Ransomware groups and families

The family is the malware: the encryption program and its tools, usually named after the code or the ransom note, such as LockBit or Akira. The group is the criminal organisation that develops and runs it, including the leak site, the payment process and the negotiators. An affiliate is a separate criminal team that rents the malware from the group and carries out the actual break-ins, in return for a share of the ransom, often the larger share. This matters for defenders because the same family can arrive through very different routes, depending on which affiliate is using it, while one affiliate may switch between families from month to month. Government advisories therefore describe both: the family's indicators and the techniques its affiliates have been seen using. When a report says a group attacked a company, it usually means that one of its affiliates did.

Ransomware as a service is a business model in which developers lease their ransomware to affiliates, who carry out the attacks and split the proceeds with them. The developers provide the encryption software, a control panel, a leak site for publishing stolen data, payment handling and sometimes negotiators and support. The affiliates bring access to victims, often bought from initial access brokers, and do the intrusion work. The model explains several things small companies notice: ransomware is no longer limited to skilled attackers, attacks are frequent and opportunistic rather than aimed only at famous names, and the same brand can appear with very different techniques. Most families in recent CISA and FBI advisories, including LockBit, ALPHV, RansomHub and Medusa, are described as operating this way. Taking down the developers disrupts many affiliates at once, which is why law enforcement often goes after the platform.

Double extortion means the attackers both encrypt your systems and steal a copy of your data, then demand payment for two things: the decryption key and a promise not to publish the data. It became common around 2020 and is now the norm: CISA and FBI advisories describe it for most current groups, including Black Basta, Akira, Play and Rhysida. Some groups skip encryption entirely and extort only with stolen data, as the advisory on BianLian describes from 2024 onwards. The practical consequence is that good backups solve only half the problem: they get you running again but do nothing about the stolen data, which may trigger GDPR notification and duties towards customers. It also means the theft happens before the encryption, often over several days, which gives defenders a window. Large outbound transfers to unfamiliar destinations are one of the signals NetSenX flags on every plan.

A leak site is a website run by a ransomware group, usually reachable only through the Tor network, where it lists the companies it claims to have attacked and publishes their stolen data if they do not pay. A listing often starts with the company's name, a countdown and a sample of files, as pressure during negotiations. Leak sites are also marketing: they advertise the group's reach to potential affiliates. A few points for a company that finds itself listed. A listing is a claim, not proof; groups sometimes exaggerate or repost old data, so verify what was actually taken. It is also a strong indication that data left the network, which matters for GDPR notification. Law enforcement takedowns often replace leak sites with a seizure banner, as happened with LockBit in February 2024 and BlackSuit in July 2025. Monitoring services and national CERTs track these sites; do not visit them from company devices.

Start with government sources, which are free, dated and careful about what they claim. The US agency CISA, with the FBI and partner agencies, publishes the StopRansomware series of joint advisories, each covering one group with its known techniques, indicators of compromise and recommended defences; every advisory has an ID such as AA24-131A and a date. In Europe, look at your national CERT or cybersecurity agency, which publishes warnings in your language, at ENISA's annual Threat Landscape report for trends, and at Europol for takedowns and arrests. The No More Ransom project lists free decryption tools. Vendor threat reports add detail but also marketing, so cross-check their figures against an official source. When you read an advisory, look first at the date and the update history: groups change tools, and older indicators lose value quickly, while the techniques described usually stay relevant much longer.

No More Ransom is a free website launched in July 2016 by Europol's European Cybercrime Centre, the Dutch police and security companies, which collects decryption tools for ransomware. By its sixth anniversary in July 2022, Europol reported 136 free tools covering 165 ransomware variants. Its Crypto Sheriff page lets you upload a ransom note or two encrypted files to check whether a tool exists. It is worth checking, but keep expectations realistic: tools exist mainly for older families, for families whose keys were seized by police, and for families with flaws in their encryption. For most current professional groups, no free decryptor exists. Do not upload files containing sensitive personal data without considering your GDPR obligations, keep copies of the encrypted files in case a tool appears later, and get advice before running any decryptor on production systems.

Sometimes a lot, often less than the headlines suggest. When police seize a group's servers, they may recover decryption keys: in the Hive operation announced in January 2023, the FBI said it had given keys to more than 300 victims under attack and over 1,000 earlier victims, and Operation Cronos against LockBit in February 2024 yielded more than 1,000 keys. Victims can ask their national police whether keys exist for their case, and No More Ransom often publishes tools afterwards. Seized data can also stop further leaks. But a takedown rarely removes the people: affiliates move to other platforms, and in several cases members reappeared under a new name within months. For companies not yet attacked, it changes little. The same techniques continue under other brands, so the defences recommended in the advisories remain the ones to apply.

