Ransomware Radar
The 25 busiest ransomware crews, ranked by how far claims sit above their baseline.
Loading ransomware activity
Fetching claimed victims per crew from the pwnsy data API.
Each dot is a crew. Further from the centre means more claims in the window; colour shows how far that sits above the crew's own normal. Click a dot to open the crew; click empty space to show all again. Leak-site claims, unverified.
Background readingRansomware as a serviceAnatomy of an attackInitial access brokers
Leak-site claims, unverified. Merged from RansomLook and ransomwatch.
Sectors hit (tap a crew to open it)
Latest claims
How the radar works
Windows are anchored on the newest record in the feed. Recent and prior are the last 90 days and the 90 before; momentum is the change. Spike is a z-score against the crew's previous 11 months: 1 or more is a spike, 2 or more a strong one.
Claims are self-reported and can be inflated or reposted. Sectors come from a keyword classifier. Top 3 share and HHI measure how concentrated claims are.
FAQ
What does the spike score mean?
A z-score of the latest month against the previous 11 months; 1 or more counts as a spike. Early in a month most crews show a negative score.
What are recent, prior and momentum?
Claims in the last 90 days of the feed and the 90 before; momentum is the change. No prior claims shows n/a.
Where do the claims come from?
Leak-site posts collected by RansomLook and the archived ransomwatch project. They are the groups' own claims and can be inflated or reposted.
How are victim sectors assigned?
A keyword classifier on victim names. Most names stay unclassified, so the sector mix covers only the matched share.
What does the sanctioned flag mean?
The crew appears in an OFAC or UK designation, linked with its date. Paying it can breach sanctions law.
Data: pwnsy data API, merged from RansomLook and the archived ransomwatch leak-site feeds.