Ransomware Intelligence

Live Ransomware Attack Intelligence Dashboard

Real-time worldwide threat monitoring

Total Victims

10,930

+7.8%

confirmed ransomware victims

Active Ransomware Groups

205

+18.5%

tracked ransomware operators

Countries Affected

142

-2.1%

nations with reported attacks

Live Threat Intelligence

Last 7 days154 victims · 33 countries

Live Attack Feed

Real-time
0 Critical
JNP ENGqilin
Manufacturing
NEW
CLAIMED
MEDIUM
about 11 hours ago
MarketJoyqilin
Professional Services
NEW
CLAIMED
MEDIUM
about 11 hours ago
Eat Saladqilin
Hospitality
NEW
CLAIMED
MEDIUM
about 11 hours ago
MEISA - Sinesmeisa-e.com
Portugal
qilin
Energy & Utilities
NEW
CLAIMED
MEDIUM
about 13 hours ago
NEW
CLAIMED
MEDIUM
about 14 hours ago
NEW
CLAIMED
MEDIUM
about 19 hours ago
NEW
CLAIMED
MEDIUM
about 19 hours ago
csinsurance.mxexample.com
Mexico
killsec
Financial Services
NEW
CLAIMED
MEDIUM
about 21 hours ago
acehospital.inexample.com
India
killsec
Healthcare
NEW
CLAIMED
MEDIUM
about 21 hours ago
NEW
CLAIMED
MEDIUM
about 21 hours ago
trrac.netinc ransom
Transportation
CLAIMED
MEDIUM
about 24 hours ago
iql-nog.comiql-nog.com
Spain
safepay
Manufacturing
CLAIMED
MEDIUM
1 day ago
CLAIMED
MEDIUM
1 day ago
CLAIMED
MEDIUM
1 day ago
CLAIMED
MEDIUM
1 day ago
View all victims

Attack Statistics & Trends

Attack Volume — Last 12 Months

Jul 2025Sep 2025Nov 2025Jan 2026Mar 2026May 202603507001,0501,400

Top Threat Actors & Targets

SOCRadar Ransomware Intelligence is a free real-time threat monitoring platform that tracks active ransomware groups and their attack campaigns worldwide. The dashboard aggregates victim disclosures from ransomware leak sites, dark web forums, and SOCRadar's proprietary monitoring infrastructure to produce a continuously updated global attack map segmented by region, industry sector, country, and ransomware family. Security teams, threat hunters, and SOC analysts use it to understand which ransomware groups are active in their geography or sector, assess current threat levels before executive briefings, and generate domain-specific threat reports to check whether their organization has been mentioned in ransomware actor channels. Data refreshes every five seconds from live sources. No account required.