Ransomware IOCs

179 groups with public IOCs · 2,433 total indicators. Click a group to see its hashes, IPs, wallets, and more. Source: ransomware.live.

Groups with published IOCs

#	Group	IOC types · counts	Total
1	akira	btc 7 ip 1 md5 320 mutex 2 sha256 37	367
2	raworld	ip 2 md5 209 tox 2	213
3	bianlian	email 1 ip 191 md5 8 tox 1	201
4	clop	email 11 ip 180	191
5	trigona	email 1 md5 114	115
6	thegentlemen	email 2 ip 8 md5 48 session 2 sha1 4 sha256 34 tox 6	104
7	qilin	ftp 2 ip 7 md5 54 tox 1	64
8	silentransomgroup	btc 61	61
9	dragonforce	ip 1 md5 55 pgp 2 tox 1 url 1	60
10	cactus	email 3 md5 50 tox 1	54
11	fog	md5 53	53
12	hellokitty	md5 52	52
13	crpxo	domain 3 ip 11 md5 16 session 1 tox 1 url 5	37
14	anubis	ip 4 md5 25 twitter 2	31
15	gunra	email 3 ip 1 md5 16 session 1 tox 4 url 5	30
16	rhysida	md5 28	28
17	blacknevas	sha256 27	27
18	embargo	md5 18 mutex 8 tox 1	27
19	lockbit	ip 10 md5 16	26
20	lockbit3	ip 10 md5 16	26
21	medusa	email 3 md5 18 telegram 2 tox 3	26
22	medusalocker	email 2 registrykey 1 sha256 20 tox 2	25
23	beast	email 12 ip 1 mail 8 session 1 sha256 1 tox 1	24
24	nightspire	email 5 ip 2 md5 8 session 1 sha256 2 telegram 3 tox 3	24
25	lynx	email 1 md5 19	20
26	interlock	ip 3 md5 9 sha256 3 url 4	19
27	sicarii	pgp 18 tox 1	19
28	majinahanashi	email 2 md5 5 sha1 5 sha256 5 tox 1	18
29	shinyhunters	email 1 ip 2 md5 5 pgp 2 telegram 8	18
30	Sorry	ip 15 sha256 2	17
31	braincipher	email 4 md5 12	16
32	termite	ip 2 md5 3 sha-1 2 sha-256 2 sha1 3 sha256 3	15
33	benzona	ip 1 md5 1 pgp 9 sha256 1 tox 1	13
34	bqtlock	telegram 10 twitter 2 xmr 1	13
35	lockbit5	md5 13	13
36	bert	ip 2 md5 9 session 1	12
37	vanhelsing	btc 2 ip 2 md5 7 tox 1	12
38	nitrogen	md5 6 tox 5	11
39	Ghostsec	ip 1 sha256 4 url 5	10
40	chaos	ip 3 md5 3 sha256 3	9
41	everest	email 3 ip 3 mutex 1 sha256 1 tox 1	9
42	8base	email 5 telegram 2	7
43	bluelocker	email 2 sha256 4 tox 1	7
44	datacarry	email 1 ip 2 md5 1 session 1 sha256 2	7
45	krybit	md5 4 session 1 tox 2	7
46	babuk2	email 1 pgp 1 session 1 telegram 2 tox 1	6
47	d1r	email 1 ip 1 session 1 telegram 2 tox 1	6
48	devman	ip 3 tox 1 twitter 2	6
49	eclipse	certificate 1 pgp 2 session 1 sha256 1 tox 1	6
50	j	md5 6	6
51	kazu	email 2 ip 1 pgp 1 session 2	6
52	metaencryptor	ip 2 url 4	6
53	promptlock	sha1 6	6
54	ralord	ip 1 md5 2 session 1 tox 2	6
55	crazyhunter	telegram 4 tox 1	5
56	noname	email 3 tox 2	5
57	ragnarok	email 5	5
58	0apt	md5 4	4
59	blackfield	email 3 tox 1	4
60	darkangels	email 2 session 1 tox 1	4
61	doppelpaymer	email 4	4
62	endzone	email 1 pgp 1 session 1 tox 1	4
63	goddamn ransomwhere	email 3 tox 1	4
64	helix	certificate 1 pgp 3	4
65	incransom	ip 2 sha256 2	4
66	payload	mutex 1 sha256 2 tox 1	4
67	ransomhouse	telegram 4	4
68	warlock	sha256 1 tox 3	4
