Threat actor landscape
Who is behind reported incidents, and what drives them
Ranked by incident count in the selected date range. Profile metadata (country, targets, motives) reflects all-time attribution. 57% of events have no named actor.
#1 · Criminal
cl0p
Russian Federation
362
incidents
#2 · Hacktivist
NoName057(16)
Russian Federation
357
incidents
#3 · Hacktivist
Anonymous
Russian Federation
281
incidents
#4 · Criminal
Vice Society
Origin unknown
162
incidents
#5 · Nation-State
NGB 3rd Technical Surveillance Bureau
Korea (the Democratic People's Republic of)
147
incidents
#6 · Criminal
LockBit 3.0
Origin unknown
147
incidents
#7 · Nation-State
GRU Main Special Center for Special Technologies (Unit 74455) (SANDWORM)
Russian Federation
131
incidents
#8 · Criminal
ALPHVM
Russian Federation
131
incidents
#9 · Criminal
Black Basta
Russian Federation
111
incidents
#10 · Hacktivist
Killnet
Russian Federation
96
incidents
#11 · Criminal
ShinyHunters
Origin unknown
89
incidents
#12 · Criminal
WIZARD SPIDER
Russian Federation
84
incidents
#13 · Hobbyist
OurMine
Saudi Arabia
73
incidents
#14 · Criminal
Play
Russian Federation
69
incidents
#15 · Criminal
REvil
Russian Federation
68
incidents
Top 5 target countries per actor
Percentage of incidents within each actor type by industry, motive, and attack type. Darker cells = higher share of that actor's incidents in the selected period.