cert-orangecyberdefense/ransomware_mapMap tracking ransomware, by OCD World Watch team
Latest = version 29 (January 2026 - incoming)
Map visualizing relationships and timelines associated to +300 ransomware groups, between 2015 and 2026. Hope this helps!
World Watch team - Global CERT Orange Cyberdefense
All rights reserved.
This graph does not intend to be exhaustive. Its goal is to showcase relationships between relevant ransomware operations and does not purposely list all existing ransomware groups since 2015. Names of strains and associated threat actors were chosen arbitrarily by us among the most popular alias used among the cybersecurity community. It does not mean we endorse the vendor that created the alias.
As a reminder, it is extremely complex to assert relationship and attribution when looking at the cybercrime ecosystem: threat actors are extremely volatile and connected between each other, making effective collaborations hard to define and track over time. In addition to our internal resources (monitoring, reverse engineering, Incident Response engagements related to most of these prominent groups), this mapping makes use of numerous public and private reports from incident responders, malware analysts, CTI researchers,… We paid attention to carefully select, corroborate and fact-check such intelligence with trusted sources, but may have still made small mistakes or debatable associations.
Don’t hesitate to send us your feedback if any directly or by opening an issue.
Changelog:
Edit: Apos
Edit: BlackOut
Edit: BlackSuit
Edit: Cactus
Edit: Cryptnet
Edit: Dharma
Edit: Embargo
Edit: Hellokitty
Edit: Hunters International
Edit: LukaLocker
Edit: Makop
Edit: Nitrogen
Edit: Phobos
Edit: Qilin
Edit: Radar
Edit: Ransomed
Edit: Thanos
New addition: Agenda - May 2022
New addition: Ailock - June 2025
New addition: Anubis - December 2024
New addition: Arachna - September 2025
New addition: Arkana - March 2025
New addition: Aware - January 2026
New addition: Beast - July 2025
New addition: Benzona - - November 2025
New addition: Bert - March 2025
New addition: BlackField - October 2025
New addition: BlackNevas - July 2025
New addition: BlackShrantac - September 2025
New addition: BQTlock - July 2025
New addition: Brotherhood - October 2025
New addition: Cephalus - August 2025
New addition: Chaos - March 2025
New addition: Coinbase Cartel - September 2025
New addition: Cortex - April 2025
New addition: CrazyHunter - January 2025
New addition: Crypto24 - April 2025
New addition: DarkLulz - June 2025
New addition: DataCarry - May 2025
New addition: Desolator - August 2025
New addition: Devman 2.0 - December 2025
New addition: Devman - April 2025
New addition: Dire Wolf - May 2025
New addition: Evilbyte - March 2025
New addition: Genesis - October 2025
New addition: Gentlemen - September 2025
New addition: Global - June 2025
New addition: Gunra - May 2025
New addition: HelloGookie - April 2024
New addition: HexaLocker - August 2024
New addition: Imn Crew - March 2025
New addition: J Group - February 2025
New addition: KawaLocker - June 2025
New addition: Kazu - October 2025
New addition: Kraken - February 2025
New addition: Kryptos - October 2025
New addition: Leaknet - October 2025
New addition: Lockbit 5.0 - September 2025
New addition: Lunalock - September 2025
New addition: Mamona - March 2025
New addition: Marlock - September 2021
New addition: Mindware - May 2022
New addition: Minteye - December 2025
New addition: Monolock - October 2025
New addition: Ms13-089 - December 2025
New addition: Nightspire - February 2025
New addition: Obscura - August 2025
New addition: Orca - September 2024
New addition: Osiris - December 2025
New addition: Payouts King - July 2025
New addition: PEAR - July 2025
New addition: Prince - July 2024
New addition: Radiant - September 2025
New addition: RAlord - March 2025
New addition: Root - December 2025
New addition: Run Some Wares - February 2025
New addition: Satanlock - April 2025
New addition: Secp0 - March 2025
New addition: Securotrop - August 2025
New addition: SiegedSec - December 2023
New addition: Sinobi - July 2025
New addition: Skira - March 2025
New addition: Sparta - September 2022
New addition: TeamXXX - May 2025
New addition: Tengu - October 2025
New addition: Trident - December 2025
New addition: VanHelsing - March 2025
New addition: Vect - January 2026
New addition: Walocker - July 2025
New addition: Warlock - June 2025
New addition: Werewolves - March 2023
New addition: Weyhro - March 2025
New addition: World Leaks - January 2025
New addition: Yurei - September 2025
Edit: 8base
Edit: Black Basta
Edit: Brain Spider
Edit: Chatty Spider
Edit: D0nut
Edit: DarkVault
Edit: Interlock
Edit: Jigsaw
Edit: LukaLocker
Edit: Monti
Edit: Monti
Edit: Pryx
Edit: Rancoz
Edit: Ransomware Blog
New addition: 0mega
New addition: Anubis
New addition: Apos Security
New addition: Arcane
New addition: Argonauts
New addition: BabyLockerKZ
New addition: Bashe
New addition: BlackLock
New addition: BlackTor
New addition: BlueBox
New addition: Chort
New addition: CoomingProject
New addition: Core
New addition: Cring
New addition: dAn0n
New addition: DeathGrip
New addition: Dragonforce
New addition: ElPaco
New addition: Eruption
New addition: Farattack
New addition: Frag
New addition: Fsociety
New addition: Funksec
New addition: GDLockerSec
New addition: Grinch
New addition: Hellcat
New addition: HellDown
New addition: Interlock
New addition: Kairos
New addition: Kraken
New addition: Kryptina
New addition: LeakedData
New addition: Linkc
New addition: LockBit 4.0
New addition: Malas
New addition: Marketo
New addition: Morpheus
New addition: Muliaka
New addition: Nitro Spider
New addition: Nitrogen
New addition: Phantom
New addition: PlayBoy
New addition: Qiulong
New addition: Ransomcortex
New addition: Sabbath
New addition: Safepay
New addition: Sarcoma
New addition: Slippery Scorpius
New addition: Space Bears
New addition: Stormous
New addition: Stumped Scorpius
New addition: Termite
New addition: Tycoon
New addition: UNC2190
New addition: Unsafe
New addition: Xelera
