Ransomware Radar
Ranks the 25 ransomware crews with the most claims by how far their latest claims sit above their own baseline, with trend, momentum, sector mix and sanctions, for analysts and defenders who track ransomware groups.
Claims come from the groups' own leak sites and are unverified. Data from the pwnsy data API, merged from RansomLook and ransomwatch.
Loading ransomware activity
Fetching claimed victims per crew from the pwnsy data API.
Sectors hit (tap a crew to open it)
Latest claims
How the radar works
The pwnsy data API merges ransomware leak-site posts from RansomLook and the archived ransomwatch project, then counts claimed victims per crew. The radar shows the 25 crews with the most claims. All windows are anchored on the newest record in the feed, so a stale feed does not make every crew look quiet.
- Recent and prior are claims in the last 90 days of the feed and in the 90 days before that. Momentum is the percentage change between them.
- Spike is a z-score: the latest month's claims compared with the crew's own average over the previous 11 months, in standard deviations.
- Sectors come from a keyword classifier on victim names. Sanctioned marks crews with an OFAC or UK designation on record.
How to read the result
Because each crew is measured against its own history, a small crew doubling its claims stands out as much as a large one. A z-score of 1 or more marks a spike and 2 or more a strong one. A red trend line means momentum is up.
Claims are self-reported by the groups. They can be inflated, duplicated or reposted from older breaches, so treat a spike as a reason to look closer. Sector labels cover only the claims the classifier could match.
The top 3 share and the HHI describe how concentrated claims are across crews. A low concentration means activity is spread over many groups.
FAQ
What does the spike score mean?
It is a z-score: the crew's claims in the latest month of the feed compared with its average over the previous 11 months, measured in standard deviations. A crew counts as spiking at a z-score of 1 or more. The latest month can still be in progress, so early in a month most crews show a negative score.
What are recent, prior and momentum?
Recent counts claims in the 90 days up to the newest record in the feed, and prior counts the 90 days before that. Momentum is the percentage change from prior to recent. A crew with no prior claims shows n/a.
Where do the claims come from?
From ransomware leak-site posts collected by RansomLook and the archived ransomwatch project, merged by the pwnsy data API. The radar lists the 25 crews with the most claims in that data. The posts are the groups' own claims and can be inflated, duplicated or reposted from older breaches.
How are victim sectors assigned?
A keyword classifier reads each victim's name and assigns a sector when a pattern matches, such as a hospital or a school. Most names match nothing and stay unclassified, so the sector mix describes only the classified share of claims.
What does the sanctioned flag mean?
The crew or its operators appear in an OFAC or UK designation that pwnsy records, shown with the designation date and a link to the notice. Paying a designated group can breach sanctions law, so check sanctions exposure before any payment decision.
Data: pwnsy data API, merged from RansomLook and the archived ransomwatch leak-site feeds.