Hunt

96 groups posted 3,097 victims in the last 90 days. A group needs three postings to get a package, or one plus a write-up or a confirmed breach. Each package has who they hit, the reports on them, their techniques, which rules catch those techniques, and the indicators to sweep. Everything links back to where it came from.

#	Actor	Victims	Last post	Hits most	Writeups	Covered
01	The GentlemenG1058 S9051	363	Nov 5	Manufacturing	2	54/64
02	QilinS1242	342	Nov 7	Manufacturing	1	45/52
03	N0n	204	Nov 6	Transportation		no ttps
04	AkiraG1024 S1129	116	Nov 6	Manufacturing	3	24/27
05	INC RansomG1032	96	Nov 7	Professional services	1	23/24
06	Storm	83	Oct 19	Manufacturing		no ttps
07	Silent Ransom Group	76	Nov 7	Professional services	10	7/12
08	krybit	76	Oct 29	Retail & consumer		no ttps
09	Settra	75	Nov 6	Professional services	1	no ttps
10	direwolf	67	Nov 6	Technology		no ttps
11	safepay	66	Nov 4	Manufacturing	3	no ttps
12	LockBit 5.0S1202	64	Nov 4	Professional services		29/34
13	emperador	60	Oct 31	Manufacturing		no ttps
14	nightspire	54	Nov 7	Healthcare		no ttps
15	AuditTeam	52	Nov 5	Technology		no ttps
16	Majinahanashi	50	Oct 31	Retail & consumer		no ttps
17	Cl0pS0611	48	Oct 21	Technology		16/17
18	PlayG1040 S1162	48	Nov 4	Manufacturing		25/26
19	Booba Project	47	Nov 3	Healthcare		no ttps
20	Wallstreet	43	Oct 30	Healthcare		no ttps
21	rhysida	43	Nov 7	Professional services		no ttps
22	Everest	43	Oct 27	Technology		no ttps
23	medusalocker	43	Nov 4	Manufacturing		no ttps
24	Panzer	43	Oct 28	Professional services		no ttps
25	Brain Cipher	41	Nov 6	Professional services		no ttps
26	DragonForce	30	Oct 27	Manufacturing		no ttps
27	Aurora	29	Oct 30	Manufacturing		no ttps
28	Orova	28	Nov 3	Technology		no ttps
29	Pear	27	Nov 5	Healthcare		no ttps
30	metaencryptor	27	Oct 12	Manufacturing		no ttps
31	Vexy Ransomware	26	Nov 5	Technology		no ttps
32	ZaWoo	25	Sep 24	Professional services		no ttps
33	genesis	24	Nov 6	Healthcare		no ttps
34	lamashtu	24	Oct 24	Manufacturing		no ttps
35	ShinyHuntersG1057	22	Sep 24	Healthcare	14	36/42
36	Global Secret Group	22	Nov 4	Manufacturing		no ttps
37	Whitearmor	22	Nov 7	Technology		no ttps
38	Interlock	21	Oct 21	Education		no ttps
39	Dark Project	21	Nov 5	Manufacturing		no ttps
40	Eclipse	21	Nov 6	Transportation		no ttps
41	Coinbase Cartel	20	Aug 23	Professional services		no ttps
42	Chaos	19	Nov 3	Manufacturing		no ttps
43	payload	18	Nov 3	Manufacturing	1	14/17
44	Anubis	17	Nov 7	Healthcare		no ttps
45	BYOD	17	Nov 5	Retail & consumer		no ttps
46	iah6477	16	Oct 18	Manufacturing		no ttps
47	DeadLock	14	Oct 24	Manufacturing		no ttps
48	HYFLOCK	13	Nov 2	Technology		no ttps
49	spacebears	13	Oct 22	Healthcare		no ttps
50	Barracuda	12	Nov 1	Technology		no ttps
51	Doommageddon	12	Nov 4	Manufacturing		no ttps
52	Helix	12	Oct 21	Manufacturing		no ttps
53	3AM	11	Oct 9	Manufacturing		no ttps
54	arcusmedia	11	Oct 9	Manufacturing		no ttps
55	insomnia	11	Oct 5	Healthcare		no ttps
