Threat Actor Profiles

VPN access and fast encryption

Akira

Enters through VPNs and stolen credentials, steals data fast and encrypts Windows, ESXi and Nutanix hosts. FBI and CISA updated their advisory in November 2025.

Russian espionage through cloud identities

APT29

A Russian espionage group that NCSC-UK assesses is almost certainly part of the SVR. It favours cloud identity abuse, targeted phishing and unpatched servers.

Mass data theft through software flaws

Clop

Runs bursts of mass data theft through flaws in products such as MOVEit and Oracle E-Business Suite, then emails executives. Quiet periods between campaigns are normal.

Double extortion with anti-forensics

Dire Wolf

Double extortion group active since May 2025, mainly hitting manufacturing and technology. How it gets in has not been established.

Extortion, access sales and insider recruitment

Everest

Combines data extortion, ransomware, access sales and insider recruitment. Sources differ on how often it still encrypts, so plan for data theft either way.

Iranian state persona using wipers and leaks

Handala

An Iranian state-linked persona posing as hacktivists. Enters through VPNs and IT providers, wipes systems, leaks data and threatens individuals.

Affiliate ransomware with health sector focus

INC Ransom

Affiliates use spear phishing, bought credentials and flaws in internet-facing systems, then steal data with legitimate tools. Healthcare stands out, including an NHS Scotland board.

North Korean theft, espionage and disruption

Lazarus Group

North Korean operators behind WannaCry, according to the NCSC, and large cryptocurrency thefts. They often begin with fake job offers aimed at developers and engineers.

Ransomware-as-a-service after takedown

LockBit

Affiliate-run ransomware disrupted by the NCA-led Operation Cronos in 2024. It relaunched as LockBit 5.0 and remains active.

Fast exploitation of new flaws

Medusa

Uses newly announced flaws within a day and double extortion with leak-site countdowns. Microsoft reports UK targeting by one Medusa operator, now moving to a new payload.

Closed group with double extortion

Play

Steals data then encrypts, recompiles its binary for each attack, and phones staff to push payment. Agencies presume it is a closed group.

Public sector and data auctions

Rhysida

Opportunistic ransomware that hits public bodies, education and healthcare, then auctions or publishes stolen data. It claimed the British Library attack.

Credential-led double extortion

SafePay

Gets in through exposed credentials, VPNs and edge flaws, often encrypts within a day, then phones victims. The NCA co-authored the US advisory on it in October 2026.

Russian military destructive operations

Sandworm

A GRU unit, according to the UK government, specialising in destructive attacks on critical infrastructure. Microsoft has also reported wider access operations reaching the UK.

Callback phishing and data extortion

Silent Ransom Group

Poses as IT support by phone and sometimes in person, steals data without encrypting it, then pressures staff and clients. Law firms are the main target.

Pre-positioning on critical infrastructure

Volt Typhoon

A Chinese state-sponsored actor pre-positioning on critical infrastructure. It uses valid accounts, built-in tools and hijacked routers to stay hidden for long periods.

DisruptedGovernment Reporting

Kill Security (KillSec)

Ransomware as a service, disrupted in 2026

Ransomware-as-a-service group, active from 2024, that often stole data without encrypting it. Taken down in Operation KillSwitch in September 2026.

DisruptedGovernment Reporting

Radar

Disrupted double extortion group

Disrupted in August 2024 by US, UK and German authorities. Exploited weak passwords and missing two-factor authentication at smaller organisations.

DisruptedGovernment Reporting

Scattered Spider

Help desk fraud and identity attacks

Talks its way past help desks and MFA, then moves to data theft and ransomware. Jailed members and heavy disruption, but the methods are still in use.

Email bombing and spoofed IT calls

3AM

Floods a target with email, calls posing as IT, and gains remote access through Quick Assist. Stole data over nine days in a case Sophos documented.

Ransomware with an optional wipe mode

Anubis Ransomware

Ransomware-as-a-service with data extortion and access-broker programmes, plus a wipe mode that can destroy files even if a ransom is paid.

Fake IT calls, not the older Chaos builder

Chaos Ransomware

Floods staff with spam, then calls them posing as IT to get remote access. Talos links it to BlackSuit and says it is unrelated to the older Chaos builder.

Broker-bought access, European focus

Cloak

Buys access from brokers, often using credentials taken by info-stealers, then encrypts and extorts. Mainly European targets, especially Germany.

White-label ransomware cartel

DragonForce

Rents out ransomware and infrastructure under a cartel model, with attacks through MSP tools and edge devices. M&S said it was hit with its ransomware in 2025.

Rust ransomware that disables EDR

Embargo

Uses custom Rust tools to disable security products, including through Safe Mode, then steals and encrypts data. Healthcare is reported as a likely focus.