Mostly to escape pressure. A well-known name attracts law enforcement, sanctions and blocklists, and many insurers and companies refuse to pay groups under sanctions, so a new name can make payment easier for the criminals. A rebrand can also follow an internal split, a leak of the group's chats or a police operation. Official sources document several such changes: CISA's August 2024 update of its advisory on Royal states that BlackSuit is a rebrand of Royal, and its August 2024 advisory on RansomHub notes that the operation was formerly known as Cyclops and Knight. After the leak of Conti's internal chats in 2022, its members dispersed into other operations. For defenders the lesson is simple: the name on the ransom note changes faster than the techniques behind it. Track the techniques, which each advisory lists with MITRE ATT&CK references, not only the brand names.

Read it as a checklist, not as news. Each CISA StopRansomware advisory ends with a mitigations section, and most of it repeats the same handful of measures: patch internet-facing systems quickly, especially VPNs and remote access; require multi-factor authentication on remote access, e-mail and admin accounts; keep offline, tested backups; segment the network so that one infected machine cannot reach everything; limit admin rights and the use of remote desktop; and monitor for unusual internal and outbound traffic. Tick off which of these you already do, and fix the weakest one first. Then read the initial-access section: if the group is known to exploit a product you use, check that product's patch level today. The indicators of compromise, such as IP addresses and file hashes, are useful to your IT provider or security tools but age quickly. You do not need to understand every technical detail to act on the mitigations.

LockBit is a ransomware-as-a-service operation that appeared in 2019 and was the most deployed ransomware variant worldwide in 2022, according to joint advisory AA23-165A, published by CISA, the FBI and international partners on 14 June 2023. Its affiliates got in through exposed remote-desktop services, phishing, stolen credentials and vulnerabilities in internet-facing systems; a separate advisory, AA23-325A of November 2023, described the exploitation of the Citrix Bleed flaw. On 20 February 2024, Operation Cronos, led by the UK's National Crime Agency with the FBI and Europol, took control of LockBit's infrastructure and leak site and obtained more than 1,000 decryption keys. The brand tried to resume afterwards, with far less reach. For defenders, the advisories' lessons still apply: patch edge devices quickly, require MFA on remote access, and watch for lateral movement and large outbound transfers before encryption.

ALPHV, also known as BlackCat, was a ransomware-as-a-service operation active from late 2021, notable for being written in the Rust programming language and for encrypting both ordinary servers and virtualisation hosts. CISA and the FBI described it in advisory AA23-353A, first published on 19 December 2023 and updated in February 2024: by then its affiliates had compromised over 1,000 entities worldwide, often after tricking help desks and IT staff into handing over credentials. In December 2023 the FBI announced that it had disrupted the group and given a decryption tool to more than 500 victims. ALPHV resumed briefly and then shut down in March 2024, in what many researchers described as an exit scam on its own affiliates. The affiliates did not disappear; many moved to other platforms. The advisory's key lesson for small companies: train help-desk staff to verify identity before any password or MFA reset.

Black Basta is a ransomware-as-a-service operation first seen in April 2022. In joint advisory AA24-131A, first published on 10 May 2024, CISA, the FBI and partner agencies reported that its affiliates had affected over 500 organisations worldwide, including 12 of the 16 US critical infrastructure sectors, using double extortion: encrypting systems and stealing data. Initial access typically came through spear phishing and the exploitation of known vulnerabilities; the advisory also describes affiliates using legitimate remote-access and file-transfer tools, stolen credentials and remote desktop to move between machines. Researchers widely reported that the group's internal chat logs leaked in February 2025, after which its activity declined. The advisory's recommendations make a useful baseline for any company: keep systems patched, require phishing-resistant MFA, train staff to recognise phishing, keep offline backups, and control which remote-access software is allowed.

Akira is a ransomware operation first seen in March 2023 that targets businesses and critical infrastructure in North America, Europe and Australia. CISA, the FBI, Europol's cybercrime centre and the Netherlands' NCSC described it in joint advisory AA24-109A of 18 April 2024: by 1 January 2024 it had affected over 250 organisations and claimed about 42 million US dollars in proceeds. An update on 13 November 2025 raised that figure to about 244 million US dollars as of late September 2025 and listed manufacturing, education, IT, health care, financial services, and food and agriculture among the sectors most often hit. Akira affiliates commonly get in through VPN accounts without multi-factor authentication and through known flaws in VPN and firewall products, the update naming a SonicWall vulnerability among them, and they steal data before encrypting. The advice follows directly: MFA on every VPN account, prompt patching of edge devices, and offline backups.

