// UNCLASSIFIED // CLEARED FOR PUBLIC RELEASE //
FILE PUB-IDXDTG 0600Z
ColdRecon › Threat Group Index
Adversaries

Threat Group Index

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE
The threat groups most active across the breaches we track.

Profiles of the ransomware crews, extortion groups and APTs behind the incidents in our corpus — their techniques, target sectors and activity over time.

ShinyHunters
85 incidents · last seen 2026-09-22 · 4983.0M records
Cl0p
27 incidents · last seen 2026-09-16 · 74.0M records
Qilin
24 incidents · last seen 2026-09-16 · 480K records
DragonForce
21 incidents · last seen 2026-09-10 · — records
LockBit
15 incidents · last seen 2026-08-24 · 33.0M records
Akira
14 incidents · last seen 2026-09-20 · — records
Clop
13 incidents · last seen 2026-08-17 · 62.1M records
Rhysida
10 incidents · last seen 2026-09-12 · 2.2M records
Everest
10 incidents · last seen 2026-05-29 · 576K records
RansomHub
9 incidents · last seen 2025-08-12 · 940K records
ExfilSquad
9 incidents · last seen 2026-08-24 · 540K records
The Gentlemen
8 incidents · last seen 2026-09-14 · — records
TheHatman
8 incidents · last seen 2026-08-27 · — records
Cactus
7 incidents · last seen 2025-03-17 · — records
BlackCat
7 incidents · last seen 2024-04-30 · — records
Vexy
7 incidents · last seen 2026-09-21 · — records
Nitrogen
7 incidents · last seen 2026-05-22 · — records
Lapsus$
7 incidents · last seen 2026-05-31 · 7.3M records
AuditTeam
6 incidents · last seen 2026-09-22 · — records
Play
6 incidents · last seen 2026-09-01 · — records
incransom
5 incidents · last seen 2026-05-30 · — records
FulcrumSec
5 incidents · last seen 2026-09-04 · 34.8M records
Scattered Spider
4 incidents · last seen 2025-05-20 · 7.0M records
ALPHV/BlackCat
4 incidents · last seen 2024-02-29 · — records
Interlock
4 incidents · last seen 2025-08-22 · 2.4M records
INC Ransom
4 incidents · last seen 2026-09-05 · 743K records
TeamPCP
4 incidents · last seen 2026-08-19 · — records
Midnight Blizzard
4 incidents · last seen 2024-03-01 · — records
BlackSuit
3 incidents · last seen 2024-08-28 · 1.9M records
Termite
3 incidents · last seen 2025-02-26 · — records
SafePay
3 incidents · last seen 2026-09-19 · — records
Sp1d3r
3 incidents · last seen 2024-06-21 · 1.1M records
Emperador
3 incidents · last seen 2026-09-21 · — records
Orova
3 incidents · last seen 2026-08-09 · — records
Panzer
3 incidents · last seen 2026-08-14 · — records
Settra
3 incidents · last seen 2026-09-03 · — records
Unsafe
3 incidents · last seen 2026-09-15 · — records
Incransom
3 incidents · last seen 2026-09-19 · — records
Booba Project
3 incidents · last seen 2026-09-16 · — records
Gentlemen
3 incidents · last seen 2026-09-04 · — records
CoinbaseCartel
3 incidents · last seen 2026-08-25 · — records
AKIRA
2 incidents · last seen 2025-05-20 · — records
MetaEncryptor
2 incidents · last seen 2026-09-17 · — records
Hatman
2 incidents · last seen 2026-08-21 · — records
Hellcat
2 incidents · last seen 2024-11-08 · — records
EMBARGO
2 incidents · last seen 2025-05-26 · — records
Nightspire
2 incidents · last seen 2026-08-19 · — records
Scattered LAPSUS$ Hunters
2 incidents · last seen 2025-10-06 · 1000.5M records
Majinahanashi
2 incidents · last seen 2026-08-16 · — records
Brain Cipher
2 incidents · last seen 2024-12-09 · — records

This is the public cut. The desk sees the rest.

ColdRecon turns this signal into a daily brief and a live detection-coverage console. Request clearance.

Request Clearance →