Ransomware Groups We Handle

Ransomware groups are cybercriminal organizations that deploy malicious software to encrypt victims’ data, blocking access until a ransom, usually in cryptocurrency, is paid for decryption. Their attacks target individuals, corporations, government institutions, and critical infrastructure, often leading to severe disruptions, data loss, and substantial financial damage.

Over time, these groups have become increasingly sophisticated, exploiting system vulnerabilities and adopting advanced evasion techniques to maximize profits. Additionally, many now employ double-extortion tactics, not only encrypting data but also threatening to leak or sell it if payment is withheld, amplifying the pressure on victims and the overall impact of their operations.

Most active and threatening ransomware groups

We limit the release of sensitive information about our detection systems for security purposes. We continually monitor threat actors and malicious campaigns.

Akira

The Akira ransomware group appeared in March 2023, possibly linked to the former CONTI group. Early versions in C++ used the .akira extension, later rewritten in Rust as megazord.exe with .powerranges files. Akira affiliates also work with Snatch and BlackByte, using brute-force on Cisco VPNs and exploiting CVE-2019-6693 and CVE-2022-40684. A decryptor for the first version was released by Avast in June 2023.

8base

The 8base ransomware group first appeared in March 2022, remaining mostly quiet until mid-2023 when it targeted 131 organizations in 3 months. Its data leak site launched in March 2023, claiming transparency, and reports note similarities with RansomHouse in site design and ransom notes. 8base did not develop its own ransomware; it used a Phobos variant. Its sites were seized by police in February 2025.

Source: https://github.com/crocodyli/ThreatActors-TTPs

Alphv / Blackcat

The ALPHV/BlackCat ransomware began in December 2021, promoted via Dark Web forums as a “new ransomware family” written in Rust. Its operators have ties to previous cybercrime groups like DarkSide, BlackMatter, and REvil. Execution requires an access token provided by the RaaS operators to affiliates. The group shut down in March 2024. Source: https://github.com/crocodyli/ThreatActors-TTPs

Babuk

Babuk Ransomware is a highly sophisticated threat, meticulously compiled to attack various platforms. The most prevalent versions target Windows operating systems and ARM for Linux architectures, showcasing the group’s broad reach. Older variants, including one for ESX and an archaic 32-bit PE executable, have been documented by security researchers. Its source code leaked in 2021 and has been reused by many later ransomware families.

LockBit 3.0

LockBit 3.0 is an advanced ransomware strain active since June 2022, designed to encrypt victim files using a highly resilient cryptographic framework. It combines the ChaCha20 stream cipher, the AES-128 block algorithm, and Curve25519 elliptic-curve cryptography to enable secure key exchange, ensuring strong protection, faster encryption, and improved evasion capabilities.

Other emerging ransomware threats illustration

Other Emerging Threats

Emerging cybersecurity trends highlight rapidly evolving threats that leverage advanced automation, AI-driven attacks, and sophisticated evasion techniques to compromise systems efficiently. Modern threat actors increasingly adopt zero-day exploitation, fileless malware operations, and multi-stage intrusion tactics, supported by encrypted communication channels.

AS IT TECH

Ransomware family guides from AS

Ransomware Analysis Studio — identify the family and measure the encryption Akira ransomware recovery: real cases LockBit 5.0: ESXi, NAS and Veeam backups Can a ransomware-encrypted SQL Server database be recovered?Ransomware recovery case studies

Buy recovery software at asittech.com →Free downloads

From AS IT TECH — asittech.com, our software and guides site.