Ransomware

Anubis is a Ransomware-as-a-Service (RaaS) operation active since December 2024, originally developed under the codename Sphinx. It combines file encryption and data exfiltration with a

What is NightSpire ransomware? NightSpire is a ransomware threat group that first appeared in February 2025. Initially focused on data theft and extortion, the group

SafePay is a centralized ransomware operation that emerged in late 2024 and became one of the most active threat groups globally by mid-2025, with over

What is Gentlemen ransomware? Gentlemen is a ransomware operation that emerged in mid-2025 and has rapidly established itself as one of the most active and

Sinobi is a ransomware operation that emerged in mid-2025 and quickly became a significant threat to organizations across multiple sectors. The group operates under a

INC ransomware is a ransomware-as-a-service (RaaS) operation that emerged in mid-2023 and rapidly established itself as a significant threat to organizations worldwide. The group employs

Dire Wolf is a human-operated ransomware operation first documented in 2025 and linked to targeted, financially motivated intrusions. Dire Wolf uses a double-extortion model, combining

Qilin (also known as Agenda) is a ransomware-as-a-service (RaaS) operation active since at least 2022, used in financially motivated double-extortion campaigns that combine system encryption

DragonForce is a ransomware-as-a-service (RaaS) operation that first gained public attention in 2023. It operates through a model in which core operators provide ransomware tooling

Key takeaways: Lazarus operates as a modular organization: TraderTraitor (crypto), BlueNoroff (banking/SWIFT), Andariel (espionage/ransomware) Financial theft operations are often followed by destructive wiper deployment (Whiskey