The chart positions active ransomware groups on two axes:

→ Horizontal axis — Persistence

How long the group has been active, measured from their first known victim to today. Groups further to the right are older, more established operations.

↑ Vertical axis — Victims claimed

Number of victims published during the analysis period (quarter or rolling window). Groups higher up claimed more victims in that timeframe.

The four quadrants

Notes

• Minimum threshold: only groups with at least 10 victims in the period are plotted, filtering out noise from one-off actors.
• Normalization: both axes are scaled 0–100 relative to the groups shown — positions are comparative, not absolute.