Most Active Ransomware Groups

Clop

What is Clop?

Clop is a ransomware variant associated with TA505, a cybercriminal group active since at least 2014. TA505 is known for compromising over 3,000 U.S.-based organizations and 8,000 global organizations. The group frequently changes its malware and drives global trends in criminal malware distribution, including ransomware campaigns involving Clop.

Emerging in February 2019 from the CryptoMix ransomware variant, Clop was used as a Ransomware as a Service (RaaS) in large-scale spear-phishing campaigns. These campaigns utilized verified and digitally signed binaries to bypass system defenses. Clop initially employed a 'double extortion' tactic, stealing and encrypting victim data, and publishing exfiltrated data on the Tor network via the CLOP^_-LEAKS website if the ransom was not paid.

In 2023, Clop increasingly adopted pure extortion methods with "encryption-less ransomware," which skips the encryption process but still threatens to leak data if the ransom is not paid. This approach allows threat actors to achieve the same results and generate larger profits.

Technical Overview

The Clop ransomware group is known for evolving its tactics, techniques, and procedures (TTPs). They typically gain initial access through phishing emails containing the Get2 Loader, which downloads the SDBot and FlawedAmmy RAT. They also use valid credentials or exploit various CVEs over time.

In late January 2023, the Clop ransomware group launched a campaign using a zero-day vulnerability, now cataloged as CVE-2023-0669, to target the GoAnywhere MFT platform. There is speculation about the use of a Cleo product vulnerability tracked as CVE-2024-55956, which Clop claimed to have exploited.

Impact

As of early 2025, Clop has reportedly targeted 161 victims.

Akira

What is Akira?

Akira is a ransomware variant and deployment entity active since at least March 2023. Akira gains initial access by using compromised credentials to exploit single-factor external access mechanisms such as VPNs. It then employs various publicly available tools and techniques for lateral movement within the network. Akira is associated with "double extortion" ransomware activities, where data is exfiltrated from victim environments before encryption, with threats to publish the files if the ransom is not paid. Technical analysis of Akira ransomware reveals multiple overlaps and similarities with Conti malware.

As a Ransomware-as-a-Service (RaaS), Akira has been utilized by several groups, including GOLD SAHARA and PUNK SPIDER.

Technical Overview

Akira ransomware is a 64-bit Windows binary primarily developed in C++ with extensive use of C++ libraries. It employs the Boost library for its asynchronous encryption functionality and is compiled using Microsoft Linker version 14.35. In June 2023, a security researcher known as "rivitna" published a Linux version of Akira, which is also 64-bit and incorporates the Boost library.

Initially, early versions of Akira ransomware encrypted files with the ".akira" extension. By August 2023, some attacks introduced a variant called Megazord, written in Rust, which encrypts files with the ".powerranges" extension. Despite the introduction of Megazord, Akira threat actors have continued to deploy both the original Akira ransomware, including an updated Akira_v2 variant, and Megazord interchangeably in their campaigns, as confirmed by CISA.

Impact

As of early 2025, Akira has reportedly targeted 141 victims.

RansomHub

What is RansomHub?

RansomHub emerged in mid-February 2024 and has already listed several organizations as alleged victims of their attacks, which involve extortion through encryption and data leaks.

The announcement of RansomHub's new Ransomware-as-a-Service (RaaS) was published on RAMP4U (or RAMP), a Russian-origin forum used by cybercriminals to advertise malicious services. A user named 'koley' announced the affiliate program on February 2, 2024.

In the RaaS announcement, it was mentioned that the money laundering of paid ransoms is the responsibility of the affiliate. All communication and sending of the decryptor to the victim are handled through chat. The revenue split for this RaaS is 90%90% for the affiliate and 10%10% for the developer, who is identified as 'koley.'

RansomHub appears to have ties to both ALPHV (BlackCat) and Knight Ransomware. Following a February 2024 ransomware attack on Change Healthcare, ALPHV initially claimed responsibility but was later accused by an affiliate, notchy, of withholding their share of a $\ 22\ million ransom. After ALPHV's sudden disappearance in March 2024, RansomHub surfaced, claiming possession of the same 4TB of stolen data. Researchers noted strong similarities in tactics, techniques, infrastructure, and code between ALPHV and RansomHub, suggesting RansomHub could be a rebrand or composed of former ALPHV affiliates. Additionally, RansomHub shares significant code overlap with Knight Ransomware (formerly Cyclops), including being written in Go, using Gobltiscate for obfuscation, and employing similar ransom notes and encryption techniques. Both also utilize a strategy of restarting systems in safe mode before encryption. These overlaps imply that RansomHub could be a hybrid operation, merging elements of ALPHV's tactics with Knight's codebase, potentially involving former affiliates from both groups.

Impact

As of early 2025, RansomHub has reportedly targeted 124 victims.