Ransomware Groups Attacking Spain
66 active ransomware groups attacking Spain, ranked by claimed victims tracked in the Ninja Signal graph.
| Group | Claimed victims in Spain | Sanctioned |
|---|---|---|
| LockBit | 58 | ⚠ Yes |
| Qilin | 31 | — |
| RansomHub | 17 | — |
| TheGentlemen | 13 | — |
| Deadlock | 11 | — |
| Safepay | 10 | — |
| INC Ransom | 8 | — |
| Cactus | 8 | — |
| Pysa | 7 | — |
| BlackCat / ALPHV | 7 | — |
| Hunters International | 6 | — |
| Vice Society | 5 | — |
| BrainCipher | 5 | — |
| RansomHouse | 4 | — |
| Krybit | 4 | — |
| Hive | 4 | — |
| Gunra | 4 | — |
| 8Base | 4 | — |
| Play | 3 | — |
| NoEscape | 3 | — |
| N0n | 3 | — |
| Lamashtu | 3 | — |
| Everest | 3 | — |
| DragonForce | 3 | — |
| BlackSuit | 3 | — |
| Black Basta | 3 | — |
| Trigona | 2 | — |
| 3AM | 2 | — |
| Stormous | 2 | — |
| SpaceBears | 2 | — |
| Sarcoma | 2 | — |
| RansomEXX | 2 | — |
| Panzer | 2 | — |
| Nova | 2 | — |
| NightSpire | 2 | — |
| Monti | 2 | — |
| MedusaLocker | 2 | — |
| M3RX | 2 | — |
| Lynx | 2 | — |
| Kairos | 2 | — |
| Fog | 2 | — |
| Direwolf | 2 | — |
| Booba Project | 2 | — |
| BlackByte | 2 | — |
| BianLian | 2 | — |
| Avaddon | 2 | — |
| Audit Team | 2 | — |
| World Leaks | 1 | — |
| Royal | 1 | — |
| RagnarLocker | 1 | — |
| Midas | 1 | — |
| Meow | 1 | — |
| Medusa | 1 | — |
| Mallox | 1 | — |
| Majinahanashi | 1 | — |
| KillSecurity | 1 | — |
| Global Secret Group | 1 | — |
| Emperador | 1 | — |
| Eldorado | 1 | — |
| Conti / Wizard Spider | 1 | ⚠ Yes |
| Cl0p | 1 | — |
| Aurora | 1 | — |
| Arcus Media | 1 | — |
| Akira | 1 | — |
| AiLock | 1 | — |
| Abyss | 1 | — |
See every group on the ransomware index, read the analysis on the blog, or track new Spain victims each morning in the Daily.
Track it daily
Ransomware moves every day. So does our paper.
The Probably Fine Daily is our morning threat-intelligence briefing — new victims, new groups, what actually matters, in plain English. Free.
Read today's Daily →Browse the archive