Home › Ransomware

Ransomware Groups Targeting Energy & Utilities

98 active ransomware groups targeting Energy & Utilities, ranked by claimed victims tracked in the Ninja Signal graph.

GroupClaimed victims in Energy & UtilitiesSanctioned
LockBit83⚠ Yes
Qilin35—
BlackCat / ALPHV35—
TheGentlemen27—
RansomHub27—
Play24—
Cl0p22—
Hunters International18—
Akira16—
BianLian15—
Conti / Wizard Spider14⚠ Yes
Lynx13—
Everest12—
RansomHouse10—
Medusa10—
DragonForce10—
Royal9—
Rhysida9—
Pysa9—
INC Ransom8—
RagnarLocker6—
NoEscape6—
Black Basta6—
Apt736—
8Base6—
Vice Society5—
Quantum5—
N0n5—
KillSecurity5—
Deadlock5—
Cactus5—
Snatch4—
RansomEXX4—
RansomedVC4—
Lamashtu4—
Hive4—
Global Secret Group4—
Fog4—
Emperador4—
Cloak4—
BlackByte4—
Avaddon4—
Settra3—
REvil3—
NightSpire3—
Money Message3—
Genesis3—
Cuba3—
CMD Organization3—
Wallstreet2—
Trigona2—
Stormous2—
RA Group2—
Payload2—
Panzer2—
Monti2—
MetaEncryptor2—
Majinahanashi2—
LV2—
Krybit2—
Karakurt2—
Gunra2—
Eldorado2—
Direwolf2—
Bravox2—
Bashe2—
Arcus Media2—
Anubis2—
Abyss2—
ZaWoo1—
World Leaks1—
Vexy Ransomware1—
Titan1—
3AM1—
Termite1—
Storm1—
SpaceBears1—
Sarcoma1—
Safepay1—
Pear1—
PayoutsKing1—
Orova1—
Nova1—
Nokoyawa1—
Midas1—
MedusaLocker1—
Mallox1—
Lorenz1—
Kairos1—
Interlock1—
Helldown1—
Embargo1—
Dark Project1—
CiphBit1—
Chaos1—
BrainCipher1—
BlackSuit1—
Arvin Club1—

See every group on the ransomware index, read the analysis on the blog, or track new Energy & Utilities victims each morning in the Daily.

Track it daily

Ransomware moves every day. So does our paper.

The Probably Fine Daily is our morning threat-intelligence briefing — new victims, new groups, what actually matters, in plain English. Free.

Read today's Daily →Browse the archive