Play, also called Playcrypt, is a ransomware group active since June 2022. CISA, the FBI and the Australian Cyber Security Centre described it in joint advisory AA23-352A of 18 December 2023, then counting about 300 affected entities; an update in June 2025 said the FBI knew of approximately 900 as of May 2025. Play uses double extortion, but its ransom note states no amount: victims are told to make contact by e-mail, and the update notes that some were also phoned and threatened. Initial access typically comes from valid accounts that were stolen or bought, and from vulnerabilities in internet-facing systems such as remote-desktop and firewall services. The group recompiles its malware for each attack, so file hashes are of limited use. Behaviour is more reliable: credential theft, movement between internal machines, and data gathered and sent out before encryption, which network monitoring can see.

Royal was a ransomware operation active from about September 2022, and BlackSuit is its successor. CISA and the FBI first described Royal in advisory AA23-061A of 2 March 2023; an update in November 2023 counted over 350 known victims since September 2022, and an update in August 2024 states that BlackSuit is a rebrand of Royal and that the actors' ransom demands exceeded 500 million US dollars in total, the largest single demand being 60 million. Phishing was the most common way in, followed by remote desktop, the exploitation of public-facing applications and access bought from brokers. In July 2025, an international operation coordinated through Europol and led by US Homeland Security Investigations seized BlackSuit's servers and domains, as the US Justice Department announced in August 2025. No arrests were reported, and researchers observed members moving to new operations. The defences in the advisory remain relevant whatever the brand.

Rhysida is a ransomware-as-a-service group that appeared in May 2023. CISA, the FBI and the MS-ISAC described it in joint advisory AA23-319A of 15 November 2023, noting that it attacked opportunistically across education, health care, manufacturing, IT and government, using double extortion. According to the advisory, its actors got in mostly through external remote services such as VPNs, often with stolen credentials where multi-factor authentication was not enforced, through phishing, and in some cases by exploiting the Zerologon vulnerability in domain controllers. Once inside, they used built-in admin tools and remote desktop to move around, the living-off-the-land pattern seen in many groups. For a small company, the advisory's message is familiar but important: require MFA on every remote access path, patch domain controllers, restrict remote desktop, and segment the network so that a single foothold does not expose everything.

Medusa is a ransomware-as-a-service operation first identified in June 2021, not to be confused with the unrelated MedusaLocker family or a mobile malware also called Medusa. CISA, the FBI and the MS-ISAC described it in joint advisory AA25-071A of 12 March 2025, reporting more than 300 victims by February 2025 in critical infrastructure sectors including medical, education, legal, insurance, technology and manufacturing; an update in August 2026 raised the count to more than 500 victims as of April 2026. Its developers and affiliates get in through phishing to steal credentials and by exploiting unpatched vulnerabilities, and the advisory describes heavy use of legitimate remote-access software and built-in admin tools. Medusa runs a leak site with countdown timers and offers to delay publication for a fee. The mitigations are the familiar set: patch operating systems, software and firmware; multi-factor authentication for all services; network segmentation; offline backups; and limiting remote-desktop and remote-access tools to the ones you actually use.

RansomHub was a ransomware-as-a-service operation that appeared in February 2024 and grew quickly by recruiting affiliates from other platforms, including after the collapse of ALPHV and the LockBit takedown. CISA, the FBI, the MS-ISAC and the US health department described it in joint advisory AA24-242A of 29 August 2024: by then it had encrypted and stolen data from at least 210 victims, in sectors such as water, IT, government services, health care, emergency services, food, financial services and communications. The advisory notes that the operation was formerly known as Cyclops and Knight and uses double extortion. Affiliates typically got in through phishing, password spraying and the exploitation of known vulnerabilities in internet-facing systems. Researchers reported that its infrastructure went offline in April 2025 and that many affiliates moved elsewhere. The pattern is the lesson: brands come and go quickly, while the entry techniques and the recommended defences stay the same.

Cl0p, also written Clop, is a ransomware and extortion operation that security agencies associate with a criminal group tracked as TA505. It is best known for mass data theft through flaws in file-transfer software rather than for classic encryption. CISA and the FBI described its exploitation of a zero-day vulnerability, CVE-2023-34362, in the MOVEit Transfer product in joint advisory AA23-158A of 7 June 2023: from late May 2023 the group stole data from a large number of organisations through that one product, then demanded payment to keep it unpublished. Earlier campaigns had used similar flaws in other managed file-transfer products. For a small company the lessons are specific: know which file-transfer and other internet-facing applications you run, including those operated by suppliers on your behalf, patch them as soon as an advisory appears, and watch for unusual volumes of data leaving those servers. Encryption is not required for serious harm.