69	GDLockrSec	tox 1 twitter 2	3
70	crypto24	email 1 ip 1 session 1	3
71	cuba	email 3	3
72	exfilsquad	email 1 tox 2	3
73	karma	email 3	3
74	kawa4096	email 1 sha256 1 tox 1	3
75	killsec	session 1 telegram 1 tox 1	3
76	montage	email 2 sha256 1	3
77	nefilim	email 3	3
78	nova	session 1 tox 2	3
79	obscura	sha256 1 tox 2	3
80	panzer	certificate 1 pgp 1 tox 1	3
81	play	email 3	3
82	settra	ip 2 tox 1	3
83	shinysp1d3r	sha256 3	3
84	umbra	email 1 session 1 telegram 1	3
85	weyhro	ip 2 tox 1	3
86	ailock	md5 1 sha256 1	2
87	blacklocks	session 1 tox 1	2
88	bluebox	email 1 tox 1	2
89	bolt team	tox 2	2
90	byod	email 1 session 1	2
91	cloak	email 1 md5 1	2
92	cry0	ip 1 tox 1	2
93	d4rk4rmy	tox 2	2
94	darkmatter	pgp 1 tox 1	2
95	doommageddon	session 1 sha256 1	2
96	dysphor1a	telegram 2	2
97	esxiargs	btc 1 tox 1	2
98	everstake	pgp 1 tox 1	2
99	exitium	tox 2	2
100	frag	email 2	2
101	fulcrumsec	session 1 tox 1	2
102	hellcat	email 1 tox 1	2
103	helldown	email 1 tox 1	2
104	lapsus$	session 1 sha256 1	2
105	mallox	email 2	2
106	netrunner	email 1 tox 1	2
107	obsoft	telegram 1 tox 1	2
108	orova	md5 1 tox 1	2
109	payday	email 1 sha256 1	2
110	payoutsking	tox 2	2
111	pear	email 1 tox 1	2
112	prinzeugen	btc 1 email 1	2
113	radar	session 1 tox 1	2
114	ranzy	email 2	2
115	rook	email 2	2
116	snatch	email 2	2
117	tengu	tox 2	2
118	the green blood group	email 1 tox 1	2
119	thegreenbloodgroup	email 1 tox 1	2
120	wannacry	md5 1 sha256 1	2
121	whitearmor	email 1 session 1	2
122	xpl0itrs	session 1 tox 1	2
123	0day syndicate	ip 1	1
124	Bashe	ip 1	1
125	abyss	tox 1	1
126	arkana	session 1	1
127	atomsilo	email 1	1
128	barracuda	email 1	1
129	black x	email 1	1
130	blacklock	md5 1	1
131	blackshrantac	tox 1	1
132	blacksuit	ip 1	1
133	bluewhale	email 1	1
134	booba project	email 1	1
135	cephalus	ip 1	1
136	chilelocker	email 1	1
137	coinbasecartel	tox 1	1
138	dark project	tox 1	1
139	darkbit	tox 1	1
140	dataleak	tox 1	1
141	falcon	pgp 1	1
142	flocker	session 1	1
143	global	session 1	1
144	global secret group	tox 1	1
145	hive	sha256 1	1
146	hyflock	session 1	1
147	icarus	session 1	1
148	insomnia	tox 1	1
149	l group	email 1	1
150	lunalock	email 1	1
151	m3rx	tox 1	1
152	meowciety403	telegram 1	1
153	minteye	tox 1	1
154	morpheus	email 1	1
155	ms13089	email 1	1
156	orion	tox 1	1
157	prolock	email 1	1
158	rancoz	email 1	1
159	ransomexx	email 1	1
160	redact	tox 1	1
161	reynolds	tox 1	1
162	satanlockv2	tox 1	1
163	scarlettgroup	session 1	1
164	securotrop	tox 1	1
165	sensayq	email 1	1
166	shiba	tox 1	1
167	skira	session 1	1
168	slug	session 1	1
169	sovcali	session 1	1
170	teamxxx	ip 1	1
171	the seven deadly sins	ip 1	1
172	timc	tox 1	1
173	toufan	tox 1	1
174	trinity	email 1	1
175	u-bomb	email 1	1
176	ulose	tox 1	1
177	vect	tox 1	1
178	vexy ransomware	tox 1	1
179	wallstreet	tox 1	1