Ransomware needs a way in. Stolen credentials are the cheapest one.
Live Ransomware Attack Intelligence Dashboard
Real-time worldwide threat monitoring
Total Ransomware Victims
10,416
+14.4%confirmed ransomware victims
Active Ransomware Groups
235
+29.8%tracked ransomware operators
Countries Affected
145
+0.7%nations with reported attacks
Live Threat Intelligence
Last 30 days1,029 victims · 68 countries
Attack Statistics & Trends
Attack Volume — Last 12 Months
Top Threat Actors & Targets
SOCRadar Ransomware Intelligence is a free real-time threat monitoring platform that tracks active ransomware groups and their attack campaigns worldwide. The dashboard aggregates victim disclosures from ransomware leak sites, dark web forums, and SOCRadar's proprietary monitoring infrastructure to produce a continuously updated global attack map segmented by region, industry sector, country, and ransomware family. Security teams, threat hunters, and SOC analysts use it to understand which ransomware groups are active in their geography or sector, assess current threat levels before executive briefings, and generate domain-specific threat reports to check whether their organization has been mentioned in ransomware actor channels. Data refreshes every five seconds from live sources. No account required.
F.A.Q.
Find answers to common questions about ransomware threats and intelligence