Ransomware Groups Targeting Education
87 active ransomware groups targeting Education, ranked by claimed victims tracked in the Ninja Signal graph.
| Group | Claimed victims in Education | Sanctioned |
|---|---|---|
| LockBit | 135 | ⚠ Yes |
| Vice Society | 57 | — |
| Pysa | 51 | — |
| Rhysida | 46 | — |
| RansomHub | 40 | — |
| Qilin | 33 | — |
| INC Ransom | 33 | — |
| TheGentlemen | 30 | — |
| Fog | 27 | — |
| Cl0p | 27 | — |
| BianLian | 20 | — |
| BlackCat / ALPHV | 20 | — |
| Akira | 20 | — |
| Medusa | 18 | — |
| BlackSuit | 18 | — |
| Royal | 17 | — |
| Hive | 13 | — |
| Snatch | 12 | — |
| RansomHouse | 10 | — |
| Safepay | 8 | — |
| NoEscape | 8 | — |
| Krybit | 8 | — |
| Karakurt | 8 | — |
| Interlock | 8 | — |
| Booba Project | 8 | — |
| Nova | 7 | — |
| NightSpire | 7 | — |
| Monti | 7 | — |
| 8Base | 7 | — |
| Stormous | 6 | — |
| Meow | 6 | — |
| Kairos | 6 | — |
| FLocker | 6 | — |
| CMD Organization | 6 | — |
| Wallstreet | 5 | — |
| Payload | 5 | — |
| Nokoyawa | 5 | — |
| LostTrust | 5 | — |
| KillSecurity | 5 | — |
| Arvin Club | 5 | — |
| Panzer | 4 | — |
| MedusaLocker | 4 | — |
| Eldorado | 4 | — |
| DragonForce | 4 | — |
| Direwolf | 4 | — |
| Conti / Wizard Spider | 4 | ⚠ Yes |
| BlackByte | 4 | — |
| 3AM | 3 | — |
| Quantum | 3 | — |
| Payload Bin | 3 | — |
| Emperador | 3 | — |
| Avaddon | 3 | — |
| Arcus Media | 3 | — |
| World Leaks | 2 | — |
| Termite | 2 | — |
| SunCrypt | 2 | — |
| Storm | 2 | — |
| REvil | 2 | — |
| Play | 2 | — |
| N0n | 2 | — |
| Hunters International | 2 | — |
| Global Secret Group | 2 | — |
| Everest | 2 | — |
| Dispossessor | 2 | — |
| dAn0n | 2 | — |
| Cuba | 2 | — |
| Cactus | 2 | — |
| Audit Team | 2 | — |
| Apt73 | 2 | — |
| Vexy Ransomware | 1 | — |
| Trigona | 1 | — |
| RansomEXX | 1 | — |
| RansomedVC | 1 | — |
| RagnarLocker | 1 | — |
| Nitrogen | 1 | — |
| Money Message | 1 | — |
| MetaEncryptor | 1 | — |
| Lynx | 1 | — |
| Knight | 1 | — |
| FulcrumSec | 1 | — |
| DarkVault | 1 | — |
| Dark Project | 1 | — |
| Cloak | 1 | — |
| Chaos | 1 | — |
| BrainCipher | 1 | — |
| AiLock | 1 | — |
| Abyss | 1 | — |
See every group on the ransomware index, read the analysis on the blog, or track new Education victims each morning in the Daily.
Track it daily
Ransomware moves every day. So does our paper.
The Probably Fine Daily is our morning threat-intelligence briefing — new victims, new groups, what actually matters, in plain English. Free.
Read today's Daily →Browse the archive