Ransomware Groups Targeting Hospitality
84 active ransomware groups targeting Hospitality, ranked by claimed victims tracked in the Ninja Signal graph.
| Group | Claimed victims in Hospitality | Sanctioned |
|---|---|---|
| LockBit | 75 | ⚠ Yes |
| Qilin | 27 | — |
| Play | 27 | — |
| Akira | 20 | — |
| RansomHub | 16 | — |
| DragonForce | 16 | — |
| Cl0p | 16 | — |
| TheGentlemen | 14 | — |
| BlackCat / ALPHV | 13 | — |
| INC Ransom | 10 | — |
| 8Base | 8 | — |
| Snatch | 7 | — |
| BianLian | 7 | — |
| Settra | 6 | — |
| NightSpire | 6 | — |
| Medusa | 6 | — |
| Hunters International | 6 | — |
| Cactus | 6 | — |
| Arcus Media | 6 | — |
| Stormous | 5 | — |
| Conti / Wizard Spider | 5 | ⚠ Yes |
| Safepay | 4 | — |
| Payload | 4 | — |
| Orova | 4 | — |
| LV | 4 | — |
| Krybit | 4 | — |
| Black Basta | 4 | — |
| RansomHouse | 3 | — |
| Pysa | 3 | — |
| Nova | 3 | — |
| Majinahanashi | 3 | — |
| Lynx | 3 | — |
| Lamashtu | 3 | — |
| KillSecurity | 3 | — |
| Fog | 3 | — |
| Deadlock | 3 | — |
| DarkVault | 3 | — |
| Apt73 | 3 | — |
| Vice Society | 2 | — |
| SpaceBears | 2 | — |
| Rhysida | 2 | — |
| Pear | 2 | — |
| PayoutsKing | 2 | — |
| Nitrogen | 2 | — |
| N0n | 2 | — |
| Gunra | 2 | — |
| Everest | 2 | — |
| Dark Project | 2 | — |
| BlackSuit | 2 | — |
| BlackByte | 2 | — |
| Bashe | 2 | — |
| Arvin Club | 2 | — |
| ZaWoo | 1 | — |
| Vexy Ransomware | 1 | — |
| Trigona | 1 | — |
| 3AM | 1 | — |
| Storm | 1 | — |
| Spook | 1 | — |
| Sarcoma | 1 | — |
| Royal | 1 | — |
| RansomEXX | 1 | — |
| RagnarLocker | 1 | — |
| Quantum | 1 | — |
| Monti | 1 | — |
| Meow | 1 | — |
| MedusaLocker | 1 | — |
| Mallox | 1 | — |
| LostTrust | 1 | — |
| Karakurt | 1 | — |
| Interlock | 1 | — |
| Global Secret Group | 1 | — |
| Genesis | 1 | — |
| Emperador | 1 | — |
| Embargo | 1 | — |
| Donut Leaks | 1 | — |
| Dispossessor | 1 | — |
| Direwolf | 1 | — |
| Cloak | 1 | — |
| Cicada3301 | 1 | — |
| Chaos | 1 | — |
| Booba Project | 1 | — |
| Aurora | 1 | — |
| Anubis | 1 | — |
| Abyss | 1 | — |
See every group on the ransomware index, read the analysis on the blog, or track new Hospitality victims each morning in the Daily.
Track it daily
Ransomware moves every day. So does our paper.
The Probably Fine Daily is our morning threat-intelligence briefing — new victims, new groups, what actually matters, in plain English. Free.
Read today's Daily →Browse the archive