～2015

2016

2017

2018

2019

2020

2021

：

ATOMSILOLOCKFILE

AKO

2024

THUNDER X

CATB (CATB99 / BAXTOY)

8BASE
ABYSS
AKIRA
AKO
ALPHA (MYDATA)ALPHV (BLACKCAT)APOS SECURITY
APT73 (ERALEIG)
ARCANE
ARCUS MEDIA
ARVINCLUBASTRO (ASTRA)ATOMSILO
AVADDONAVOSLOCKER
AXXES
BABUK
BABUK2023 (XVGV)BABYDUCKBABLOCK (RORSCHACH)
BIANLIAN
BIG HEAD
BITPAYMERBL4CKT0R (BLACKTOR)BLACKBASTA
BLACKBIT
BLACKBYTEBLACKDOLPHINBLACKMAGIC
BLACKMATTERBLACKOUT
BLACKSHADOW (SPECTRAL KITTEN)
BLACKSNAKEBLACKSUIT
BL00DY (BLOODY)BLUESKY
BONACI GROUP
BUHTI
BULLY
CACTUSCATB (CATB99 / BAXTOY)CERBERCHACHACHAOSCHEERSCHILE LOCKER (ARCRYPTER)CHILY
CIPHBITCIPHERLOCKER
CLOAK
CL0P (CLOP)CONTICOOMING PROJECTCROSSLOCKCRYKAL / CRYLOCKCRYPTBB
CRYPTNETCRYPTOMIXCRYPTON
CRYPTOWALL
CRYPTXXXCRYSIS

2022 - P
2023 - X
2023 - S
2020 - A
2023 - V
2021 - J
2024 - X
2024 - O
2021 - U
2024 - P2019 - Y
2021 - D2021 - A2020 - W
2021 - L
2022 - W
2021 - C
2022 - C
2021 - Z
2022 - P
2021 - B
2023 - Z2017 - Q
2021 - Y
2022 - K
2022 - T
2021 - S
2023 - Y
2022 - Y
2021 - L
2024 - X
2020 - Y
2023 - Q
2023 - J
2022 - O
2022 - S
2021 - Y
2024 - L
2022 - Y
2023 - X
2022 - A2016 - U2019 - N
2021 - Q
2022 - B
2022 - Z
2023 - I
2023 - X
2023 - Y
2023 - T2019 - W2019 - F
2021 - Y
2023 - Y2015 - V
2023 - P
2023 - Y2016 - W2017 - P2015 - W2016 - W2016 - P

Possibly associated with ransomware group's initial access broker.

CUBA
CYCLOPS

2019 - U
2023 - M：At the same timing, same victims were posted on both leak sites.

CYLANCE
DAGON

2023 - C
2022 - D

DAIXINDAN0N (DANON)DARKANGELS

2022 - C2024 - X
2022 - CDARKPOWERDARK VAULT2023 - Y
2024 - ODARKBITDARKRACE

2023 - Y
2023 - YDARKRYPTDARKSIDE

2021 - Y2020 - L

DATAF
DEATHRANSOM

2023 - C2020 - H

DEFRAY777
DHARMADIAVOL2018 - U2016 - P
2021 - N

DIKE
DISPOSSESSOR

2017 - O
2024 - O

DONEX
DONUT

2024 - X
2022 - F

DOPPELPAYMERDRAGONFORCE

2019 - Q
2023 - P

DUNGHILL
ECH0RAIX (ECHORAIX)

