threatintel
actor tracker
leak-site activity · unverified

What ransomware crews are posting right now

Recent victim disclosures observed on ransomware leak sites, aggregated by ransomware.live. The feed is hourly-refreshed; entries here are scraped from attacker-controlled leak sites and are surface only— not part of this catalog’s curated primary-source rule.

unverified — attacker claim

Every row below is an unverified claim posted by an extortion crew on a leak site. Groups have repeatedly listed fake victims, inflated breach scopes, double-posted the same victim across brand splits, and re-listed previously-disrupted victims to keep their leak site looking active. Treat as a directional signal of what crews want public — not as a verified incident list.

Posts shown100
Mapped to tracked actor35 (35%)
Latest postMay 18, 21:55
Sourceransomware.live
100 of 100 posts

Data via ransomware.live (Julien Mousqueton). We never mirror leak-site .onion URLs or upstream screenshots. See the About page for our curation rules.