EudorIACyber Intelligence
Operational monitoring Newsletter IT EN
Global observatory

Ransomware worldwide

Organizations named in claims, affected countries and the most active groups. An overview updated from public sources.

See the latest cases
Sources up to date Last collection Sources and methodology
The period at a glancelast 30 days · All data follows the selected filters
Reported cases82matching reports grouped into cases
In the last 24 hours1first public report
Countries involved3272 cases with a known country
Groups in the claims34in the selected period
Reset filters
Where it happens

Countries of reported organizations

72 mapped cases
World map of victim countries stated in public claims

Hover for details. Click a country to zoom in, then drag the map to pan.

The map shows the country of organizations named by the sources.
  1. 0
  2. 1–9
  3. 10–99
  4. 100–999
  5. 1.000–9.999
  6. 10.000+

72 / 82 cases with a usable country · 10 without usable country data.

How it is evolving

Reporting trend

Cases per day · UTC

Date first reported by the sources, which may differ from the attack date. The current period is incomplete.

8 Reporting trend82 reported cases. Values are available in the table below the chart.28/08: 329/08: 430/08: 131/08: 601/09: 702/09: 203/09: 004/09: 205/09: 106/09: 007/09: 208/09: 209/09: 310/09: 311/09: 212/09: 213/09: 114/09: 815/09: 116/09: 017/09: 618/09: 719/09: 220/09: 221/09: 422/09: 223/09: 624/09: 025/09: 326/09: 0
28/0826/09
View chart values
PeriodReported cases
2026-08-283
2026-08-294
2026-08-301
2026-08-316
2026-09-017
2026-09-022
2026-09-030
2026-09-042
2026-09-051
2026-09-060
2026-09-072
2026-09-082
2026-09-093
2026-09-103
2026-09-112
2026-09-122
2026-09-131
2026-09-148
2026-09-151
2026-09-160
2026-09-176
2026-09-187
2026-09-192
2026-09-202
2026-09-214
2026-09-222
2026-09-236
2026-09-240
2026-09-253
2026-09-260
Who is claiming responsibility

Most active groups

Group profiles →
  1. The Gentlemen11 13%
  2. Qilin10 12%
  3. everest5 6%
  4. audit team4 5%
  5. Brain Cipher4 5%
  6. unsafe4 5%

Share of cases in the period, by the group named by the sources.

Who is affected

Organization sectors

82 / 82
  1. Technology82 100%

Classification reported by the sources. 0 cases without a usable sector.

What is happening

Latest reported cases

1–25 / 82

Open a case to review its sources. A claim does not establish a confirmed compromise.

First reportedOrganisationGroupCountrySectorSources
15:33 UTC UNIRITA3 aggregated matches everest Japan TechnologyRansomLook · ransomware.live
11:36 UTC FTAPI Software2 aggregated matches The Gentlemen United States TechnologyRansomLook · ransomware.live
03:21 UTC TapClicks (marketing analytics platform) N0n United States Technologyransomware.live
15:21 UTC Trump Mobile EndZone United States Technologyransomware.live
14:39 UTC CLOUD-CLEARWAYGROUP.COM2 aggregated matches clop United States TechnologyRansomLook · ransomware.live
14:38 UTC KVHELI-WORDPRESS.COM2 aggregated matches clop Georgia TechnologyRansomLook · ransomware.live
14:35 UTC INFINIGATE.CH(INFINIGATE.CO.UK)2 aggregated matches clop United Kingdom TechnologyRansomLook · ransomware.live
11:51 UTC Inkript2 aggregated matches Qilin Not reported TechnologyRansomLook · ransomware.live
07:40 UTC Seznam medusalocker Czech Republic Technologyransomware.live
17:22 UTC AFRICA-TECH (IT services / document processing)2 aggregated matches N0n Mali TechnologyRansomLook · ransomware.live
10:18 UTC Columbus Informatica2 aggregated matches Qilin Italy TechnologyRansomLook · ransomware.live
19:23 UTC kyyba.com2 aggregated matches unsafe Finland TechnologyRansomLook · ransomware.live
17:22 UTC Telrad Networks2 aggregated matches Qilin Israel TechnologyRansomLook · ransomware.live
13:05 UTC HyVision System. Inc2 aggregated matches metaencryptor South Korea TechnologyRansomLook · ransomware.live
13:04 UTC Visual Intelligence, Inc.2 aggregated matches metaencryptor United States TechnologyRansomLook · ransomware.live
14:11 UTC acilnet.com2 aggregated matches Krybit Turkey TechnologyRansomLook · ransomware.live
06:24 UTC TOWILL bravox United States Technologyransomware.live
16:53 UTC Schneider’s Computing2 aggregated matches Arcus Media Canada TechnologyRansomLook · ransomware.live
16:20 UTC voltgames.io2 aggregated matches unsafe Not reported TechnologyRansomLook · ransomware.live
22:23 UTC Quest Group3 aggregated matches anubis United States TechnologyRansomLook · ransomware.live
19:51 UTC Inter (Venezuela's largest internet provider)3 aggregated matches N0n Venezuela, Bolivarian Republic of TechnologyRansomLook · ransomware.live
10:12 UTC Ascend Com2 aggregated matches Qilin Singapore TechnologyRansomLook · ransomware.live
07:06 UTC ATT2 aggregated matches EndZone United States TechnologyRansomLook · ransomware.live
07:03 UTC ANYTHINGIT2 aggregated matches Spirals Not reported TechnologyRansomLook · ransomware.live
00:23 UTC Inovapy3 aggregated matches Panzer Paraguay TechnologyRansomLook · ransomware.live
Sources, coverage and methodology

This observatory describes claims in the monitored sources: worldwide ransomware coverage is partial. Reported cases are not a count of confirmed attacks or unique victims.

Reports with the same organization and group name, within 30 days of the first report, are grouped into one case. Letter case, spacing and known aliases are normalized; different names may still refer to the same organization.

160 source reports for 82 reported cases. Country and sector come from the sources: missing or conflicting data remains unassigned. Dates use UTC; the collection date is used if no publication date is available.

RansomLookLast successful collection
ransomware.liveLast successful collection

General articles, group profiles and technical portal checks are excluded from the counts.

View onion portal diagnostics →