2023 - C2017 - Z

EGREGOR
EL_COMETA
ELBIE

2020 - O
2021 - V2017 - O

EL DORADOEMBARGO

2024 - X
2024 - X

EMPEROR DRAGONFLYENDURANCE

2022 - A
2022 - Z

ENTROPY
EP918
ERUPTIONESXIARGS

2021 - Q
2021 - Z2020 - U
2022 - Z

EVEREST
EVILCORP

2020 - R2015 - P

EXORCIST
Farnetwork
FAUST

2020 - Z
2023 - E2017 - O

FONIX (XINOF)
FSOCIETY / FLOCKER

2020 - Z
2024 - X

FUSIONGANDCRAB

2016 - E2018 - T

GANGBANG
GHOSTSEC

2017 - E
2022 - R

GOING INSANE
GOOD DAY

2024 - Y
2023 - T

GRIEF
GROOVE
HADES

2021 - Q
2021 - C2020 - Q

HARDBITHARONHELLBORNHELLO GOOKIE

2022 - O
2021 - W
2021 - Y
2024 - I

HELLO KITTY (FIVE HANDS)HERMES

2020 - I2017 - F

HITLER (AGL0BGVYCG)
HIVE

2016 - Z
2021 - F

HOLYGHOST
HOTARUS2021 - Y
2021 - Z

HUNTERS INTERNATIONAL
ICEFIREINC RANSOMINDUSTRIAL SPYISOSJIGSAW
JSWORM
KARAKURT
KARMA
KILLSECKNIGHT
LA PIOVRALAMBDALAPSUS$LILITH
LIZARDLOCK4LOCKBIT (ABCD)LOCKBIT2.0 (LOCKBIT RED)LOCKBIT3.0 (LOCKBIT BLACK)LOCKDATALOCKERGOGALOCKFILE
LOKI LOCKER
LORENZLOSTTRUSTLV
MACAW LOCKER
MADCAT
MAILTOMALAS
MALEKTEAMMALLOX (FARGO)
MARIO
MAZE
MBC
MEDUSAMEGACORTEXMEOWMETAENCRYPTORMICHAELKORSMIDASMILIHPENMINDWARE
MOGILEVICH
MOISHAMONEY MESSAGEMONTI
MORLOCKMOUNT LOCKER
MY DECRYPTER (MAGNIBER)N4UGHTYSECNB65NEBULA
NEFILIM
NEMTY
NETWALKER
N3TW0RM (NETWORM)
NEVADANIGHTSKYNOESCAPENOKOYAWANONAME
OFFWHITE
0MEGA (OMEGA)ONEPERCENTONYX
PANDORAPAY2KEYPAYLOAD.BIN
PHOBOSPHOENIX LOCKER
PLAY
POLYVICE
PROJECT RELICPROLOCKPROMETHEUS
PUTIN TEAMPWNDLOCKERPYSA / MESPINOZAQILIN (AGENDA)QIULONGQLOCKERQUANTUM
RA GROUPRA WORLDRABBIT HOLE
RADAR
RAGNAR LOCKER
RAGNAROKRAMP
RANCOZRANIONRANSOM CARTELRANSOM EXXRANSOM CORPRANSOMED.VC
RANSOMHOUSERANSOMHUBRANSOMWARE BLOGRANZYRAZNATOVICRED RANSOMWARE GROUP (RED CRYPTOAPP)REDALERT (N13V)
REVIL (SODINOKIBI)RHYSIDAROBBINHOOD
ROOK
ROYAL
RTM
RYUK
54BB47H (SABBATH)SAMSAMSCARECROWSCHOOLBOYSSEKHMETSENSAYQSHADOWSHAOLEAKSSIEGEDSECSILENT RANSOM GROUP
SLUG
SNAPMCSNATCHSOLIDBITSPACE BEARSSPARTASPARTACUS
SPOOK
STEEL
STORMOUSSUGAR
SUNCRYPTSUNNYDAYSYNACKSZ40
TELEGRAMTHANOS
THREEAM (3AM)

