModerate⋮
BQTLockSourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareUAE, Israel, Saudi ArabiaModerate⋮
Cicada3301Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareJordan, Tunisia, UAEModerate⋮
Cl0pSourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareEgypt, Saudi Arabia, UAEModerate⋮
DarkVaultSourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareIsrael, Saudi Arabia, UAE, Qatar, OmanModerate⋮
DeadlockProvisional profile auto-created from leak-site claims — not analyst-vetted. A group's self-claim of a victim, not a confirmed breach.FinancialRansomwareProvisional—Provisional⋮
DoommageddonProvisional profile auto-created from leak-site claims — not analyst-vetted. A group's self-claim of a victim, not a confirmed breach.FinancialRansomwareProvisional—Provisional⋮
EldoradoSourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareJordan, Lebanon, UAEModerate⋮
EverestSourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareUAE (and broader Gulf)Moderate⋮
GhostSec / GhostLockerSourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareLebanon, Israel, Egypt, Qatar, Turkey, MoroccoModerate⋮
Hunters InternationalSourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareUAE, TunisiaModerate⋮
IncRansomSourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareSaudi Arabia, UAEModerate⋮
KillSecSourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareSaudi Arabia, UAE, EgyptModerate⋮
krybitProvisional profile auto-created from leak-site claims — not analyst-vetted. A group's self-claim of a victim, not a confirmed breach.FinancialRansomwareProvisional—Provisional⋮
LockBit / LockBit 3.0Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareUAE, Saudi Arabia, Kuwait, Qatar, Oman, Bahrain, EgyptModerate⋮
lockbit5Provisional profile auto-created from leak-site claims — not analyst-vetted. A group's self-claim of a victim, not a confirmed breach.FinancialRansomwareProvisional—Provisional⋮
MedusaSourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareSaudi Arabia, UAE, MoroccoModerate⋮
nightspireProvisional profile auto-created from leak-site claims — not analyst-vetted. A group's self-claim of a victim, not a confirmed breach.FinancialRansomwareProvisional—Provisional⋮
payloadProvisional profile auto-created from leak-site claims — not analyst-vetted. A group's self-claim of a victim, not a confirmed breach.FinancialRansomwareProvisional—Provisional⋮
Qilin (fka Agenda)Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareUAE, Egypt, Saudi ArabiaModerate⋮
RansomHouseSourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareSaudi Arabia, EgyptModerate⋮
RansomHubSourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareUAE, Saudi Arabia, Egypt, LebanonModerate⋮
SarcomaSourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareSaudi Arabia, Oman, Kuwait, Qatar, UAEModerate⋮
SpacebearsSourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareEgypt, Saudi ArabiaModerate⋮
StormousSourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareEgypt, Saudi Arabia, Lebanon, Israel, Qatar, Turkey, UAEModerate⋮
The GentlemenSourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareSaudi Arabia, UAEModerate⋮