Threat groups
Named groups with 3 or more reports in 2026, across 50 tracked countries.
| Group | Kind | Reports | Confirmed | Countries | Latest |
|---|---|---|---|---|---|
| The Gentlemen | Ransomware | 47 | 5 | Indonesia, Vietnam, Thailand, Ireland, Singapore, South Africa, Malaysia, Saudi Arabia, Canada, Netherlands, Colombia, Bangladesh, Argentina, Pakistan, Egypt, Kenya, Philippines | 31 Oct 2026 |
| Qilin | Ransomware | 39 | 3 | Singapore, Malaysia, Chile, Philippines, Myanmar, Bangladesh, Thailand, Mexico, Argentina, Pakistan, Vietnam, New Zealand, Germany, Romania | 7 Nov 2026 |
| LockBit 5.0 | Ransomware | 9 | 1 | Thailand, Malaysia, Vietnam, Indonesia, Philippines, Egypt | 29 Oct 2026 |
| Everest | Ransomware | 9 | 1 | Singapore, United Arab Emirates, Sweden, Colombia, Indonesia, Taiwan | 27 Oct 2026 |
| Nova | Ransomware | 9 | 0 | Vietnam, Indonesia | 22 Jul 2026 |
| INC Ransom | Ransomware | 8 | 2 | Malaysia, Indonesia, Vietnam, Sweden, Singapore, Saudi Arabia, Cambodia | 31 Aug 2026 |
| ShinyHunters | Extortion | 8 | 8 | United States, United Kingdom, Malaysia, Singapore, Canada, Netherlands | 28 Aug 2026 |
| N0n | Extortion | 7 | 0 | Singapore, Indonesia, Vietnam, Saudi Arabia | 12 Oct 2026 |
| DireWolf | Ransomware | 6 | 1 | Malaysia, Thailand, Chile | 10 Sep 2026 |
| Payload | Ransomware | 6 | 0 | Malaysia, Vietnam, Ireland, Egypt, Thailand | 13 Jun 2026 |
| DYSPHOR1A | Unattributed | 6 | 0 | Myanmar, Indonesia, Thailand | 6 Sep 2026 |
| APT73 | Extortion | 6 | 0 | Thailand, Bangladesh, Kenya, Philippines | 21 May 2026 |
| Rhysida | Ransomware | 5 | 1 | Malaysia, Vietnam, Philippines, Germany | 30 Oct 2026 |
| Krybit | Ransomware | 5 | 0 | Vietnam, Singapore, Philippines, Thailand, Kenya | 26 Aug 2026 |
| Panzer | Ransomware | 5 | 0 | Indonesia, Thailand, Nigeria | 9 Oct 2026 |
| Coinbase Cartel | Extortion | 5 | 0 | Indonesia, Philippines, Vietnam | 22 Aug 2026 |
| World Leaks | Extortion | 5 | 1 | Pakistan, India, Thailand, Sri Lanka | 2 Jul 2026 |
| DragonForce | Ransomware | 5 | 0 | Thailand, Philippines, Sri Lanka, Vietnam, Brazil | 27 Jul 2026 |
| Handala | State-aligned | 5 | 1 | United Arab Emirates, Ireland, Saudi Arabia, Israel | 13 Apr 2026 |
| Orova | Ransomware | 4 | 0 | Malaysia, Singapore | 3 Nov 2026 |
| Emperador | Extortion | 4 | 0 | Brazil, Sweden, Vietnam, Philippines | 23 Sep 2026 |
| ByteToBreach | Extortion | 4 | 3 | Romania, Nigeria, Sweden, Mexico | 14 Jul 2026 |
| MARLANWG | Unattributed | 3 | 1 | Malaysia, Indonesia | 6 Nov 2026 |
| Eclipse | Ransomware | 3 | 0 | Singapore | 8 Oct 2026 |
| RansomHouse | Extortion | 3 | 0 | Indonesia | 2 Oct 2026 |
| DeathNote Hackers | Hacktivist | 3 | 0 | Philippines | 5 Nov 2026 |
| core849 | Unattributed | 3 | 1 | Philippines | 5 Nov 2026 |
| Deadlock | Ransomware | 3 | 0 | Philippines, Kenya, Nigeria | 10 Aug 2026 |
| Fingerprint | Extortion | 3 | 3 | Poland | 1 Oct 2026 |