Ransomware Intelligence

Live Ransomware Attack Intelligence Dashboard

Real-time worldwide threat monitoring

Total Ransomware Victims

11,352

+11.3%

confirmed ransomware victims

Active Ransomware Groups

208

+18.9%

tracked ransomware operators

Countries Affected

148

+2.8%

nations with reported attacks

Live Threat Intelligence

Last 7 days147 victims · 38 countries

Live Attack Feed

Real-time
0 Critical
CLAIMED
MEDIUM
about 8 hours ago
CLAIMED
MEDIUM
about 8 hours ago
CLAIMED
MEDIUM
about 11 hours ago
CLAIMED
MEDIUM
about 11 hours ago
CLAIMED
MEDIUM
about 15 hours ago
CLAIMED
MEDIUM
about 16 hours ago
Deutsche Bankdb.com
Germany
unsafe
Financial Services
CLAIMED
MEDIUM
about 18 hours ago
Locati Architectslocatiarchitects.com
Australia
play
Other
CLAIMED
MEDIUM
about 19 hours ago
Silvestri & Associates Insurancesilvestriandassociates.com
United States
play
Financial Services
CLAIMED
MEDIUM
about 19 hours ago
TQ Financial Servicestqfinancials.comqilin
Financial Services
CLAIMED
MEDIUM
1 day ago
CLAIMED
MEDIUM
1 day ago
Goodwill Manasotaexperiencegoodwill.org
United States
qilin
Retail & E-Commerce
CLAIMED
MEDIUM
1 day ago
Sitmaticsitmatic.com
Germany
qilin
Technology
CLAIMED
MEDIUM
1 day ago
Sisintsisint.pt
Portugal
qilin
Technology
CLAIMED
MEDIUM
1 day ago
CLAIMED
MEDIUM
1 day ago
View all victims

Attack Statistics & Trends

Attack Volume — Last 12 Months

Aug 2025Oct 2025Dec 2025Feb 2026Apr 2026Jun 202603507001,0501,400

Top Threat Actors & Targets

SOCRadar Ransomware Intelligence is a free real-time threat monitoring platform that tracks active ransomware groups and their attack campaigns worldwide. The dashboard aggregates victim disclosures from ransomware leak sites, dark web forums, and SOCRadar's proprietary monitoring infrastructure to produce a continuously updated global attack map segmented by region, industry sector, country, and ransomware family. Security teams, threat hunters, and SOC analysts use it to understand which ransomware groups are active in their geography or sector, assess current threat levels before executive briefings, and generate domain-specific threat reports to check whether their organization has been mentioned in ransomware actor channels. Data refreshes every five seconds from live sources. No account required.