One moment, our live darknet feed is loading
Once the feed arrives, the most active ransomware groups appear here.
Threat Actors
Ransomware Victim Watch
Live-Uebersicht von Gruppen und behaupteten Opfern
Diese Ebene zeigt standardmaessig potenzielle Opfer aus den letzten 3 Tagen. Nutzen Sie die Suche fuer gespeicherte Historie.
Victim
Group
Country / sector
Claim date
Feed loading
...
...
...
Victim Digest
Neue Opferclaims per E-Mail erhalten
Waehlen Sie eine taegliche oder woechentliche Uebersicht. Die E-Mail macht klar, dass es um Feed-Claims geht, nicht um bestaetigte Vorfaelle.
Log in or create a free account
We link this email preference to your account, so you can later choose daily, weekly or off yourself.
Featured dossiers
Actor profiles that belong here first
Not because these are the only relevant actors, but because they show how different motivation, access and impact can be.
Qilin / ransomware clusters
Double extortion, supply chain pressure and rapid impact on production and healthcare environments.
- Access: Edge exposure, brokers, misconfigurations and stolen credentials.
- Watch for: Privilege escalation, data theft tooling and pressure on business continuity.
APT29 / diplomatic espionage
Longer dwell time, quiet cloud abuse scenarios and high-value targets.
- Access: Phishing, OAuth abuse, trusted cloud channels and stealthy persistence.
- Watch for: Identity hygiene, mailbox rules, delegated grants and admin activity.
Scattered Spider-like operators
Social engineering, helpdesk abuse and cloud access through identity bypass.
- Access: SIM swap, helpdesk routes, MFA fatigue and privilege abuse.
- Watch for: Conditional Access, admin separation and recovery accounts.
Actor families
Which main groups matter most for organisations
The live version should show a clear pattern not only per actor, but also per actor family.
Ransomware operators
The highest visibility is often around ransomware groups, but the real value of actor profiling lies in access patterns, brokers, tooling and the pace at which business pressure is created.
- Strong focus on impact, public pressure and recovery cost
- Often dependent on IABs, exposed edge or identity abuse
- Highly relevant to leadership, continuity and insurability
Espionage and state-linked actors
This is less about visible disruption and more about quiet access, long-term presence and targeted information advantage. Executive relevance sits mainly in provability, governance and confidentiality.
- More stealth, longer dwell time and more cloud-focused tradecraft
- Strong emphasis on identities, mail and app access
- More relevant to government, semi-public and diplomatic chains
Ecosystem actors and brokers
Not every actor is the final attacker. Brokers, stealer ecosystems and access resellers create the fuel other campaigns build on. That layer is critical for early warning.
- Credentials and sessions are the core issue
- Strong overlap with infostealers, phishing and dark web resale
- Highly relevant for monitoring and access hygiene prioritisation