Ransomware IOCs

171 groups with public IOCs · 2,352 total indicators. Click a group to see its hashes, IPs, wallets, and more. Source: ransomware.live.

Groups with published IOCs

#	Group	IOC types · counts	Total
1	akira	btc 7 ip 1 md5 320 mutex 2 sha256 37	367
2	raworld	ip 2 md5 209 tox 2	213
3	bianlian	email 1 ip 191 md5 8 tox 1	201
4	clop	email 11 ip 180	191
5	trigona	email 1 md5 114	115
6	thegentlemen	email 2 ip 1 md5 47 session 1 sha1 4 sha256 34 tox 6	95
7	qilin	ftp 2 ip 5 md5 54 tox 1	62
8	silentransomgroup	btc 61	61
9	cactus	email 3 md5 50 tox 1	54
10	fog	md5 53	53
11	hellokitty	md5 52	52
12	crpxo	domain 3 ip 11 md5 16 session 1 tox 1 url 5	37
13	anubis	ip 4 md5 25 twitter 2	31
14	gunra	email 3 ip 1 md5 16 session 1 tox 4 url 5	30
15	rhysida	md5 28	28
16	blacknevas	sha256 27	27
17	lockbit	ip 10 md5 16	26
18	lockbit3	ip 10 md5 16	26
19	medusa	email 3 md5 18 telegram 2 tox 3	26
20	dragonforce	ip 1 md5 22 pgp 1 tox 1	25
21	medusalocker	email 2 registrykey 1 sha256 20 tox 2	25
22	beast	email 12 ip 1 mail 8 session 1 sha256 1 tox 1	24
23	lynx	email 1 md5 19	20
24	embargo	md5 18 tox 1	19
25	interlock	ip 3 md5 9 sha256 3 url 4	19
26	sicarii	pgp 18 tox 1	19
27	majinahanashi	email 2 md5 5 sha1 5 sha256 5 tox 1	18
28	Sorry	ip 15 sha256 2	17
29	shinyhunters	email 1 ip 2 md5 5 pgp 1 telegram 8	17
30	braincipher	email 4 md5 12	16
31	termite	ip 2 md5 3 sha-1 2 sha-256 2 sha1 3 sha256 3	15
32	nightspire	email 5 session 1 sha256 2 telegram 3 tox 3	14
33	benzona	ip 1 md5 1 pgp 9 sha256 1 tox 1	13
34	bqtlock	telegram 10 twitter 2 xmr 1	13
35	lockbit5	md5 13	13
36	bert	ip 2 md5 9 session 1	12
37	vanhelsing	btc 2 ip 2 md5 7 tox 1	12
38	nitrogen	md5 6 tox 5	11
39	Ghostsec	ip 1 sha256 4 url 5	10
40	chaos	ip 3 md5 3 sha256 3	9
41	everest	email 3 ip 3 mutex 1 sha256 1 tox 1	9
42	8base	email 5 telegram 2	7
43	bluelocker	email 2 sha256 4 tox 1	7
44	datacarry	email 1 ip 2 md5 1 session 1 sha256 2	7
45	krybit	md5 4 session 1 tox 2	7
46	babuk2	email 1 pgp 1 session 1 telegram 2 tox 1	6
47	d1r	email 1 ip 1 session 1 telegram 2 tox 1	6
48	devman	ip 3 tox 1 twitter 2	6
49	j	md5 6	6
50	kazu	email 2 ip 1 pgp 1 session 2	6
51	metaencryptor	ip 2 url 4	6
52	promptlock	sha1 6	6
53	ralord	ip 1 md5 2 session 1 tox 2	6
54	crazyhunter	telegram 4 tox 1	5
55	noname	email 3 tox 2	5
56	ragnarok	email 5	5
57	0apt	md5 4	4
58	blackfield	email 3 tox 1	4
59	darkangels	email 2 session 1 tox 1	4
60	doppelpaymer	email 4	4
61	eclipse	certificate 1 pgp 1 session 1 tox 1	4
62	endzone	email 1 pgp 1 session 1 tox 1	4
63	goddamn ransomwhere	email 3 tox 1	4
64	incransom	ip 2 sha256 2	4
65	payload	mutex 1 sha256 2 tox 1	4
