Where can we find official information about ransomware groups?

Start with government sources, which are free, dated and careful about what they claim. The US agency CISA, with the FBI and partner agencies, publishes the StopRansomware series of joint advisories, each covering one group with its known techniques, indicators of compromise and recommended defences; every advisory has an ID such as AA24-131A and a date. In Europe, look at your national CERT or cybersecurity agency, which publishes warnings in your language, at ENISA's annual Threat Landscape report for trends, and at Europol for takedowns and arrests. The No More Ransom project lists free decryption tools. Vendor threat reports add detail but also marketing, so cross-check their figures against an official source. When you read an advisory, look first at the date and the update history: groups change tools, and older indicators lose value quickly, while the techniques described usually stay relevant much longer.

← All 25 questions on Ransomware groups and familiesAll topics