Ransomware IOCs

167 groups with public IOCs · 2,269 total indicators. Click a group to see its hashes, IPs, wallets, and more. Source: ransomware.live.

Groups with published IOCs

#	Group	IOC types · counts	Total
1	akira	btc 7 ip 1 md5 320 mutex 2 sha256 37	367
2	raworld	ip 2 md5 209 tox 2	213
3	bianlian	email 1 ip 191 md5 8 tox 1	201
4	clop	email 11 ip 180	191
5	trigona	email 1 md5 114	115
6	thegentlemen	email 2 md5 47 session 1 sha1 4 sha256 34 tox 6	94
7	qilin	ftp 2 ip 5 md5 54 tox 1	62
8	cactus	email 3 md5 50 tox 1	54
9	fog	md5 53	53
10	hellokitty	md5 52	52
11	crpxo	domain 3 ip 11 md5 16 session 1 tox 1 url 5	37
12	anubis	ip 4 md5 25 twitter 2	31
13	gunra	email 3 ip 1 md5 16 session 1 tox 4 url 5	30
14	rhysida	md5 28	28
15	blacknevas	sha256 27	27
16	lockbit	ip 10 md5 16	26
17	lockbit3	ip 10 md5 16	26
18	medusa	email 3 md5 18 telegram 2 tox 3	26
19	dragonforce	ip 1 md5 22 pgp 1 tox 1	25
20	medusalocker	email 2 registrykey 1 sha256 20 tox 2	25
21	beast	email 12 ip 1 mail 8 session 1 sha256 1 tox 1	24
22	lynx	email 1 md5 19	20
23	embargo	md5 18 tox 1	19
24	interlock	ip 3 md5 9 sha256 3 url 4	19
25	sicarii	pgp 18 tox 1	19
26	majinahanashi	email 2 md5 5 sha1 5 sha256 5 tox 1	18
27	Sorry	ip 15 sha256 2	17
28	braincipher	email 4 md5 12	16
29	termite	ip 2 md5 3 sha-1 2 sha-256 2 sha1 3 sha256 3	15
30	nightspire	email 5 session 1 sha256 2 telegram 3 tox 3	14
31	benzona	ip 1 md5 1 pgp 9 sha256 1 tox 1	13
32	bqtlock	telegram 10 twitter 2 xmr 1	13
33	lockbit5	md5 13	13
34	bert	ip 2 md5 9 session 1	12
35	vanhelsing	btc 2 ip 2 md5 7 tox 1	12
36	nitrogen	md5 6 tox 5	11
37	shinyhunters	email 1 ip 2 telegram 8	11
38	Ghostsec	ip 1 sha256 4 url 5	10
39	chaos	ip 3 md5 3 sha256 3	9
40	8base	email 5 telegram 2	7
41	bluelocker	email 2 sha256 4 tox 1	7
42	datacarry	email 1 ip 2 md5 1 session 1 sha256 2	7
43	krybit	md5 4 session 1 tox 2	7
44	babuk2	email 1 pgp 1 session 1 telegram 2 tox 1	6
45	d1r	email 1 ip 1 session 1 telegram 2 tox 1	6
46	devman	ip 3 tox 1 twitter 2	6
47	j	md5 6	6
48	kazu	email 2 ip 1 pgp 1 session 2	6
49	promptlock	sha1 6	6
50	ralord	ip 1 md5 2 session 1 tox 2	6
51	crazyhunter	telegram 4 tox 1	5
52	noname	email 3 tox 2	5
53	ragnarok	email 5	5
54	0apt	md5 4	4
55	blackfield	email 3 tox 1	4
56	darkangels	email 2 session 1 tox 1	4
57	doppelpaymer	email 4	4
58	eclipse	certificate 1 pgp 1 session 1 tox 1	4
59	endzone	email 1 pgp 1 session 1 tox 1	4
60	goddamn ransomwhere	email 3 tox 1	4
61	incransom	ip 2 sha256 2	4
62	payload	mutex 1 sha256 2 tox 1	4
63	ransomhouse	telegram 4	4
64	warlock	sha256 1 tox 3	4