2023 - F
2022 - Z
2023 - X
2022 - U2017 - O2016 - W2019 - E
2021 - M
2021 - E
2023 - X
2023 - M
2023 - Y
2023 - Z
2021 - H
2022 - Y2016 - O
2023 - C2019 - P
2021 - P
2022 - M
2022 - Q
2022 - E
2021 - A
2021 - T
2021 - V
2023 - U2020 - T
2021 - Q
2023 - Y2019 - V
2023 - X
2023 - X
2021 - X
2021 - G2019 - O
2021 - Y2019 - A2019 - Z
2022 - S
2023 - U
2023 - C
2021 - W2016 - E
2022 - Y
2024 - Z
2022 - Z
2023 - X
2022 - G2024 - M2020 - D2017 - T2015 - Y
2022 - G2020 - Z2020 - E2019 - E2020 - V
2021 - Y
2022 - E
2021 - B
2023 - W
2022 - E
2024 - M2018 - E
2022 - Y2020 - T
2022 - Q
2022 - A2020 - Y
2021 - C2018 - P
2021 - Q
2022 - E
2022 - I
2022 - Y2020 - N
2021 - W
2022 - S2019 - N2019 - Y
2022 - L
2024 - X
2021 - Z
2021 - D2023 - C2024 - C2024 - Y
2022 - Y2019 - O2019 - Y
2021 - C
2023 - Y2017 - Z
2021 - T2020 - U
2023 - S
2023 - R
2021 - G2024 - K
2022 - A2020 - A
2023 - R
2024 - O
2022 - I2019 - T
2023 - I2019 - Y
2021 - A
2022 - J
2023 - C2018 - F
2021 - U2015 - U
2022 - S
2022 - M2020 - O
2024 - X
2023 - Z
2022 - Y
2022 - R
2022 - H
2024 - Y
2021 - Z2018 - X
2022 - Q
2024 - X
2022 - Y2018 - U
2021 - W2017 - O
2021 - R
2021 - Z2019 - O
2023 - I2017 - V2020 - V2016 - E2019 - W
2023 - L

THUNDER X
TOMMYLEAKSTRIGONA
TRISECUNDERGROUNDUNSAFEV IS VENDETTA
VASA LOCKER (BABY)
VEGA
VICE SOCIETY
VSOP
WASTEDLOCKERWEREWOLVESWHITERABBITX001XSXING TEAMYANLUOWANGYASHMAZEONZEPPELIN
ZERO TOLERANCE

2020 - A
2022 - M
2022 - V
2024 - Y
2023 - U
2022 - Y
2023 - U2020 - C2019 - I
2021 - I
2022 - Q
2020 - Q
2023 - M
2021 - G
2022 - A
2021 - D2021 - H
2022 - Q
2022 - J2019 - I
2024 - X

CATB (CATB99 / BAXTOY)PANDORA

ROOK

RANZY

X001XS：：EMPEROR DRAGONFLY (involves DEV-0401 / BRONZE STARLIGHT) is reportedly behind
this. It has been pointed out that there are similarities with those ransomware.

X001XS It is pointed out that the content of thepostings on the leak site is very similar to ROOK.

AKO Relationship between AKO and MEDUSA ispointed out sometimes, but AKO developer denied.

INDEX：Ransom notes are similar and relevance of the groups are pointed out.

The actors are reportedly similar
within those ransomware.

Their leak site is similar to BLACKMATTER's leak site.

MEDUSA

2023

RANSOMWARE BLOGRANSOMWARE BLOG The presence of a link on the
MEDUSA negotiation site indicates a potential connection.

A

2022

：Possibly a fork of ROOK.

NIGHTSKY

Confirmed cooperative activities with OSINT Corp.

CHEERSNIGHTSKY：It is pointed out they used BABUK's code.

ROOK

：

CHEERS The method of posting the name of the victim
organization in hidden letters on the leak site is similar.

B

BIANLIAN：At the same timing, same victims were posted on both leak sites.

RANSOMHOUSECHEERS

Source code was leaked on a hacker forum in September 2021.

DARKANGELSVASA LOCKER(BABY)

C：It is pointed out that the CHEERSCRYPT ransomware was developed based on BABUK's code.
DUNGHILLPAYLOAD.BIN

RA GROUPBABUK：It is pointed out that this group used the leaked BABUK.

RA WORLDDAIXIN

WHITERABBITGROOVE

Possibly ran by BLACKMATTER affiliates.

：It is pointed out that it is operated by the administrator of GROOVE.

：

RAMP

DAIXIN, NOKOYAWA, RA GROUP It is pointed out that they used leaked BABUK’s code.
(Other; BABUK2023 (XVGV), CYLANCE, DATAF, LOCK4, MICHAELKORS, RTM, etc.)

RAMP

MORLOCKASTRO (ASTRA)DASTRO (ASTRA)：It is pointed out that there are relationship within affiliates.

：Alleged to attack Russian companies using LOCKBIT BLACK and BABUK.

：DAGON Code similarities with MOUNT LOCKER andQUANTUM have been pointed out.