ClickFix lures and a bring your own runtime loader

LeakNet

Moved from buying access to tricking users with ClickFix lures on hacked websites, then loading malware in memory through a legitimate runtime.

Double extortion built on INC code

Lynx

Ransomware-as-a-service built on INC code. Enters through valid credentials and remote access, then steals data and destroys backups before encrypting.

FortiOS exploitation, 48-hour deadlines

NightSpire

Opportunistic double extortion group with short deadlines. Uses a Fortinet flaw, stolen credentials and legitimate tools, mainly against smaller organisations.

Malvertising loader turned ransomware

Nitrogen

Started as a loader spread by fake IT tool downloads, then moved into its own ransomware. Its ESXi encryptor has a flaw that makes recovery impossible.

Data theft without encryption

PEAR

Logs in with compromised VPN credentials, uses legitimate tools and steals data for extortion. It does not encrypt systems, so backups do not remove the threat.

Large affiliate ransomware programme

Qilin

Affiliate-run ransomware behind the Synnovis attack that disrupted London hospitals. It remained highly active in 2026 even as an alleged leading member was extradited to Germany.

Data extortion and ESXi encryption

RansomHouse

Steals data and uses custom tools to encrypt VMware ESXi hypervisors at scale, then pressures victims through a leak site.

VPN access against mid-sized firms

Sinobi

Enters through SonicWall VPNs and trusted accounts, removes security tools, steals data and encrypts. Suspected link to Lynx and INC, not confirmed.

Edge device access and domain-wide encryption

The Gentlemen

Fast-growing ransomware-as-a-service. Uses edge devices and stolen credentials, kills EDR with vulnerable drivers, and can encrypt a domain through Group Policy.

Data theft extortion linked to Hunters International

World Leaks

Steals data and threatens to publish it, using custom exfiltration tools. Presents itself as extortion-only, though at least one reported case involved encryption.

ESXi and NAS after edge compromise

Abyss

Enters through unpatched VPN appliances or weak SSH, steals data, then encrypts Windows and VMware ESXi systems. Current activity is unclear.

Data theft without encryption

Coinbase Cartel

Steals data without encrypting it, apparently using stolen credentials and bought access. Vendors disagree on who is behind it.

EDR evasion and off-peak attacks

Crypto24

Targets large organisations, disables EDR with custom tooling and legitimate utilities, and strikes off-peak. How it gets in has not been reported.

Domain controller spread, unrecoverable large files

Obscura

Go ransomware variant spread from domain controllers. A flaw means files over 1GB are lost even after payment. Its operators have not been identified.

New family using a malicious driver

Osiris

Documented from one November 2025 attack. Attackers disabled security tools with a malicious driver and stole data to cloud storage before encrypting.

Double extortion, industrial focus

Sarcoma

Double extortion group first seen in October 2024, with industrial firms prominent among its reported targets. Current activity is unclear.

Credential-led RaaS, now Shisa

Tengu

Ransomware-as-a-service first seen in October 2025, rebranded as Shisa in March 2026. Gets in mainly through exposed RDP and VPN using stolen or guessed credentials.

Babuk-derived double extortion

Termite

Claimed the Blue Yonder attack that affected UK supermarkets. Cyble assesses it as a Babuk rebrand. Current activity is unclear.

DragonForce-derived RaaS, apparently stopped

DormantVendor Research

DevMan

Grew from an affiliate into its own ransomware programme on DragonForce-derived code. Appears to have stopped, but its operator is assessed to remain active elsewhere.

Double extortion, not Genesis Market

ActiveLimited Reporting

Genesis

Double extortion group active since October 2025, mainly claiming US organisations. Separate from Genesis Market, as far as sources show.

Qilin-linked ransomware brand

ActiveLimited Reporting

Securotrop

A young ransomware brand reported to use Qilin code while running its own leak site. No incident report has confirmed its methods.

Corporate-styled leak site tied to Phobos

ActiveLimited Reporting

Space Bears

Double extortion brand linked to Phobos, with a leak site first seen in April 2024. Its current ransomware variant is unclear.

Little-documented Windows ransomware

Benzona

Windows ransomware reported in December 2025 with a 72-hour deadline. Its operators, way in and targets are not established.

New double extortion group, thin reporting

BlackShrantac

Double extortion group first seen in September 2025. How it gets in has not been reliably documented.

Little-documented extortion group

DATACARRY

Extortion group known mainly for the 2025 Miljödata breach in Sweden. Little is published about how it operates.

Data theft extortion, identity unclear

Kazu

Steals data and demands payment to keep it private. It is unclear whether it is one person or a group, and there is no reliable account of its methods.

Regulated and third-party data

TridentLocker

Double extortion group that emerged in late 2025 and targets holders of regulated data. Little technical detail has been published.