Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks
Link thickness reflects how often one group's claim on a victim was followed by another's. Based on 52 victims discovered in 2026 and claimed by 2 or more groups — showing only the top 20 most common paths for readability.
Graph concept by Valéry Rieß-Marchive
| Added | Name | Victims in 2026 | Victims Overall | Last Victim |
|---|---|---|---|---|
| 2026-01-05 | Sicarii | 1 | 1 | 2026-01-05 |
| 2026-01-06 | Vect | 25 | 25 | 2026-04-15 |
| 2026-02-04 | The green blood group | 2 | 2 | 2026-02-04 |
| 2026-02-07 | Insomnia | 49 | 49 | 2026-09-07 |
| 2026-02-11 | Reynolds | 1 | 1 | 2026-02-11 |
| 2026-02-11 | Bravox | 28 | 28 | 2026-09-01 |
| 2026-02-17 | Payload | 75 | 75 | 2026-08-20 |
| 2026-02-23 | Cipherforce | 6 | 6 | 2026-02-23 |
| 2026-02-23 | Kittykatkrew | 2 | 2 | 2026-02-25 |
| 2026-02-25 | Shadowbyt3$ | 19 | 19 | 2026-09-10 |
| 2026-03-03 | Ailock | 51 | 51 | 2026-08-26 |
| 2026-03-12 | Loki | 1 | 1 | 2026-03-12 |
| 2026-03-17 | Exitium | 4 | 4 | 2026-04-14 |
| 2026-03-21 | Alp-001 | 17 | 17 | 2026-04-08 |
| 2026-04-03 | Netrunner | 6 | 6 | 2026-04-03 |
| 2026-04-03 | Krybit | 146 | 146 | 2026-09-12 |
| 2026-04-08 | Auditteam | 34 | 34 | 2026-09-13 |
| 2026-04-09 | Timc | 3 | 3 | 2026-04-09 |
| 2026-04-13 | Lamashtu | 34 | 34 | 2026-06-17 |
| 2026-04-29 | Aurora | 39 | 39 | 2026-09-07 |
| 2026-04-29 | M3rx | 38 | 38 | 2026-08-29 |
| 2026-04-30 | Mnt6 | 3 | 3 | 2026-05-02 |
| 2026-05-01 | Fulcrumsec | 27 | 27 | 2026-09-11 |
| 2026-05-02 | Cmdorganization | 43 | 43 | 2026-07-31 |
| 2026-05-02 | Blackwater | 12 | 12 | 2026-08-24 |
| 2026-05-04 | Prinzeugen | 5 | 5 | 2026-06-28 |
| 2026-05-05 | Icarus | 12 | 12 | 2026-06-23 |
| 2026-05-10 | Leakbazaar | 9 | 9 | 2026-05-10 |
| 2026-05-18 | Titan | 24 | 24 | 2026-08-20 |
| 2026-05-28 | 0day syndicate | 5 | 5 | 2026-05-29 |
| 2026-06-02 | Black x | 11 | 11 | 2026-09-01 |
| 2026-06-09 | Ulose | 5 | 5 | 2026-06-09 |
| 2026-06-13 | Triple x | 4 | 4 | 2026-08-05 |
| 2026-06-15 | Deadlock | 101 | 101 | 2026-08-24 |
| 2026-06-26 | Wallstreet | 15 | 15 | 2026-09-10 |
| 2026-06-28 | Settra | 64 | 64 | 2026-09-03 |
| 2026-06-28 | Redact | 2 | 2 | 2026-06-28 |
| 2026-06-29 | Blackfield | 2 | 2 | 2026-07-03 |
| 2026-07-06 | Cry0 | 2 | 2 | 2026-08-06 |
| 2026-07-06 | Doommageddon | 11 | 11 | 2026-09-13 |
| 2026-07-06 | Booba project | 16 | 16 | 2026-08-24 |
| 2026-07-09 | Crpxo | 37 | 37 | 2026-08-02 |
| 2026-07-13 | D1r | 3 | 3 | 2026-07-13 |
| 2026-07-26 | Exfilsquad | 15 | 15 | 2026-07-26 |
| 2026-07-26 | Global secret group | 46 | 46 | 2026-09-10 |
| 2026-07-30 | Gammax | 4 | 4 | 2026-08-06 |
| 2026-07-30 | Kyber | 1 | 1 | 2026-07-30 |
| 2026-08-04 | Orova | 45 | 45 | 2026-08-31 |
| 2026-08-05 | Panzer | 25 | 25 | 2026-09-11 |
| 2026-08-05 | Orion | 14 | 14 | 2026-08-05 |
| 2026-08-05 | Dark project | 29 | 29 | 2026-09-09 |
| 2026-08-06 | Barracuda | 9 | 9 | 2026-09-13 |
| 2026-08-07 | L group | 28 | 28 | 2026-08-23 |
| 2026-08-07 | Helix | 8 | 8 | 2026-08-22 |
| 2026-08-07 | Storm | 53 | 53 | 2026-09-09 |
| 2026-08-09 | Sovcali | 1 | 1 | 2026-08-09 |
| 2026-08-12 | Majinahanashi | 22 | 22 | 2026-09-01 |
| 2026-08-12 | Emperador | 16 | 16 | 2026-09-12 |
| 2026-08-12 | Ethics | 3 | 3 | 2026-08-12 |
| 2026-08-14 | Bluewhale | 2 | 2 | 2026-08-14 |
| 2026-08-15 | Xpl0itrs | 8 | 8 | 2026-08-20 |
| 2026-08-16 | Eclipse | 8 | 8 | 2026-09-08 |
| 2026-08-20 | Iah6477 | 7 | 7 | 2026-08-29 |
| 2026-08-20 | Dysphor1a | 11 | 11 | 2026-09-06 |
| 2026-08-30 | Zawoo | 19 | 19 | 2026-08-31 |
| 2026-08-30 | Falcon | 3 | 3 | 2026-08-31 |
| 2026-09-03 | Vexy ransomware | 12 | 12 | 2026-09-12 |
| 2026-09-05 | Blacklocks | 1 | 1 | 2026-09-05 |