66	ransomhouse	telegram 4	4
67	warlock	sha256 1 tox 3	4
68	GDLockrSec	tox 1 twitter 2	3
69	crypto24	email 1 ip 1 session 1	3
70	cuba	email 3	3
71	exfilsquad	email 1 tox 2	3
72	karma	email 3	3
73	kawa4096	email 1 sha256 1 tox 1	3
74	killsec	session 1 telegram 1 tox 1	3
75	montage	email 2 sha256 1	3
76	nefilim	email 3	3
77	nova	session 1 tox 2	3
78	obscura	sha256 1 tox 2	3
79	panzer	certificate 1 pgp 1 tox 1	3
80	play	email 3	3
81	settra	ip 2 tox 1	3
82	shinysp1d3r	sha256 3	3
83	umbra	email 1 session 1 telegram 1	3
84	weyhro	ip 2 tox 1	3
85	ailock	md5 1 sha256 1	2
86	blacklocks	session 1 tox 1	2
87	bluebox	email 1 tox 1	2
88	bolt team	tox 2	2
89	byod	email 1 session 1	2
90	cloak	email 1 md5 1	2
91	cry0	ip 1 tox 1	2
92	d4rk4rmy	tox 2	2
93	darkmatter	pgp 1 tox 1	2
94	doommageddon	session 1 sha256 1	2
95	dysphor1a	telegram 2	2
96	esxiargs	btc 1 tox 1	2
97	exitium	tox 2	2
98	frag	email 2	2
99	fulcrumsec	session 1 tox 1	2
100	helix	certificate 1 pgp 1	2
101	hellcat	email 1 tox 1	2
102	helldown	email 1 tox 1	2
103	lapsus$	session 1 sha256 1	2
104	mallox	email 2	2
105	netrunner	email 1 tox 1	2
106	orova	md5 1 tox 1	2
107	payday	email 1 sha256 1	2
108	payoutsking	tox 2	2
109	pear	email 1 tox 1	2
110	prinzeugen	btc 1 email 1	2
111	radar	session 1 tox 1	2
112	ranzy	email 2	2
113	rook	email 2	2
114	snatch	email 2	2
115	tengu	tox 2	2
116	the green blood group	email 1 tox 1	2
117	thegreenbloodgroup	email 1 tox 1	2
118	xpl0itrs	session 1 tox 1	2
119	0day syndicate	ip 1	1
120	Bashe	ip 1	1
121	abyss	tox 1	1
122	arkana	session 1	1
123	atomsilo	email 1	1
124	barracuda	email 1	1
125	black x	email 1	1
126	blacklock	md5 1	1
127	blackshrantac	tox 1	1
128	blacksuit	ip 1	1
129	bluewhale	email 1	1
130	booba project	email 1	1
131	cephalus	ip 1	1
132	chilelocker	email 1	1
133	coinbasecartel	tox 1	1
134	dark project	tox 1	1
135	darkbit	tox 1	1
136	dataleak	tox 1	1
137	falcon	pgp 1	1
138	flocker	session 1	1
139	global	session 1	1
140	global secret group	tox 1	1
141	icarus	session 1	1
142	insomnia	tox 1	1
143	l group	email 1	1
144	lunalock	email 1	1
145	m3rx	tox 1	1
146	meowciety403	telegram 1	1
147	minteye	tox 1	1
148	morpheus	email 1	1
149	ms13089	email 1	1
150	orion	tox 1	1
151	prolock	email 1	1
152	rancoz	email 1	1
153	ransomexx	email 1	1
154	redact	tox 1	1
155	reynolds	tox 1	1
156	satanlockv2	tox 1	1
157	securotrop	tox 1	1
158	sensayq	email 1	1
159	shiba	tox 1	1
160	skira	session 1	1
161	slug	session 1	1
162	sovcali	session 1	1
163	teamxxx	ip 1	1
164	timc	tox 1	1
165	toufan	tox 1	1
166	trinity	email 1	1
167	u-bomb	email 1	1
168	ulose	tox 1	1
169	vect	tox 1	1
170	vexy ransomware	tox 1	1
171	wallstreet	tox 1	1