XING TEAMMOUNT LOCKERDAGON
QUANTUM
VICESOCIETY

These groups are recognized as franchise-type RaaS, because attack methods and hosting servers are similar or
identical. In some cases, these groups are considered as a rebranded group due to code similarities.

QUANTUM：It is similar to KARMA, and some says it is a rebranded group.

NOKOYAWA

KARMA is said to have started from JSWORM, and evolved through NEMTY, NEFILIM, OFFWHITE,TELEGRAM, FUSION, MILIHPEN, and GANGBANG ransomware.

JSWORM

NEMTY

NEFILIMKARMA：It is pointed out that a variant of RUST-based NOKOYAWA subspecies.
Takedown in January 2023.In Nov., arrested attackers who used LOCKERGOGA,MEGACORTEX, and DHARMA in addition to HIVE.

：

：

HIVE

HIVE At the same timing, same victims were posted on bothleak sites. But HIVE denied any connection to CONTI.

HUNTERS INTERNATIONAL

Sold on hacker forums since 2017. Multiple variants exist.

RYUK

：

：It is pointed out that it was created based on the HERMES's code.

：(Involvement DEV-0230

G

DONUT

DONUT

、DEV-0193 (WIZARD SPYDER) etc.)

RANSOMHOUSE

WHITERABBIT, MARIO Cooperation with
BIANLIAN was confirmed in ransomware attacks.

MONTI

★

H

MONTI

★

MARIO

NB65

★

NB65 ( )LOCKBIT GREEN

PUTIN TEAMMEOWSCARECROW ( )RANSOMHOUSE A case has been confirmed in which the URL of RANSOMHOUSE
was included in a threatening letter created by WHITERABBIT.

HELLO KITTY (FIVE HANDS)

★

MONTI

：Confirmed this ransomware was built from the leaked CONTI source code.
SILENT RANSOM GROUPBLUESKY ( )：：：May have used leaked CONTI source code or binaries.

It is pointed out that the presence of a common developer with BABUK.

YANLUOWANG

Reuse of DeathRansom and ABYSS is pointed out. An individual
believed to be the developer released the source code on ahacker forum in Oct. 2023.

SILENT RANSOM GROUPLAPSUS$：YANLUOWANG

There are multiple variants deployed as RaaS.

I：MONTI posted DONUT LEAKS credentials on the leak site.

：It is pointed out that there are relationship within affiliates.
YANLUOWANG：Possibly some IAB (Initial Access Broker) are the same.
They do not use ransomware, but confirmed some cooperation with other groups.

(Involvement DEV-0537)

ZEPPELIN

MONTI

NB65

：It is pointed out that some CONTI attackers launched it as a new group.

Prior to developing its own ransomware, it wasreportedly using BABUK's Linux locker.

VEGA：This group promotes RANSOMHOUSE on Telegram.

Extortion group with confirmed ties to ransomware attack groups.

(Involvement FIN8)The CONTI source code was leaked around March 2022. The
following attack groups were alleged to have repurposed thesource code.
denotes groups without leak sites.

LAPSUS$RANSOMHOUSE

WHITERABBIT：▼Additional Information
AKIRA

：

：At the same timing, same victims were posted on both leak sites.

CONTI

Claims to focus on data theft rather than encryption as the main objective.

HUNTERS INTERNATIONAL The attack group is pointed out rebranding of
HIVE ransomware because of its source code similarities, but they denied.

(Involvement GRIM SPIDER)RYUKLeak site existes, but no exposure activity has been confirmed at this moment.

NEVADA

CONTI While it is generally recognized as a rebrand of RYUK, someconsider it is a separate organization belonging to the same parent group.

F

NEVADANOKOYAWAIt has been pointed out that CONTI is collaborating with affiliates of HELLO KITTY, HIVE,
BLACKCAT, AVOSLOCKER, and BABUK attack groups, by outsourcing some of its tasks.

HERMESAt the same timing, some of the same victims by SNATCH were posted on the leak site. It is
pointed out that Farnetwork, which is suspected to be related to JSWORM, is behind the scene.

PLAY：It is pointed out that there are relationship within affiliates.

E：Reportedly used QUANTUM ransomware.

It is pointed out attackers behind HIVE and NOKOYAWA are related eachother. PLAY may be ran by the same attackers due to similar attack methods.

