Ransomware IOCs

79 groups with public IOCs · 1,601 total indicators. Click a group to see its hashes, IPs, wallets, and more. Source: ransomware.live.

Groups with published IOCs

#	Group	IOC types · counts	Total
1	akira	btc 7 md5 320 sha256 37	364
2	raworld	ip 1 md5 209 tox 1	211
3	bianlian	ip 191 md5 8	199
4	trigona	md5 114	114
5	qilin	ftp 2 ip 5 md5 54	61
6	fog	md5 53	53
7	hellokitty	md5 52	52
8	cactus	md5 50	50
9	anubis	ip 4 md5 25 twitter 1	30
10	rhysida	md5 28	28
11	blacknevas	sha256 27	27
12	lockbit3	ip 10 md5 16	26
13	dragonforce	ip 1 md5 22 tox 1	24
14	medusa	email 2 md5 18 telegram 1 tox 3	24
15	medusalocker	sha256 19 tox 1	20
16	interlock	ip 3 md5 9 sha256 3 url 4	19
17	lynx	md5 19	19
18	sicarii	pgp 18 tox 1	19
19	Sorry	ip 15 sha256 2	17
20	braincipher	email 3 md5 12	15
21	benzona	ip 1 md5 1 pgp 9 sha256 1 tox 1	13
22	lockbit5	md5 13	13
23	beast	ip 1 mail 8 session 1 sha256 1 tox 1	12
24	vanhelsing	btc 2 ip 2 md5 7 tox 1	12
25	bert	ip 2 md5 9	11
26	Ghostsec	ip 1 sha256 4 url 5	10
27	nitrogen	md5 6 tox 4	10
28	chaos	ip 3 md5 3 sha256 3	9
29	nightspire	email 4 sha256 2 telegram 2 tox 1	9
30	termite	ip 2 md5 2 sha-1 2 sha-256 2	8
31	bqtlock	telegram 5 twitter 1 xmr 1	7
32	datacarry	email 1 ip 2 md5 1 session 1 sha256 2	7
33	j	md5 6	6
34	promptlock	sha1 6	6
35	ralord	ip 1 md5 2 session 1 tox 2	6
36	bluelocker	sha256 4 tox 1	5
37	devman	ip 3 tox 1 twitter 1	5
38	gunra	ip 1 md5 4	5
39	shinyhunters	email 1 telegram 4	5
40	thegentlemen	sha1 4 tox 1	5
41	0apt	md5 4	4
42	warlock	sha256 1 tox 3	4
43	crazyhunter	telegram 2 tox 1	3
44	kawa4096	email 1 sha256 1 tox 1	3
45	shinysp1d3r	sha256 3	3
46	weyhro	ip 2 tox 1	3
47	GDLockrSec	tox 1 twitter 1	2
48	ailock	md5 1 sha256 1	2
49	bluebox	email 1 tox 1	2
50	cry0	ip 1 tox 1	2
51	crypto24	email 1 ip 1	2
52	d4rk4rmy	tox 2	2
53	frag	email 2	2
54	nova	session 1 tox 1	2
55	obscura	sha256 1 tox 1	2
56	pear	email 1 tox 1	2
57	radar	session 1 tox 1	2
58	thegreenbloodgroup	email 1 tox 1	2
59	Bashe	ip 1	1
60	arkana	session 1	1
61	blacklock	md5 1	1
62	blackshrantac	tox 1	1
63	blacksuit	ip 1	1
64	cephalus	ip 1	1
65	cloak	md5 1	1
66	exitium	tox 1	1
67	global	session 1	1
68	insomnia	tox 1	1
69	lapsus$	sha256 1	1
70	lunalock	email 1	1
71	minteye	tox 1	1
72	ms13089	email 1	1
73	payload	sha256 1	1
74	payoutsking	tox 1	1
75	satanlockv2	tox 1	1
76	securotrop	tox 1	1
77	skira	session 1	1
78	teamxxx	ip 1	1
79	toufan	tox 1	1