40 victims named
Financial gainSince 2026-09-09
Threat actors
Who is doing this, and how. Intrusion sets come from MITRE ATT&CK with the techniques each group is documented using, so a profile is a list of things to check rather than a description of something frightening. Extortion groups are counted from the victims they have named on their own leak sites.
- 176
- ATT&CK groups tracked
- 16
- Extortion groups
- 16
- Matching this view
These counts are of organisations each group has claimed to have attacked, taken from the group’s own leak site. Most have never been confirmed by the organisation named. Treat the volume and the timing as real, and the accusation as unproven.
14 victims named
Financial gainSince 2026-09-09
10 victims named
Financial gainSince 2026-09-08
6 victims named
Financial gainSince 2026-09-08
6 victims named
Financial gainSince 2026-09-07
5 victims named
Financial gainSince 2026-09-07
4 victims named
Financial gainSince 2026-09-08
4 victims named
Financial gainSince 2026-09-07
3 victims named
Financial gainSince 2026-09-09
3 victims named
Financial gainSince 2026-09-08
3 victims named
Financial gainSince 2026-09-07
2 victims named
Financial gainSince 2026-09-08
2 victims named
Financial gainSince 2026-09-07
2 victims named
Financial gainSince 2026-09-09
2 victims named
Financial gainSince 2026-09-07
2 victims named
Financial gainSince 2026-09-07
Intrusion set data is from MITRE ATT&CK, which is maintained by MITRE and released for public use. Extortion group activity is derived from this tracker’s own incident records, sourced from RansomLook under CC BY 4.0.