Halcyon Ransomware 
Research Center

Uniting experts, driving smart policies, and delivering actionable intelligence to detect, disrupt, and defeat ransomware.
Join the Mission
Join the Mission
Dec 22
/
United Kingdom
/
Devman
Dec 22
/
USA
/
Sinobi
Dec 22
/
Brazil
/
Lockbit
Dec 22
/
Denmark
/
Akira
Dec 22
/
Spain
/
Devman
Dec 22
/
Malaysia
/
Dire Wolf
Dec 22
/
Taiwan
/
Dire Wolf
Dec 22
/
Thailand
/
Dire Wolf
Dec 22
/
Malaysia
/
Dire Wolf
Dec 22
/
Thailand
/
Dire Wolf
Dec 22
/
Germany
/
Qilin
Dec 22
/
USA
/
Qilin
Dec 22
/
Bolivia
/
Qilin
Dec 22
/
USA
/
Qilin
Dec 22
/
USA
/
Qilin
Dec 22
/
USA
/
Qilin
Dec 22
/
Italy
/
Qilin
Dec 22
/
Germany
/
Qilin
Dec 22
/
France
/
Qilin
Dec 22
/
USA
/
Interlock
Dec 22
/
Italy
/
Qilin
Dec 22
/
Oman
/
Qilin
Dec 22
/
USA
/
Qilin
Dec 22
/
USA
/
Qilin
Dec 22
/
USA
/
Sinobi
Dec 22
/
Chile
/
Devman
Dec 22
/
USA
/
Sinobi
Dec 22
/
USA
/
Sinobi
Dec 22
/
USA
/
Sinobi
Dec 22
/
USA
/
Anubis
Dec 23
/
USA
/
WorldLeaks
Dec 23
/
USA
/
Lynx
Dec 23
/
USA
/
Lynx
Dec 23
/
USA
/
Lynx
Dec 23
/
Japan
/
Lynx
Dec 23
/
Germany
/
Lynx
Dec 23
/
Brazil
/
Nova
Dec 23
/
USA
/
Crypto24
Dec 23
/
Australia
/
Anubis
Dec 23
/
Peru
/
Black Shrantac
Dec 22
/
United Kingdom
/
Devman
Dec 22
/
USA
/
Sinobi
Dec 22
/
Brazil
/
Lockbit
Dec 22
/
Denmark
/
Akira
Dec 22
/
Spain
/
Devman
Dec 22
/
Malaysia
/
Dire Wolf
Dec 22
/
Taiwan
/
Dire Wolf
Dec 22
/
Thailand
/
Dire Wolf
Dec 22
/
Malaysia
/
Dire Wolf
Dec 22
/
Thailand
/
Dire Wolf
Dec 22
/
Germany
/
Qilin
Dec 22
/
USA
/
Qilin
Dec 22
/
Bolivia
/
Qilin
Dec 22
/
USA
/
Qilin
Dec 22
/
USA
/
Qilin
Dec 22
/
USA
/
Qilin
Dec 22
/
Italy
/
Qilin
Dec 22
/
Germany
/
Qilin
Dec 22
/
France
/
Qilin
Dec 22
/
USA
/
Interlock

Ransomware by the Numbers

2025
5,414
Claimed Victims Globally
2024
$4,880,000
Average Breach Cost
Q3
2025

Manufacturing

‍Healthcare ‍

Education

‍ Business Services

‍Construction

Most Targeted
Q3
2025
Akira
Lynx
Medusa
INC Ransom
Qilin
Most Active Groups
FEATURED RESOURCES

Get the Latest Research and Alerts

Get the latest Halcyon digital goodies, from webinars to white papers, and everything in between.
December 8, 2025
Report

Ransomware: Escalating Threats to Retail During Peak Holiday Season

Read Report
October 8, 2025
Report

Threat Intel Report: Warlock Professional Development, China Ties, and the Multiple Variants it Planned from the Start

Read Report
October 29, 2025
Alert

Security Alert: Everest Group Targeting Critical Infrastructure

Read Alert

Explore our Ransomware Profiles and Resources

ATTACKS MAP TRACKER
A map of the world with a red triangle and the words "Ransomware Attack!" written above it.

Halcyon Attacks Lookout

Explore Latest Attacks
UnmaskING the Threats

Inside the Threat Actor Index

Uncover key ransomware groups, their tactics, and targets. Explore the Threat Actor Index to strengthen your defenses and stay prepared for today’s most dangerous adversaries.
Explore Threat Actors