：It is pointed out that there is a relationship with affiliates.

HELLO KITTY (FIVE HANDS)HELLO GOOKIEZEPPELIN：Among variants, outstanding damages have been confirmed.

RHYSIDA：VICE SOCIETY The use of HELLO KITTY andZEPPELIN ransomware has been pointed out.

：Some pointed out similarities with VICE SOCIETY in TTP and attack industries. And some says it is a rebranded group.
：It is pointed out that they used variant of the REDALERT ransomware.

VICE SOCIETY

REDALERT (N13V)

VICE SOCIETY

：

J

ROYAL

：Generates a ransom note very similar to CONTI.

There are also confirmed cases of extortion without using ransomware.

：A connection between members of ROYAL and CONTI has been suggested.

：Pointed out similarities with ROYAL in Linux sample.

BLACKSUIT

ZEON：

BLACKSUIT(Involvement DEV-0569)：It is pointed out the use of BLACKCAT ransomware.

：：

ALPHV (BLACKCAT) It is pointed out the possibility that CONTI
used BLACKCAT ransomware as one of the attacks.

ROYAL

ALPHV (BLACKCAT)On December 19, 2023, the web site was seized (announced by the FBI the next day),but immediately after, ALPHV (BLACKCAT) restored the seized screen and continued
activities. In early March 2024, the site again changed to a seized screen, but it is highly
likely to have been staged, after which they disappeared.

K

ROYAL

：

THREEAM (3AM) Relationship with CONTI and ROYAL
suggested based on infrastructure and TTP overlap.
VICESOCIETY

It is considered to be VICE SOCIETY's own ransomware. The
relationship with codes such as CHILY and SUNNYDAY is pointed out.

POLYVICE(Involvement DEV-0832)

ZEON

RHYSIDA：There is information that it was usingBLACKCAT'stools before using its own encryption tool.

RANSOMHUB：LOCKBIT3.0 Some members claim to have purchased thesource code from BLACKCAT and BLACKMATTER.

：(Involvement NOBERUS)▼Additional Information

RANSOMHUB：Overlaps with the source code of
KNIGHT3.0 ransomware sold on hacker forums identified.

The LOCKBIT BLACK builder was leaked around September 2022.
The following attack groups were alleged to have repurposed thebuilder.
denotes groups without leak sites.

：：

THREEAM (3AM) Relationship with
CONTI and ROYAL suggested based on
infrastructure and TTP overlap.

ALPHV (BLACKCAT) It is confirmed the possibility of overlapping affiliates and the use of
the same original data leakage tool. Pointed out that LOCKBIT and others are rebrands.

★

BLACKBASTA：Similar to CONTI's payment site & leak site.

BLACKBASTA

BLACKMATTER：L

THREEAM (3AM)

Involvement of COREID (Involvement FIN7 / CARBON SPIDER) is pointed out.

：Confirmed usage after LOCKBIT exploit failure. Affiliates maybe belong both.

★

BL00DY (BLOODY)MORLOCK ( )BUHTI ( )SCHOOLBOYS( )CRYPTBBWEREWOLVES★

THREEAM (3AM)DARKSIDE

Ralationship with REVIL is pointed out
due to similarity of the ransomware.

ALPHV (BLACKCAT) ALPHV affiliates published and sold victim organization
information previously posted on the ALPHV leak site on the RANSOMHUB leak site.

★

DRAGONFORCE：WEREWOLVES Soon after WEREWOLVES appeared, they posted
victims overlapping with LOCKBIT and QILIN, hinting some connections.

AVOSLOCKER：It is pointed out that there are relationship within affiliates.

BLACKMATTER：There are technical similarities in those ransomware.

QILIN (AGENDA)

AVOSLOCKERLOCKBIT：They diverted CONTI to LOCKBIT GREEN.

WEREWOLVES：It is reportedly used the leaked LOCKBIT3.0 ransomware builder.

SCHOOLBOYSMORLOCK

They are possibly a same group.

M

TOMMYLEAKS：Conversation with the victims points out a relationship with KARAKURT, and it is believed to be a branch of CONTI.

CYCLOPS(LOCKBIT BLACK)：It is said to be an extortion group when CONTI failed to encrypt.
DIAVOL：Possibly using common infrastructure with KARAKURT.

