CyphrQRansomware and threat groups
Which ransomware groups the FBI and partner agencies name most often, how long they have been active, and the victim and ransom figures officials have put on record. Where officials gave no figure, the cell says so rather than showing an estimate.
Rankings are the FBI's own, from its annual Internet Crime Report; group figures come from official US, UK, EU and Australian advisories and law-enforcement releases. We show only what those sources state.
Top ransomware variants reported to the FBI, by year
| Rank | 2025 report | 2024 report | 2023 report | 2022 report | 2021 report |
|---|---|---|---|---|---|
| 1 | Akira | Akira | LockBit (175) | LockBit (149) | Conti (87) |
| 2 | Qilin | LockBit | ALPHV/BlackCat (100) | ALPHV/BlackCat (114) | LockBit (58) |
| 3 | INC/Lynx/Sinobi | RansomHub | Akira (95) | Hive (87) | REvil/Sodinokibi (51) |
| 4 | BianLian | Fog | Royal (63) | – | – |
| 5 | Play | Play | Black Basta (41) | – | – |
| 6 | RansomHub | – | – | – | – |
| 7 | LockBit | – | – | – | – |
| 8 | DragonForce | – | – | – | – |
| 9 | SafePay | – | – | – | – |
| 10 | Medusa | – | – | – | – |
The FBI first published these rankings in its 2021 report; its earlier annual reports name no ransomware variants. What each year measures. 2025: Most frequently reported to IC3 (rank only); 2024: IC3 complaints (rank only; counts not published); 2023: Critical-infrastructure incidents reported to IC3; 2022: Critical-infrastructure incidents reported to IC3; 2021: Critical-infrastructure incidents reported to IC3. Counts appear only where the report publishes them; the years are measured differently, so ranks are not comparable across them. Hover a cell for the report's wording. Critical-infrastructure incidents (2021-2023), complaints (2024) and most-reported (2025) are different measures.
Ransomware groups: activity and official figures
— means official sources have not published that figure. Listed A to Z; the order is not a ranking. Figures are shown as the sources state them ("2000+", "~900") and are never added up across groups: they cover different periods and different countries. Hover a figure for the exact wording.
State-sponsored and other hacking groups
| Group (aliases) | Type | Attributed to (as officials state) | Active since | Targets | Regions named | Official action (date) | Source |
|---|---|---|---|---|---|---|---|
| Andariel Onyx Sleet; DarkSeoul; Silent Chollima; Stonefly | state-sponsored | North Korea's Reconnaissance General Bureau (RGB) 3rd Bureau | — | defense; aerospace; nuclear; engineering | Asia, North America | Joint advisory AA24-207A on North Korean global espionage campaign (2024-07-25) | CISA AA24-207A |
| APT28 (Fancy Bear) Forest Blizzard; BlueDelta | state-sponsored | Russia's GRU 85th Main Special Service Center (85th GTsSS), military unit 26165 | — | defense industry; transportation hubs (ports, airports); maritime; air traffic management; IT services | North America, Europe | Joint advisory AA25-141A on GRU targeting of Western logistics and technology firms (2025-05) | CISA AA25-141A |
| APT29 (Midnight Blizzard) Midnight Blizzard; the Dukes; Cozy Bear | state-sponsored | Russia's Foreign Intelligence Service (SVR) | — | government; think tanks; healthcare; energy; aviation; education; law enforcement; military | — | Joint advisory AA24-057A on SVR initial cloud access tactics (2024-02-26) | CISA AA24-057A |
| APT31 | state-sponsored | Hubei State Security Department (HSSD), PRC Ministry of State Security | — | defense industrial base; information technology; energy; government officials; politicians; journalists; activists | North America | US Treasury OFAC sanctions on APT31-linked Wuhan XRZ and individuals (2024-03-25) | US Treasury (jy2205) |
| APT35 (Charming Kitten) Charming Kitten; Nemesis Kitten; Phosphorus; Tunnel Vision (named by Treasury as partially overlapping intrusion sets) | state-sponsored | Iran's Islamic Revolutionary Guard Corps (IRGC), affiliated actors | — | defense; diplomatic and government personnel; media; energy; business services; telecommunications | North America, Middle East & North Africa | US Treasury OFAC sanctions on IRGC-affiliated cyber actors (2022-09-14) | US Treasury (jy0948) |
| APT38 BeagleBoyz; Bluenoroff; Stardust Chollima; Lazarus Group (overlap) | state-sponsored | North Korea's Reconnaissance General Bureau | 2015 | banks and financial institutions | Latin America, Asia, Sub-Saharan Africa | CISA/FBI/Treasury/USCYBERCOM advisory AA20-239A (FASTCash 2.0) on bank-robbing activity (2020-08-26) | CISA AA20-239A |
