HackerFeeds
All monthly reports

Ransomware attacks in November 2022

307 victims · 27 active groups · 5 new groups · 199 in October 2022 · Updated Oct 14, 2026

Key findings

  • HackerFeeds recorded 307 ransomware victims claimed on leak sites in November 2022, up 54.3% from 199 in October 2022.
  • 27 groups posted at least one victim; the three most active groups, royal (43), cuba (38) and lockbit3 (37), accounted for 38.4% of the total.
  • royal was the most active group with 43 victims, after posting none in October 2022.
  • Manufacturing was the most-targeted sector with 61 victims (19.9% of the month's total), ahead of Business Services (51).
  • Organizations in Brazil accounted for 6 victims (2.0%), followed by the United States (5) and Taiwan (3); 261 victims did not disclose a location.
  • 5 groups appeared in HackerFeeds data for the first time this month, including shaoleaks, mallox and royal.

Daily activity

Busiest day: Nov 4 (59 victims). Quietest day: Nov 12 (0 victims). Victims were posted on 29 of 30 days.

Most active groups

#GroupVictimsShareOctober 2022Change
1royal
43
14.0%0+43
2cuba
38
12.4%0+38
3lockbit3
37
12.1%59−22
4medusalocker
20
6.5%0+20
5lv
16
5.2%0+16
6alphv
16
5.2%23−7
7bianlian
15
4.9%14+1
8onyx
14
4.6%0+14
9dispossessor
13
4.2%10+3
10vicesociety
11
3.6%10+1
11play
10
3.3%0+10
12hive
10
3.3%2+8
138base
9
2.9%0+9
14blackbasta
8
2.6%24−16
15snatch
6
2.0%7−1

Targeted sectors

#SectorVictimsShare of month
1Manufacturing61
19.9%
2Business Services51
16.6%
3Technology26
8.5%
4Healthcare25
8.1%
5Consumer Services18
5.9%
6Financial Services16
5.2%
7Education15
4.9%
8Public Sector12
3.9%
9Energy11
3.6%
10Construction10
3.3%
11Agriculture and Food Production10
3.3%
12Transportation/Logistics8
2.6%

Countries

#CountryVictimsShare of month
1Brazil6
2.0%
2United States5
1.6%
3Taiwan3
1.0%
4Australia3
1.0%
5Qatar2
0.7%
6Mexico2
0.7%
7Japan2
0.7%
8United Kingdom2
0.7%
9Canada2
0.7%
10United Arab Emirates2
0.7%
11South Africa1
0.3%
12Thailand1
0.3%
13Sweden1
0.3%
14Poland1
0.3%
15Malaysia1
0.3%

261 victims (85.0%) did not disclose a location.

Groups seen for the first time

GroupFirst victim
shaoleaksNov 1, 2022
malloxNov 4, 2022
royalNov 4, 2022
projectrelicNov 11, 2022
playNov 26, 2022

“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.

Latest victims of the month

VictimGroupCountryDate
Holler-Classiclorenz—Nov 30, 2022
Pattoncuba—Nov 30, 2022
LJ Hooker Palm Beachalphv AUNov 30, 2022
Shenzhen INVT Electric Co,Ltdalphv CNNov 30, 2022
Jubilantalphv LKNov 30, 2022
Plascar Participacoes Industriaisvicesociety—Nov 29, 2022
colonialgeneral.comlockbit3—Nov 29, 2022
colonialgeneral.comdispossessor—Nov 29, 2022
https://www.rmclaw.net/royal—Nov 29, 2022
???play—Nov 29, 2022
https://www.cates.comroyal—Nov 28, 2022
kusd.edurevil USNov 28, 2022

Methodology

Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 307 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.