65	GDLockrSec	tox 1 twitter 2	3
66	crypto24	email 1 ip 1 session 1	3
67	cuba	email 3	3
68	everest	email 1 mutex 1 sha256 1	3
69	exfilsquad	email 1 tox 2	3
70	karma	email 3	3
71	kawa4096	email 1 sha256 1 tox 1	3
72	killsec	session 1 telegram 1 tox 1	3
73	metaencryptor	ip 1 url 2	3
74	montage	email 2 sha256 1	3
75	nefilim	email 3	3
76	nova	session 1 tox 2	3
77	obscura	sha256 1 tox 2	3
78	panzer	certificate 1 pgp 1 tox 1	3
79	play	email 3	3
80	settra	ip 2 tox 1	3
81	shinysp1d3r	sha256 3	3
82	weyhro	ip 2 tox 1	3
83	ailock	md5 1 sha256 1	2
84	blacklocks	session 1 tox 1	2
85	bluebox	email 1 tox 1	2
86	bolt team	tox 2	2
87	cloak	email 1 md5 1	2
88	cry0	ip 1 tox 1	2
89	d4rk4rmy	tox 2	2
90	darkmatter	pgp 1 tox 1	2
91	doommageddon	session 1 sha256 1	2
92	dysphor1a	telegram 2	2
93	esxiargs	btc 1 tox 1	2
94	exitium	tox 2	2
95	frag	email 2	2
96	fulcrumsec	session 1 tox 1	2
97	helix	certificate 1 pgp 1	2
98	hellcat	email 1 tox 1	2
99	helldown	email 1 tox 1	2
100	lapsus$	session 1 sha256 1	2
101	mallox	email 2	2
102	netrunner	email 1 tox 1	2
103	orova	md5 1 tox 1	2
104	payday	email 1 sha256 1	2
105	payoutsking	tox 2	2
106	pear	email 1 tox 1	2
107	prinzeugen	btc 1 email 1	2
108	radar	session 1 tox 1	2
109	ranzy	email 2	2
110	rook	email 2	2
111	snatch	email 2	2
112	tengu	tox 2	2
113	the green blood group	email 1 tox 1	2
114	thegreenbloodgroup	email 1 tox 1	2
115	xpl0itrs	session 1 tox 1	2
116	0day syndicate	ip 1	1
117	Bashe	ip 1	1
118	abyss	tox 1	1
119	arkana	session 1	1
120	atomsilo	email 1	1
121	barracuda	email 1	1
122	black x	email 1	1
123	blacklock	md5 1	1
124	blackshrantac	tox 1	1
125	blacksuit	ip 1	1
126	bluewhale	email 1	1
127	booba project	email 1	1
128	cephalus	ip 1	1
129	chilelocker	email 1	1
130	coinbasecartel	tox 1	1
131	dark project	tox 1	1
132	darkbit	tox 1	1
133	dataleak	tox 1	1
134	falcon	pgp 1	1
135	flocker	session 1	1
136	global	session 1	1
137	global secret group	tox 1	1
138	icarus	session 1	1
139	insomnia	tox 1	1
140	l group	email 1	1
141	lunalock	email 1	1
142	m3rx	tox 1	1
143	meowciety403	telegram 1	1
144	minteye	tox 1	1
145	morpheus	email 1	1
146	ms13089	email 1	1
147	orion	tox 1	1
148	prolock	email 1	1
149	rancoz	email 1	1
150	ransomexx	email 1	1
151	redact	tox 1	1
152	reynolds	tox 1	1
153	satanlockv2	tox 1	1
154	securotrop	tox 1	1
155	sensayq	email 1	1
156	shiba	tox 1	1
157	skira	session 1	1
158	slug	session 1	1
159	sovcali	session 1	1
160	teamxxx	ip 1	1
161	timc	tox 1	1
162	toufan	tox 1	1
163	trinity	email 1	1
164	u-bomb	email 1	1
165	vect	tox 1	1
166	vexy ransomware	tox 1	1
167	wallstreet	tox 1	1