Ransomware attacks in December 2022

534 victims · 28 active groups · 6 new groups · 307 in November 2022 · Updated Oct 14, 2026

Key findings

HackerFeeds recorded 534 ransomware victims claimed on leak sites in December 2022, up 73.9% from 307 in November 2022.
28 groups posted at least one victim; the three most active groups, clop (122), lockbit3 (58) and royal (45), accounted for 42.1% of the total.
clop was the most active group with 122 victims, after posting none in November 2022.
Manufacturing was the most-targeted sector with 75 victims (14.0% of the month's total), ahead of Business Services (73).
Organizations in the United States accounted for 24 victims (4.5%), followed by India (8) and New Zealand (7); 424 victims did not disclose a location.
6 groups appeared in HackerFeeds data for the first time this month, including dataleak, monti and nokoyawa.

Daily activity

Busiest day: Dec 22 (131 victims). Quietest day: Dec 3 (3 victims). Victims were posted on 31 of 31 days.

Most active groups

#	Group	Victims	Share	November 2022	Change
1	clop	122	22.8%	0	+122
2	lockbit3	58	10.9%	37	+21
3	royal	45	8.4%	43	+2
4	karakurt	43	8.1%	0	+43
5	avoslocker	41	7.7%	0	+41
6	bianlian	37	6.9%	15	+22
7	play	25	4.7%	10	+15
8	alphv	25	4.7%	16	+9
9	vicesociety	19	3.6%	11	+8
10	blackbasta	16	3.0%	8	+8
11	hive	15	2.8%	10	+5
12	freecivilian	14	2.6%	0	+14
13	ransomhouse	12	2.2%	0	+12
14	dispossessor	10	1.9%	13	−3
15	unsafe	8	1.5%	0	+8

Targeted sectors

#	Sector	Victims	Share of month
1	Manufacturing	75	14.0%
2	Business Services	73	13.7%
3	Technology	41	7.7%
4	Education	41	7.7%
5	Healthcare	34	6.4%
6	Consumer Services	33	6.2%
7	Public Sector	29	5.4%
8	Financial Services	27	5.1%
9	Construction	23	4.3%
10	Agriculture and Food Production	19	3.6%
11	Transportation/Logistics	18	3.4%
12	Hospitality and Tourism	18	3.4%

Countries

#	Country	Victims	Share of month
1	United States	24	4.5%
2	India	8	1.5%
3	New Zealand	7	1.3%
4	United Kingdom	7	1.3%
5	Germany	7	1.3%
6	Canada	7	1.3%
7	Brazil	6	1.1%
8	Vietnam	4	0.7%
9	France	4	0.7%
10	Australia	4	0.7%
11	Venezuela	3	0.6%
12	Mexico	3	0.6%
13	Japan	3	0.6%
14	Spain	3	0.6%
15	Taiwan	2	0.4%

424 victims (79.4%) did not disclose a location.

Groups seen for the first time

Group	First victim
dataleak	Dec 2, 2022
monti	Dec 7, 2022
nokoyawa	Dec 9, 2022
karakurt	Dec 11, 2022
unsafe	Dec 21, 2022
freecivilian	Dec 31, 2022

“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.

Latest victims of the month

Victim	Group	Country	Date
sickkids.ca	lockbit3	CA	Dec 31, 2022
QUT	royal	AU	Dec 31, 2022
hacla.org	lockbit3	—	Dec 31, 2022
mfa.gov.ua	freecivilian	—	Dec 31, 2022
minagro.gov.ua	freecivilian	—	Dec 31, 2022
mon.gov.ua	freecivilian	—	Dec 31, 2022
kmu.gov.ua	freecivilian	—	Dec 31, 2022
gkh.in.ua	freecivilian	—	Dec 31, 2022
bdr.mvs.gov.ua	freecivilian	—	Dec 31, 2022
kyivcity.com	freecivilian	—	Dec 31, 2022
motorsich.com	freecivilian	—	Dec 31, 2022
mtsbu.ua	freecivilian	—	Dec 31, 2022

Methodology

Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 534 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.