All monthly reports
Ransomware attacks in December 2024
709 victims · 54 active groups · 2 new groups · 629 in November 2024 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 709 ransomware victims claimed on leak sites in December 2024, up 12.7% from 629 in November 2024.
- 54 groups posted at least one victim; the three most active groups, funksec (104), clop (68) and akira (65), accounted for 33.4% of the total.
- funksec was the most active group with 104 victims, after posting none in November 2024.
- Business Services was the most-targeted sector with 168 victims (23.7% of the month's total), ahead of Manufacturing (96).
- Organizations in the United States accounted for 338 victims (47.7%), followed by Canada (32) and India (29); 18 victims did not disclose a location.
- 2 groups appeared in HackerFeeds data for the first time this month: bluebox and weyhro.
Daily activity
Busiest day: Dec 24 (81 victims). Quietest day: Dec 27 (4 victims). Victims were posted on 31 of 31 days.
Most active groups
| # | Group | Victims | Share | November 2024 | Change |
|---|---|---|---|---|---|
| 1 | funksec | 104 | 14.7% | 0 | +104 |
| 2 | clop | 68 | 9.6% | 0 | +68 |
| 3 | akira | 65 | 9.2% | 44 | +21 |
| 4 | ransomhub | 51 | 7.2% | 100 | −49 |
| 5 | lynx | 30 | 4.2% | 25 | +5 |
| 6 | killsec | 28 | 3.9% | 33 | −5 |
| 7 | SilentRansomGroup | 28 | 3.9% | 0 | +28 |
| 8 | qilin | 27 | 3.8% | 24 | +3 |
| 9 | dragonransomware | 23 | 3.2% | 8 | +15 |
| 10 | fog | 22 | 3.1% | 20 | +2 |
| 11 | play | 19 | 2.7% | 16 | +3 |
| 12 | safepay | 18 | 2.5% | 15 | +3 |
| 13 | apt73 | 15 | 2.1% | 14 | +1 |
| 14 | raworld | 13 | 1.8% | 10 | +3 |
| 15 | medusa | 13 | 1.8% | 18 | −5 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Business Services | 168 | 23.7% |
| 2 | Manufacturing | 96 | 13.5% |
| 3 | Technology | 94 | 13.3% |
| 4 | Healthcare | 54 | 7.6% |
| 5 | Financial Services | 52 | 7.3% |
| 6 | Transportation/Logistics | 45 | 6.3% |
| 7 | Education | 34 | 4.8% |
| 8 | Public Sector | 29 | 4.1% |
| 9 | Agriculture and Food Production | 26 | 3.7% |
| 10 | Energy | 25 | 3.5% |
| 11 | Consumer Services | 24 | 3.4% |
| 12 | Hospitality and Tourism | 15 | 2.1% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 338 | 47.7% |
| 2 | Canada | 32 | 4.5% |
| 3 | India | 29 | 4.1% |
| 4 | Brazil | 23 | 3.2% |
| 5 | United Kingdom | 19 | 2.7% |
| 6 | Germany | 18 | 2.5% |
| 7 | Australia | 15 | 2.1% |
| 8 | Italy | 12 | 1.7% |
| 9 | France | 11 | 1.6% |
| 10 | United Arab Emirates | 10 | 1.4% |
| 11 | Israel | 9 | 1.3% |
| 12 | Spain | 9 | 1.3% |
| 13 | Singapore | 7 | 1.0% |
| 14 | Mexico | 7 | 1.0% |
| 15 | Argentina | 7 | 1.0% |
18 victims (2.5%) did not disclose a location.
Groups seen for the first time
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| moh.gov.vn | funksec | VN | Dec 31, 2024 |
| tsag-agaar.gov.mn | funksec | MN | Dec 31, 2024 |
| maim.gov.my | funksec | MY | Dec 31, 2024 |
| banksulutgo | funksec | ID | Dec 31, 2024 |
| groupegm.com | ransomhub | FR | Dec 31, 2024 |
| Gossett Motor Cars | lynx | US | Dec 31, 2024 |
| SmithDunn&Co | spacebears | US | Dec 31, 2024 |
| Mai***********.de | cloak | DE | Dec 30, 2024 |
| bac***********.com.au | cloak | AU | Dec 30, 2024 |
| Town of Ponoka | cloak | CA | Dec 30, 2024 |
| mof.gov.la | funksec | LA | Dec 30, 2024 |
| apexfootwearltd.com | funksec | BD | Dec 30, 2024 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 709 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.