KNIGHT
Leak site went down in mid-February 2024; around the same time, the KNIGHT3.0 ransomware source code was sold and purchased on a hacker forum.

TOMMYLEAKSKARAKURT：It is pointed out similarities with BABUK and LOCKBIT.

CYCLOPSKARAKURT：

In late February 2024, part of their servers were seized by law
enforcement in "Operation Cronos", but activities resumed within days.
In May 2024, the alleged mastermind was indicted by law enforcement.

：(Involvement DEV-0193 (WIZARD SPYDER) etc.)

DIAVOLMORLOCK：Alleged to attack Russian companies using LOCKBIT BLACK and BABUK.

LOCKBIT3.0

SCHOOLBOYS

Alleged to use LOCKBIT BLACK in attacks.

NONAMENONAME Relationship suggested based on similarities in leak sites and overlapping victim organizations.
Some believe it may be an impersonation. (Leak site discovered, but appearance may date back to 2019.)：Similarities to CONTI have been observed.

DIAVOLNPWNDLOCKER

PROLOCK：EGREGOR Relationship with
PROLOCK is pointed out basedon TTP and technical similarities.

CHACHAMAZE：It is considered as a variant of SEKHMET.

EGREGORSUNCRYPT

Announced as RaaS in 2019, and advertised on hacker forums. PHOBOS has
many variants such as LIZARD, ISOS, DIKE, STEEL, ELBIE, FAUST, etc.

：

DHARMA：P：Their leak site imitates LOCKBIT2.0, but no evidence of relationship or actual attack is confirmed.

MAZE, RAGNAR LOCKER, SUNCRYPT, and LOCKBIT were reportedly collaborating.

LOCKBIT：LOCKBIT (ABCD)：：The chat site is very similar to that of LOCKBIT.

：It is considered as a variant of YASHMA.

GRIEF

：

WASTEDLOCKER The ransom note is similar to BITPAYMER,
and they reportedly used EVILCORP to evade US sanctions.

Q：Alleged to have repurposed the leaked LOCKBIT BLACK source code.

DRAGONFORCE
SOLIDBIT

SOLIDBIT

DOPPELPAYMERCHAOSENTROPY

YASHMAHADESSOLIDBIT
BLACKSNAKE：

To evade sanctions, some believe that EVILCORP rebranded PHOENIX LOCKER to PAYLOAD.BIN.

WASTEDLOCKER：Connection suggested as some common victim organizations were posted on LOCKBIT's Telegram channel.

DRAGONFORCEBABLOCK(RORSCHACH)：To evade US sanctions, some members of EVILCORP reportedly acted as LOCKBIT's affiliates.

BITPAYMER It is said that
EVILCORP was used in the attack.

ARCUS MEDIA(LOCKBIT RED)BITPAYMER

ARCUS MEDIABABLOCK Integrated and effectively used BABUK, LOCKBIT2.0,
and other group’s technology and attack methodology.

LOCKBIT2.0

CRYPTON
EVILCORP

Each leak site resembles LOCKBIT, but the relationship is unclear.

CRYPTBB

8BASE：

Similarities in ransom notes with MAZE ransomware pointed out.

CRYPTBB Diversion of LOCKBIT3.0 (LOCKBIT BLACK) is pointed out.

CRYPTBB Connection is pointed out due to thesimilarity of leak site and the duplication of victim list.

CRYPTON

It is said to have existed since around 2007.

RED RANSOMWARE GROUP(RED CRYPTOAPP)：

Leak site and ransom note similarities with RANSOMHOUSE ispointed out. Also pointed out diversion from PHOBOS ransomware.

PHOBOS It is pointed out that it wasdeveloped based on the DHARMA's code.

DHARMA It is pointed out that it was developed
because its decryption key was leaked.

APT73 (ERALEIG)

BL00DY (BLOODY) It is pointed out that they used the leaked
LOCKBIT 3.0 ransomware builder first in an actual attack.

PHOBOSThe vast majority of listed victim organizations overlap with past LOCKBIT and other groups' listings.

DARK VAULT

BL00DY (BLOODY)：

A person claiming to be the developer of thesethree, released a master key for decryption.

