// UNCLASSIFIED // CLEARED FOR PUBLIC RELEASE //
FILE PUB-IDXDTG 0600Z
ColdRecon › Threat Group Index
Adversaries

Threat Group Index

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE
The threat groups most active across the breaches we track.

Profiles of the ransomware crews, extortion groups and APTs behind the incidents in our corpus — their techniques, target sectors and activity over time.

ShinyHunters
106 incidents · last seen 2026-10-05 · 5267.0M records
Cl0p
27 incidents · last seen 2026-09-16 · 74.0M records
Qilin
24 incidents · last seen 2026-09-16 · 480K records
DragonForce
21 incidents · last seen 2026-09-10 · — records
LockBit
15 incidents · last seen 2026-08-24 · 33.0M records
Akira
15 incidents · last seen 2026-09-22 · — records
The Gentlemen
13 incidents · last seen 2026-10-05 · — records
Clop
13 incidents · last seen 2026-08-17 · 62.1M records
Rhysida
10 incidents · last seen 2026-09-12 · 2.2M records
Everest
10 incidents · last seen 2026-05-29 · 576K records
ExfilSquad
9 incidents · last seen 2026-08-24 · 540K records
RansomHub
9 incidents · last seen 2025-08-12 · 940K records
TheHatman
8 incidents · last seen 2026-08-27 · — records
AuditTeam
7 incidents · last seen 2026-09-22 · — records
Nitrogen
7 incidents · last seen 2026-05-22 · — records
Cactus
7 incidents · last seen 2025-03-17 · — records
Lapsus$
7 incidents · last seen 2026-05-31 · 7.3M records
Vexy
7 incidents · last seen 2026-09-21 · — records
BlackCat
7 incidents · last seen 2024-04-30 · — records
incransom
6 incidents · last seen 2026-09-30 · — records
INC Ransom
6 incidents · last seen 2026-10-01 · 743K records
Play
6 incidents · last seen 2026-09-01 · — records
SafePay
6 incidents · last seen 2026-10-09 · — records
FulcrumSec
5 incidents · last seen 2026-09-04 · 34.8M records
Termite
4 incidents · last seen 2026-09-24 · — records
Scattered Spider
4 incidents · last seen 2025-05-20 · 7.0M records
ALPHV/BlackCat
4 incidents · last seen 2024-02-29 · — records
Midnight Blizzard
4 incidents · last seen 2024-03-01 · — records
Panzer
4 incidents · last seen 2026-09-29 · — records
Interlock
4 incidents · last seen 2025-08-22 · 2.4M records
Incransom
4 incidents · last seen 2026-09-28 · — records
TeamPCP
4 incidents · last seen 2026-08-19 · — records
BlackSuit
3 incidents · last seen 2024-08-28 · 1.9M records
OpenAI agents
3 incidents · last seen 2026-09-26 · — records
Sp1d3r
3 incidents · last seen 2024-06-21 · 1.1M records
Emperador
3 incidents · last seen 2026-09-21 · — records
Orova
3 incidents · last seen 2026-08-09 · — records
Settra
3 incidents · last seen 2026-09-03 · — records
Unsafe
3 incidents · last seen 2026-09-15 · — records
BYOD
3 incidents · last seen 2026-10-08 · 11K records
Booba Project
3 incidents · last seen 2026-09-16 · — records
CoinbaseCartel
3 incidents · last seen 2026-08-25 · — records
Gentlemen
3 incidents · last seen 2026-09-04 · — records
AKIRA
2 incidents · last seen 2025-05-20 · — records
MetaEncryptor
2 incidents · last seen 2026-09-17 · — records
EMBARGO
2 incidents · last seen 2025-05-26 · — records
Majinahanashi
2 incidents · last seen 2026-08-16 · — records
Brain Cipher
2 incidents · last seen 2024-12-09 · — records
Scattered LAPSUS$ Hunters
2 incidents · last seen 2025-10-06 · 1000.5M records
Nightspire
2 incidents · last seen 2026-08-19 · — records

This is the public cut. The desk sees the rest.

ColdRecon turns this signal into a daily brief and a live detection-coverage console. Request clearance.

Request Clearance →