// UNCLASSIFIED // CLEARED FOR PUBLIC RELEASE //
FILE PUB-IDXDTG 0600Z
ColdRecon › Threat Group Index
Adversaries

Threat Group Index

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE
The threat groups most active across the breaches we track.

Profiles of the ransomware crews, extortion groups and APTs behind the incidents in our corpus — their techniques, target sectors and activity over time.

ShinyHunters
41 incidents · last seen 2026-05-31 · 2394.3M records
Cl0p
24 incidents · last seen 2025-11-28 · 74.0M records
DragonForce
18 incidents · last seen 2026-05-29 · — records
Qilin
16 incidents · last seen 2026-05-24 · 480K records
LockBit
12 incidents · last seen 2025-05-12 · 33.0M records
Clop
12 incidents · last seen 2025-11-21 · 62.1M records
Everest
10 incidents · last seen 2026-05-29 · 576K records
Akira
9 incidents · last seen 2026-05-29 · — records
RansomHub
9 incidents · last seen 2025-08-12 · 940K records
BlackCat
7 incidents · last seen 2024-04-30 · — records
Nitrogen
7 incidents · last seen 2026-05-22 · — records
Lapsus$
7 incidents · last seen 2026-05-31 · 7.3M records
Cactus
6 incidents · last seen 2025-03-17 · — records
Play
5 incidents · last seen 2025-11-03 · — records
ALPHV/BlackCat
5 incidents · last seen 2024-02-29 · — records
Rhysida
5 incidents · last seen 2026-05-27 · 800K records
incransom
5 incidents · last seen 2026-05-30 · — records
Scattered Spider
4 incidents · last seen 2025-05-20 · 7.0M records
Interlock
4 incidents · last seen 2025-08-22 · 2.4M records
Sp1d3r
3 incidents · last seen 2024-06-21 · 1.1M records
BlackSuit
3 incidents · last seen 2024-08-28 · 1.9M records
Midnight Blizzard
3 incidents · last seen 2024-03-01 · — records
Termite
3 incidents · last seen 2025-02-26 · — records
Anubis
2 incidents · last seen 2026-05-27 · — records
Hellcat
2 incidents · last seen 2024-11-08 · — records
MEDUSA
2 incidents · last seen 2025-06-01 · — records
Medusa
2 incidents · last seen 2025-05-27 · — records
Scattered LAPSUS$ Hunters
2 incidents · last seen 2025-10-06 · 1000.5M records
sarcoma
2 incidents · last seen 2025-06-04 · — records
BianLian
2 incidents · last seen 2024-06-24 · — records
Space Bears
2 incidents · last seen 2025-06-19 · — records
Brain Cipher
2 incidents · last seen 2024-12-09 · — records
Black Basta
2 incidents · last seen 2024-12-04 · — records
INC Ransom
2 incidents · last seen 2025-06-01 · 743K records
AKIRA
2 incidents · last seen 2025-05-20 · — records
akira
2 incidents · last seen 2026-05-26 · — records
Lamashtu
2 incidents · last seen 2026-05-30 · — records
EMBARGO
2 incidents · last seen 2025-05-26 · — records
Incransom
2 incidents · last seen 2026-05-29 · — records
stormous
2 incidents · last seen 2025-06-24 · — records
BlackCat/ALPHV
2 incidents · last seen 2023-11-03 · — records
BERT
1 incidents · last seen 2025-05-16 · — records
MOIS
1 incidents · last seen 2026-05-27 · — records
Inc Ransom
1 incidents · last seen 2025-05-01 · 170K records
UNC2447, Lapsus$, Yanluowang
1 incidents · last seen 2024-04-28 · — records
Cozy Bear
1 incidents · last seen 2020-12-13 · — records
Dark Angels
1 incidents · last seen 2023-09-29 · — records
Blackcat
1 incidents · last seen 2024-02-26 · — records
DarkSide
1 incidents · last seen 2021-05-07 · — records
ShinyHunters, Qilin
1 incidents · last seen 2026-05-25 · — records

This is the public cut. The desk sees the rest.

ColdRecon turns this signal into a daily brief and a live detection-coverage console. Request clearance.

Request Clearance →