56	kazu	11	Sep 7	Healthcare		no ttps
57	Scarlettgroup	11	Nov 4	Healthcare		no ttps
58	titan	11	Sep 22	Manufacturing		no ttps
59	bravox	10	Oct 22	Technology		no ttps
60	DYSPHOR1A	10	Sep 6	Education		no ttps
61	payoutsking	10	Oct 24	Healthcare		no ttps
62	ransomhouse	10	Nov 4	Energy & utilities		no ttps
63	UmBra	10	Oct 10	Education		no ttps
64	blacknevas	9	Oct 15	Manufacturing		no ttps
65	kairos	9	Oct 14	Manufacturing		no ttps
66	m3rx	9	Sep 29	Professional services		no ttps
67	ShadowByt3$	9	Sep 16	Retail & consumer		no ttps
68	Redact	8	Nov 5	Professional services		no ttps
69	everstake	8	Nov 5	Technology		no ttps
70	THE SEVEN DEADLY SINS	8	Oct 16	Technology		no ttps
71	xpl0itrs	8	Aug 20	Retail & consumer		no ttps
72	Falcon	7	Nov 3	Professional services		no ttps
73	OBSOFT	7	Nov 6			no ttps
74	Termite	7	Oct 9	Manufacturing		no ttps
75	unsafe	7	Sep 21	Technology		no ttps
76	VYPR	7	Oct 5	Healthcare		no ttps
77	EndZone	6	Oct 6	Technology		no ttps
78	Black X	6	Oct 9	Technology		no ttps
79	global	6	Sep 12	Technology		no ttps
80	netrunner	6	Oct 8	Healthcare		no ttps
81	Shiba	6	Nov 6	Healthcare		no ttps
82	Aoqin	5	Nov 5	Technology		no ttps
83	Spirals	5	Oct 3	Transportation		no ttps
84	AiLock	4	Aug 26	Professional services		no ttps
85	beast	4	Nov 5	Technology		no ttps
86	fulcrumsec	4	Oct 23	Technology		no ttps
87	securotrop	4	Sep 18	Manufacturing		no ttps
88	gunra	3	Sep 4	Professional services	1	no ttps
89	BlackLocks	3	Sep 26	Professional services		no ttps
90	blackwater	3	Aug 24	Professional services		no ttps
91	cry0	3	Oct 9	Energy & utilities		no ttps
92	crypto24	3	Oct 27	Healthcare		no ttps
93	Ethics	3	Aug 12	Technology		no ttps
94	Gammax	3	Sep 29	Manufacturing		no ttps
95	sarcoma	3	Oct 31	Retail & consumer		no ttps
96	ULose	3	Oct 27			no ttps

Read this before you trust a row

Victim counts come from leak sites via ransomware.live. A posting is the group's claim, and some are padded or recycled.

Techniques come from two places: MITRE ATT&CK, where MITRE has profiled the group, and reports about the group. A report is about a group when its title names the group, or when it names the group on at least twice as many lines as any other group. Passing mentions are listed but feed nothing. 13 of 96 groups have either. The rest have nothing published that we can read, including some of the busiest: N0n, Storm, krybit, direwolf, emperador. For those, the package is who they hit and nothing else.

Covered means at least one rule exists for the technique, ours or SigmaHQ's. A rule on the same technique can still miss this actor's version of it. Treat covered as a place to start, then test.

Indicators are the values a report lists in its IOC section, plus defanged domains and IPs and hashes in a report whose title names the group and no other. Lookalike domains that name a target company are held back.

Machine-readable: /hunt/index.json · per actor: /hunt/<actor>/package.json and /hunt/<actor>/iocs.csv