Ransomware groups we've recorded a public leak-site posting for, plus hand-tracked data-extortion and APT actors that operate without a leak site. Active groups (claimed a victim in the last 30 days) appear first; tracked non-leak-site actors and dormant groups follow. Click any name for the full profile.