// UNCLASSIFIED // CLEARED FOR PUBLIC RELEASE //
FILE PUB-IDXDTG 0600Z
ColdRecon › Threat Group Index
Adversaries

Threat Group Index

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE
The threat groups most active across the breaches we track.

Profiles of the ransomware crews, extortion groups and APTs behind the incidents in our corpus — their techniques, target sectors and activity over time.

ShinyHunters
62 incidents · last seen 2026-08-24 · 2414.1M records
Cl0p
26 incidents · last seen 2026-08-18 · 74.0M records
DragonForce
18 incidents · last seen 2026-05-29 · — records
Qilin
18 incidents · last seen 2026-05-24 · 480K records
LockBit
15 incidents · last seen 2026-08-24 · 33.0M records
Clop
13 incidents · last seen 2026-08-17 · 62.1M records
Everest
10 incidents · last seen 2026-05-29 · 576K records
RansomHub
9 incidents · last seen 2025-08-12 · 940K records
Akira
9 incidents · last seen 2026-05-29 · — records
ExfilSquad
9 incidents · last seen 2026-08-24 · 540K records
Lapsus$
7 incidents · last seen 2026-05-31 · 7.3M records
Nitrogen
7 incidents · last seen 2026-05-22 · — records
BlackCat
7 incidents · last seen 2024-04-30 · — records
Rhysida
6 incidents · last seen 2026-05-27 · 800K records
Cactus
6 incidents · last seen 2025-03-17 · — records
Play
5 incidents · last seen 2025-11-03 · — records
TheHatman
5 incidents · last seen 2026-08-22 · — records
incransom
5 incidents · last seen 2026-05-30 · — records
Interlock
4 incidents · last seen 2025-08-22 · 2.4M records
Scattered Spider
4 incidents · last seen 2025-05-20 · 7.0M records
Midnight Blizzard
4 incidents · last seen 2024-03-01 · — records
ALPHV/BlackCat
4 incidents · last seen 2024-02-29 · — records
TeamPCP
4 incidents · last seen 2026-08-19 · — records
BlackSuit
3 incidents · last seen 2024-08-28 · 1.9M records
Termite
3 incidents · last seen 2025-02-26 · — records
Sp1d3r
3 incidents · last seen 2024-06-21 · 1.1M records
Orova
3 incidents · last seen 2026-08-09 · — records
Panzer
3 incidents · last seen 2026-08-14 · — records
The Gentlemen
2 incidents · last seen 2026-08-17 · — records
stormous
2 incidents · last seen 2025-06-24 · — records
Space Bears
2 incidents · last seen 2025-06-19 · — records
direwolf
2 incidents · last seen 2026-08-13 · — records
CoinbaseCartel
2 incidents · last seen 2026-08-24 · — records
AKIRA
2 incidents · last seen 2025-05-20 · — records
everest
2 incidents · last seen 2026-08-24 · — records
Scattered LAPSUS$ Hunters
2 incidents · last seen 2025-10-06 · 1000.5M records
Anubis
2 incidents · last seen 2026-05-27 · — records
SpaceBears
2 incidents · last seen 2026-08-11 · — records
Incransom
2 incidents · last seen 2026-05-29 · — records
EMBARGO
2 incidents · last seen 2025-05-26 · — records
Hellcat
2 incidents · last seen 2024-11-08 · — records
Brain Cipher
2 incidents · last seen 2024-12-09 · — records
BianLian
2 incidents · last seen 2024-06-24 · — records
Nightspire
2 incidents · last seen 2026-08-19 · — records
Lamashtu
2 incidents · last seen 2026-05-30 · — records
Majinahanashi
2 incidents · last seen 2026-08-16 · — records
Hatman
2 incidents · last seen 2026-08-21 · — records
Lazarus
2 incidents · last seen 2026-08-12 · — records
INC Ransom
2 incidents · last seen 2025-06-01 · 743K records
REvil
2 incidents · last seen 2024-05-10 · — records

This is the public cut. The desk sees the rest.

ColdRecon turns this signal into a daily brief and a live detection-coverage console. Request clearance.

Request Clearance →