Home › Ransomware

Ransomware Groups Targeting Government & Defense

97 active ransomware groups targeting Government & Defense, ranked by claimed victims tracked in the Ninja Signal graph.

GroupClaimed victims in Government & DefenseSanctioned
LockBit131⚠ Yes
RansomHub44—
TheGentlemen32—
Qilin32—
BlackCat / ALPHV27—
Rhysida25—
Everest23—
INC Ransom22—
Pysa19—
Play16—
Hunters International16—
Vice Society15—
Apt7314—
RansomHouse12—
Avaddon12—
KillSecurity11—
Booba Project11—
Snatch9—
Medusa9—
BlackSuit9—
Stormous8—
NoEscape8—
Conti / Wizard Spider8⚠ Yes
Cl0p8—
BlackByte8—
8Base8—
Royal7—
RansomEXX7—
Nova7—
Krybit7—
Kairos7—
Emperador7—
Arcus Media7—
Interlock6—
FLocker6—
Cuba6—
Akira6—
Panzer5—
Onyx5—
Meow5—
MedusaLocker5—
Safepay4—
Quantum4—
Payload4—
NightSpire4—
LostTrust4—
Hive4—
DragonForce4—
Deadlock4—
Bashe4—
Wallstreet3—
3AM3—
Monti3—
Marketo3—
Lorenz3—
Eldorado3—
Black Basta3—
Trigona2—
Storm2—
RA Group2—
Lynx2—
Fog2—
Embargo2—
Donut Leaks2—
Dispossessor2—
Cactus2—
BianLian2—
Arvin Club2—
Abyss2—
Termite1—
SunCrypt1—
Spook1—
SpaceBears1—
Settra1—
REvil1—
RansomedVC1—
RagnarLocker1—
Pear1—
Payload Bin1—
Orova1—
Nokoyawa1—
Nitrogen1—
N0n1—
Money Message1—
Midas1—
MetaEncryptor1—
Mallox1—
LV1—
Knight1—
Karakurt1—
Helldown1—
Global Secret Group1—
Genesis1—
CRPxO1—
CMD Organization1—
Cloak1—
Audit Team1—

See every group on the ransomware index, read the analysis on the blog, or track new Government & Defense victims each morning in the Daily.

Track it daily

Ransomware moves every day. So does our paper.

The Probably Fine Daily is our morning threat-intelligence briefing — new victims, new groups, what actually matters, in plain English. Free.

Read today's Daily →Browse the archive