BianLian is a criminal group that started as a ransomware operation in June 2022 and moved to pure data-theft extortion. CISA, the FBI and the Australian Cyber Security Centre described it in joint advisory AA23-136A of 16 May 2023; the advisory says the group shifted to primarily exfiltration-based extortion around January 2023, and a November 2024 update says it moved to exclusively exfiltration-based extortion around January 2024. Its actors typically get in with valid remote-desktop credentials, often obtained from initial access brokers or through phishing, then use built-in tools and remote-access software to explore the network and copy data out before demanding payment. Because nothing is encrypted, a victim may only learn of the attack from the extortion message. That makes outbound data monitoring especially relevant, because the theft is the attack. The advisory recommends strictly limiting remote desktop, auditing remote-access tools and keeping administrative accounts under tight control.

Hive was a ransomware-as-a-service operation active from June 2021 until early 2023. In joint advisory AA22-321A of 17 November 2022, CISA, the FBI and the US health department reported that it had victimised over 1,300 companies worldwide and received about 100 million US dollars in ransom payments, with a particular impact on health care. Its affiliates got in through remote-desktop and VPN accounts without MFA, through phishing and through known vulnerabilities in internet-facing servers. On 26 January 2023 the US Justice Department announced that the FBI had secretly infiltrated Hive's network since July 2022, giving decryption keys to more than 300 victims under attack and over 1,000 earlier victims, before seizing its servers with support from German and Dutch police and Europol. Hive shows what a takedown can do for victims, and also its limits: researchers later reported Hive code reused in a new ransomware brand.

Conti was one of the most active ransomware operations of 2020 to 2022. In joint advisory AA21-265A of 22 September 2021, CISA, the FBI and the NSA reported more than 400 attacks on US and international organisations, with affiliates getting in through spear phishing, stolen or weak remote-desktop credentials, fake software downloads and known vulnerabilities; the advisory was later updated with further indicators. Conti operated more like a company than a loose network, with paid staff, which became visible in February 2022 when tens of thousands of its internal chat messages leaked. The brand shut down around mid-2022, and its members spread into other ransomware and extortion operations. For defenders, the leaked material confirmed what the advisories said: most intrusions relied on ordinary weaknesses such as missing MFA, exposed remote access and slow patching, not on exotic exploits.

Phobos is a ransomware-as-a-service family active since about 2019, and 8Base was one of the groups that used a Phobos variant. CISA, the FBI and the MS-ISAC described Phobos in joint advisory AA24-060A of 29 February 2024: its affiliates targeted county and municipal governments, emergency services, education, health care and other critical infrastructure, typically getting in through remote-desktop services with weak or stolen passwords, or through phishing. Security researchers note that Phobos has mostly been used against small and mid-sized organisations rather than large enterprises. On 11 February 2025 Europol announced a coordinated international operation in which four people suspected of leading 8Base were arrested; the US Justice Department said it disrupted over 100 servers linked to the network. The advice for small companies is plain: do not expose remote desktop to the internet, enforce strong passwords and MFA for remote access, and keep offline backups.

Ghost, also known as Cring and by several other names, is a financially motivated ransomware operation that CISA, the FBI and the MS-ISAC described in joint advisory AA25-050A of 19 February 2025. According to the advisory, Ghost actors began their attacks around early 2021 and have compromised organisations in more than 70 countries, in sectors that include critical infrastructure, schools and universities, health care, government, manufacturing and many small and medium-sized businesses. They mostly gain access by exploiting known, often years-old vulnerabilities in internet-facing software such as firewalls, web servers and mail servers, for which patches had long been available. They also change their ransomware file names and ransom notes frequently, which makes the brand hard to track. The lesson is blunt: patching public-facing systems against known vulnerabilities, and replacing devices that no longer receive updates, is the main defence the advisory recommends.

Interlock is a ransomware operation first observed in September 2024, targeting businesses and critical infrastructure in North America and Europe. CISA, the FBI, the US health department and the MS-ISAC described it in joint advisory AA25-203A of 22 July 2025. Unlike many groups, Interlock often gets in through drive-by downloads from compromised legitimate websites, including fake browser updates, and through the ClickFix technique, in which a fake CAPTCHA or error prompt persuades the user to paste and run a command. It uses double extortion and encrypts both ordinary computers and virtual machines. The advisory's recommended defences reflect that entry route: DNS and web filtering to block malicious sites, up-to-date browsers and endpoint protection, and staff who know that no real website asks them to paste commands, plus the usual patching, MFA and network segmentation. After the initial access, the remote-control traffic and the lateral movement are the stages network monitoring can see.