threatintel
actor tracker
leak-site activity · unverified

What ransomware crews are posting right now

Recent victim disclosures observed on ransomware leak sites, aggregated by ransomware.live. The feed is hourly-refreshed; entries here are scraped from attacker-controlled leak sites and are surface only— not part of this catalog’s curated primary-source rule.

unverified — attacker claim

Every row below is an unverified claim posted by an extortion crew on a leak site. Groups have repeatedly listed fake victims, inflated breach scopes, double-posted the same victim across brand splits, and re-listed previously-disrupted victims to keep their leak site looking active. Treat as a directional signal of what crews want public — not as a verified incident list.

Posts shown200
Mapped to tracked actor58 (29%)
Latest postJul 8, 03:22
Sourceransomware.live
200 of 200 posts

Data via ransomware.live (Julien Mousqueton). We never mirror leak-site .onion URLs or upstream screenshots. See the About page for our curation rules.