Home › Ransomware

Most Active Ransomware Groups: November 2026

49 profiled groups posted 1,007 claims in the last 30 days. The busiest were N0n, Qilin, TheGentlemen.

By Ninja Labz · updated 2026-11-09 · from leak-site claims

#GroupClaims, last 30 daysPrevious 30 daysLatest claim
1N0n197222026-11-09
2Qilin131812026-11-07
3TheGentlemen1221222026-11-05
4Akira40362026-11-08
5Silent Ransom Group32182026-11-07
6Booba Project27152026-11-03
7LockBit24162026-11-08
8INC Ransom23282026-11-08
9Emperador22242026-10-31
10BrainCipher21122026-11-06
11Play21142026-11-04
12Everest20112026-10-27
13Majinahanashi2002026-10-31
14Rhysida20142026-11-07
15Safepay20342026-11-07
16Settra19222026-11-06
17Wallstreet19162026-10-30
18MedusaLocker18132026-11-04
19Orova1722026-11-09
20Payload1522026-11-07
21Audit Team14242026-11-05
22Aurora1442026-10-30
23Genesis1262026-11-06
24NightSpire12142026-11-07
25Pear1162026-11-05
26Dark Project1012026-11-05
27Deadlock952026-11-08
28MetaEncryptor9142026-11-07
29DragonForce8112026-10-30
30Interlock792026-10-21

Counts are groups' own leak-site claims, dated when our trackers first saw them. They are not independently verified, batches land late, and old victims are sometimes re-posted. A high count means a group is posting a lot, which is not the same as causing the most harm.

See every group we profile, or get this in your inbox each morning with the Daily.

Track it daily

Ransomware moves every day. So does our paper.

The Probably Fine Daily is our morning threat-intelligence briefing — new victims, new groups, what actually matters, in plain English. Free.

Read today's Daily →Browse the archive