EudorIACyber Intelligence
Operational monitoring Newsletter IT EN
Global observatory

Ransomware worldwide

Organizations named in claims, affected countries and the most active groups. An overview updated from public sources.

See the latest cases
Sources up to date Last collection Sources and methodology
The period at a glancelast 30 days · All data follows the selected filters
Reported cases3matching reports grouped into cases
In the last 24 hours0first public report
Countries involved13 cases with a known country
Groups in the claims3in the selected period
Reset filters
Where it happens

Countries of reported organizations

3 mapped cases
World map of victim countries stated in public claims

Hover for details. Click a country to zoom in, then drag the map to pan.

The map shows the country of organizations named by the sources.
  1. 0
  2. 1–9
  3. 10–99
  4. 100–999
  5. 1.000–9.999
  6. 10.000+

3 / 3 cases with a usable country · 0 without usable country data.

How it is evolving

Reporting trend

Cases per day · UTC

Date first reported by the sources, which may differ from the attack date. The current period is incomplete.

1 Reporting trend3 reported cases. Values are available in the table below the chart.28/08: 129/08: 030/08: 031/08: 001/09: 102/09: 003/09: 004/09: 005/09: 006/09: 007/09: 008/09: 009/09: 010/09: 011/09: 012/09: 113/09: 014/09: 015/09: 016/09: 017/09: 018/09: 019/09: 020/09: 021/09: 022/09: 023/09: 024/09: 025/09: 026/09: 0
28/0826/09
View chart values
PeriodReported cases
2026-08-281
2026-08-290
2026-08-300
2026-08-310
2026-09-011
2026-09-020
2026-09-030
2026-09-040
2026-09-050
2026-09-060
2026-09-070
2026-09-080
2026-09-090
2026-09-100
2026-09-110
2026-09-121
2026-09-130
2026-09-140
2026-09-150
2026-09-160
2026-09-170
2026-09-180
2026-09-190
2026-09-200
2026-09-210
2026-09-220
2026-09-230
2026-09-240
2026-09-250
2026-09-260
Who is claiming responsibility

Most active groups

Group profiles →
  1. global1 33%
  2. Krybit1 33%
  3. medusalocker1 33%

Share of cases in the period, by the group named by the sources.

Who is affected

Organization sectors

3 / 3
  1. Hospitality1 33%
  2. Manufacturing1 33%
  3. Technology1 33%

Classification reported by the sources. 0 cases without a usable sector.

What is happening

Latest reported cases

1–3 / 3

Open a case to review its sources. A claim does not establish a confirmed compromise.

First reportedOrganisationGroupCountrySectorSources
09:01 UTC 瑞祥机电 (Ruixiang Jidian) medusalocker China Manufacturingransomware.live
09:00 UTC reignwoodpark.com2 aggregated matches Krybit China HospitalityRansomLook · ransomware.live
15:01 UTC Atcomm global China Technologyransomware.live
Sources, coverage and methodology

This observatory describes claims in the monitored sources: worldwide ransomware coverage is partial. Reported cases are not a count of confirmed attacks or unique victims.

Reports with the same organization and group name, within 30 days of the first report, are grouped into one case. Letter case, spacing and known aliases are normalized; different names may still refer to the same organization.

4 source reports for 3 reported cases. Country and sector come from the sources: missing or conflicting data remains unassigned. Dates use UTC; the collection date is used if no publication date is available.

RansomLookLast successful collection
ransomware.liveLast successful collection

General articles, group profiles and technical portal checks are excluded from the counts.

View onion portal diagnostics →