RAGNAR LOCKER

It has been confirmed that it was distributed and sold as RaaSon hacker forums, etc., and the source code was sold in 2020.

DISPOSSESSORHARDBIT Ransom notes and logo are similar, but therelationship is unknown.HARDBIT commented in theinterview that they used LOCKBIT's ransom note.

SEKHMETLeak site was taken down on Oct. 19, 2023. Multiple countries cooperated and dismantled the group.

CRYSISHARDBIT：

EGREGORIt is believed to be the first ransomware group to employ double extortion.
It can be seen that attack groups with leak sites began to emerge starting with MAZE.

OFirst appeared in October 2022, followed by 2.0 in
November.While they claimed data theft, no leak site is confirmed.

BLACKSNAKE It is reportedly developed based on CHAOS ransomware.

PHOENIX LOCKERLOCKDATA：To evade US sanctions, it reportedly used EVILCORP.

MACAW LOCKER

ONYX

MACAW LOCKER：It is reportedly developed based on CHAOS ransomware.

VSOP

LOCKDATA：This ransomware reportedly developed based on CHAOS Ransomware Builder v4 (variant of CHAOS ransomware).
SIEGEDSEC：A connection to the operational base of RANSOMED.VC is pointed out.

ONYX

SIEGEDSEC

The leak site was launched in Dec. 2023. Soon after, it was taken down by the hacktivist group “D7BBUK”.

：Cooperative relationship with EVEREST is pointed out.

Announced dissolution in Oct. 2023. Then they hinted resuming activities under a new name in Dec.

RANSOMED.VC

EVERESTR

RANSOMED.VC

STORMOUSRAZNATOVIC：They expressed STORMOUS as a partner.

RANSOMED.VC
While some question the claims of ransomware usage, samples written by PHP areconfirmed.Also confirmed they expressed RANSOMED.VC as a partner.

：Some indicated there may be a relationship with RANSOMED.VC.

：Alleged to conduct double extortion ransomware attacks in collaboration with STORMOUS.

RANSOMCORP

GHOSTSEC

GHOSTSEC：Similarities to EVEREST have been observed.

Though the specific activity start date was uncertain, the leak site was found in 2023.

BLACKBYTE：It could be the extortion department of CONTI.

BLACKBYTESRANSOM CORP

BLACKBYTE：(Involvement HECAMEDE)

The decryption key and source code were released in the hacker forum on February 2023. The leak site was found on Nov. 2023.

Presumed variant of the leaked CONTI source code.

PUTIN TEAMSCARECROWBLUESKY

MEOW：Reported ties to CONTI based on cryptocurrency transactions; multiple sources suggest AKIRA repurposed code from CONTI.

AKIRA

AKIRA

MY DECRYPTER (MAGNIBER)

It is pointed out that it is deployed as RaaS for some of their members.

：It may be developed by the same engineer.

：Technical relationship is pointed out.

LOKI LOCKERRANSOM CARTEL

MY DECRYPTER(MAGNIBER)

T：Relationship is pointed out because the CLOAK's leak site URL appears in the ransom note.

GOOD DAYRANSOM CARTELBLACKBIT：Due to functional similarities, they are considered as a subspecies of LOKI LOCKER.

BLACKBIT

It is pointed out that was using BLACKCAT ransomware. Re-activated in April 2022, after the takedown in July 2021.

GANDCRABREVIL (SODINOKIBI)(Involvement

GOOD DAYCLOAKONEPERCENT：DEV-0504)

ONEPERCENT：Relationship with REVIL, MAZE, and EGREGOR is pointed out.

LV

：It is pointed out that the code and structure is similar to REVIL.

：LV

SAMSAM

CERBER

SPARTACUS
CUBA

They temporarily suspended its activities, but new specimens appeared, exploiting CVE-2021-26084 /CVE-2021-22205 in Dec. 2021, CVE-2022-26134 in Jun. 2022, and CVE-2023-22518 in Nov. 2023.

It is pointed out that there are common TA.

U

V IS VENDETTA Confirmed its existence in sub-domain of CUBA in 2023.Vice-versa, there is an
opinion that CUBA is a rebrand of V IS VENDETTA.Details and relationship are unclear at this time.