| APT40 Kryptonite Panda; Gingham Typhoon; Leviathan; Bronze Mohawk | state-sponsored | People's Republic of China Ministry of State Security (MSS) | — | government and private sector networks | Australia & New Zealand, North America | Joint advisory AA24-190A (led by Australia's ASD) on APT40 tradecraft (2024-07-08) | CISA AA24-190A |
| APT41 Chengdu 404 Network Technology (company linked in indictment) | state-sponsored | China-based actors, Chengdu 404 Network Technology employees (per DOJ indictment) | 2011 | education; computer hardware; software incl. video gaming; government; healthcare; hospitality; social networking; NGOs; telecommunications | North America | FBI/CISA FLASH on DOJ indictment of five PRC-based cyber actors (2020-09-16) | FBI/CISA FLASH AC-000133-TT (ic3.gov) |
| CyberAv3ngers CyberAveng3rs; Cyber Avengers; Soldiers of Solomon (reported connection) | state-sponsored | Iran's IRGC (IRGC-affiliated cyber persona) | — | water and wastewater; energy | North America, Middle East & North Africa | Joint advisory AA23-335A on IRGC-affiliated actors exploiting PLCs (2023-12-01) | CISA AA23-335A |
| Flax Typhoon | state-sponsored | — | — | — | — | US Treasury OFAC designation of Integrity Technology Group for its role in Flax Typhoon activity (2025-01-03) | US Treasury (press release 17 Jan 2025) |
| Kimsuky | state-sponsored | North Korea | — | intelligence-collection targets (individuals and organizations) | Asia, North America | CISA/FBI/USCYBERCOM advisory AA20-301A: North Korean APT focus on Kimsuky (2020-10-27) | CISA AA20-301A |
| Lazarus Group / TraderTraitor APT38; BlueNoroff; Stardust Chollima | state-sponsored | North Korea (state-sponsored) | — | cryptocurrency exchanges; decentralized finance; play-to-earn gaming; crypto venture capital; individual crypto holders | — | CISA/FBI/Treasury advisory AA22-108A on TraderTraitor targeting blockchain companies (2022-04-18) | CISA AA22-108A |
| Salt Typhoon OPERATOR PANDA; RedMike; UNC5807; GhostEmperor | state-sponsored | People's Republic of China (PRC) state-sponsored | — | telecommunications; government; transportation; lodging; military infrastructure | North America, Europe, Australia & New Zealand | Multinational joint advisory AA25-239A on PRC compromise of networks worldwide (2025-08-27) | CISA AA25-239A |
| Sandworm Voodoo Bear | state-sponsored | Russia's GRU Main Centre for Special Technologies (GTsST) | — | energy (Ukrainian electricity); Olympics | Europe, Asia | NCSC/CISA/FBI/NSA advisory AA22-054A on Cyclops Blink malware replacing VPNFilter (2022-02-23) | CISA AA22-054A |
| Scattered Spider UNC3944; Scatter Swine; Oktapus; Octo Tempest; Storm-0875; Muddled Libra | criminal hacking | — | — | large companies; contracted IT help desks | — | Joint advisory AA23-320A (US, Canada, UK, Australia) on Scattered Spider (2023-11-16) | CISA AA23-320A |
| Star Blizzard Callisto Group; TA446; COLDRIVER; SEABORGIUM; TAG-53; BlueCharlie | state-sponsored | Russia's FSB Centre 18 | — | academia; defense; government; NGOs; think tanks; politicians | Europe, North America | Joint advisory AA23-341A on worldwide spearphishing campaigns (2023-12-07) | CISA AA23-341A |
| Turla Snake (implant); Uroburos (implant) | state-sponsored | Russia's FSB Center 16 | — | education; small businesses; media; government facilities; financial services; critical manufacturing; communications; research; journalists | North America, Latin America, Europe, Sub-Saharan Africa, Asia, Australia & New Zealand | Joint advisory AA23-129A on disrupting Snake malware (2023-05-09) | CISA AA23-129A |
| Volt Typhoon Vanguard Panda; BRONZE SILHOUETTE; Dev-0391; UNC3236; Voltzite; Insidious Taurus | state-sponsored | People's Republic of China (PRC) state-sponsored | — | communications; energy; transportation systems; water and wastewater | North America | Joint advisory AA24-038A on PRC actors persisting in US critical infrastructure (2024-02-07) | CISA AA24-038A |
— means official sources have not published it. Listed A to Z; the order is not a ranking. Attribution is as the named government or court source states it. Hover a cell for the exact wording.
Groups on the map: pick one under "Show ransomware groups" on the Breaches map to see the regions officials name for it.