Curated, citation-backed profiles (high/medium confidence), plus provisional entries auto-tracked from leak-site claims — clearly badged and not analyst-vetted. Ransomware entries reflect a group's claimed victim, not a confirmed breach.
GhostSec / GhostLockerSourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareLebanon, Israel, Egypt, Qatar, Turkey, MoroccoModerate⋮
Hunters InternationalSourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareUAE, TunisiaModerate⋮
IncRansomSourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareSaudi Arabia, UAEModerate⋮
KillSecSourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareSaudi Arabia, UAE, EgyptModerate⋮
krybitProvisional profile auto-created from leak-site claims — not analyst-vetted. A group's self-claim of a victim, not a confirmed breach.FinancialRansomwareProvisional—Provisional⋮
LockBit / LockBit 3.0Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareUAE, Saudi Arabia, Kuwait, Qatar, Oman, Bahrain, EgyptModerate⋮
lockbit5Provisional profile auto-created from leak-site claims — not analyst-vetted. A group's self-claim of a victim, not a confirmed breach.FinancialRansomwareProvisional—Provisional⋮
MedusaSourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareSaudi Arabia, UAE, MoroccoModerate⋮
nightspireProvisional profile auto-created from leak-site claims — not analyst-vetted. A group's self-claim of a victim, not a confirmed breach.FinancialRansomwareProvisional—Provisional⋮
payloadProvisional profile auto-created from leak-site claims — not analyst-vetted. A group's self-claim of a victim, not a confirmed breach.FinancialRansomwareProvisional—Provisional⋮
Qilin (fka Agenda)Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareUAE, Egypt, Saudi ArabiaModerate⋮
RansomHouseSourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareSaudi Arabia, EgyptModerate⋮
RansomHubSourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareUAE, Saudi Arabia, Egypt, LebanonModerate⋮
SarcomaSourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareSaudi Arabia, Oman, Kuwait, Qatar, UAEModerate⋮
SpacebearsSourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.FinancialRansomwareEgypt, Saudi ArabiaModerate⋮