V IS VENDETTA
INDUSTRIAL SPY：

INDUSTRIAL SPY Relationship with CUBA suggested based on ransom note similarities. However, some believe
it may be a temporary situation resulting from INDUSTRIAL SPY using CUBA ransomware for testing purposes.

DEFRAY777

TRIGONARANSOM EXX

ERUPTION

ARCANEUNDERGROUNDMETAENCRYPTOR

54BB47H (SABBATH)LOSTTRUST(Including possibility of being active before 2022 from the posted information on the leak site.)：(Involvement UNC2190)：Due to technical and TTP duplications, some indicated there may be a relationship with attack groups utilizing CRYLOCK.

CRYKAL / CRYLOCKTRIGONA
Ukrainian Cyber Alliance (pro-Ukrainian hacktivist group) took down TRIGONA's leak site in Oct, 2023.

SZ40

V

LORENZSYNACK

EL_COMETA
MAILTO

NETWALKER：Relationship pointed out from the tools and technical aspects used for the attack.

ALPHA (MYDATA)ALPHAJIGSAW

THANOSPROMETHEUS

SPOOK

Using THANOS ransomware.
They were developed by a Venezuelan cardiac surgeon.

HARON

W

：There are similarities in ransom note and leak site.

HARON
It is pointed out the code diversion of
CRYPTOWALL and CRYPTXXX.

It is pointed out that an attacker called DEV-0950 used CL0P (CLOP) ransomware.
Cases have been confirmed where only data theft is performed without encryption.

CRYPTOMIXCL0P (CLOP)：It is pointed out that it is a variant of CRYPTOMIX.

NOESCAPE

AVADDON

MIDAS

AXXES

Termination was declared and closed leak site in Dec. 2023. Affiliates
claimed NOESCAPE operators absconded with money stolen from victims.

：Both ransomware is highly similar, some pointing out re-branding possibility.

NOESCAPE

CL0P (CLOP)：(Involvement TA505, FIN7, FIN11)
It is pointed out that DanaBot is used as a deployment method is.

SNATCHMALLOX (FARGO)ABYSSAt the same timing, some of the same victims by
NOKOYAWA were posted on the leak site.

X

CIPHBITINC RANSOMCACTUSKILLSECAPOS SECURITY

MALAS

MALEKTEAMDONEXBLACKOUT

EL DORADO

FSOCIETY / FLOCKERMONEY MESSAGE

DAN0N (DANON)EMBARGOSENSAYQQIULONGSPACE BEARSZERO TOLERANCE
It is pointed out that these ransomware issomewhat related each other.

N4UGHTYSECPYSA / MESPINOZARAGNAROKY

PAY2KEY

BLACKSHADOW(SPECTRAL KITTEN)ROBBINHOODBL4CKT0R (BLACKTOR)COOMING PROJECTARVINCLUBHELLBORN

BONACI GROUPDARKRYPTHOLYGHOST

MBC

BLACKMAGICBULLY

0MEGA (OMEGA)

LILITHPROJECT RELICMINDWARE

BLACKDOLPHINRADARDARKBITZRANIONMEGACORTEXEXORCISTFONIX (XINOF)NEBULABABYDUCK

EP918

HOTARUSDARKPOWER

UNSAFESPARTA

MADCAT

CHILE LOCKER (ARCRYPTER)

ENDURANCEESXIARGSRANCOZSUGARQLOCKERRABBIT HOLE

SLUG

TRISECDARKRACE

LA PIOVRABIG HEADCROSSLOCKLAMBDA

Unknown relationship with the ransomwareof the same name confirmed in 2021.

SNAPMC

GOING INSANE(Leak site was discovered, but the date of appearance is unknown)

N3TW0RM (NETWORM)

ECH0RAIX(ECHORAIX)CRYPTNET

Confirmed ransomware attacks, but possibly a hacktivist.

Some cases confirmed where data was stolen without encryption.

SHAOLEAKSHITLER(AGL0BGVYCG)

CIPHERLOCKERICEFIRE

MOISHA

Ransomware with the same name existed in
2021, but the relationship is unclear.

SHADOW

MOGILEVICH
Operated a leak site but self-proclaimed to be a fraud group.