All groups113 active in 30d1 tracked actor39 dormant

Tracked groups

Ransomware groups we've recorded a public leak-site posting for, plus hand-tracked data-extortion and APT actors that operate without a leak site. Active groups (claimed a victim in the last 30 days) appear first; tracked non-leak-site actors and dormant groups follow. Click any name for the full profile.

Active in last 30 days113 groups

Group30dTotalLast seen

Tracked actors · no leak site1 actor

Data-extortion and APT actors that don't run a ransomware leak site, so they never appear in the victim feed. Hand-tracked from government advisories and reporting.

SILENT RANSOM GROUPextortion
Data-theft extortion group (no encryption) that spun out of the Conti collapse; active since at least 2022. Also tracked as Luna Moth, UNC3753, and Chatty Spider. Primarily targets U.S. law firms (since 2023), plus healthcare, insurance, and financial organizations. TTPs: callback/phishing emails, IT-helpdesk impersonation, tricking staff into granting remote-desktop access, and in-person visits claiming to need 'backups or imaging'; exfiltrates via external drives and cloud storage (Google Drive, OneDrive), then extorts. Subject of FBI IC3 public advisories (2025 and May 2026).

Dormant39 groups

Group30dTotalLast seen