Adversary Ecosystem Observation only Not scored Baseline forming

Recent leak activity

The concrete output of the live criminal ecosystem: ransomware victim / extortion posts as they appear on group leak sites, merged and de-duplicated from ransomware.live and ransomlook. The last 24 hours are shown first, then the trailing 7 days for context. This view is an observation tied to the Threat Actors dimension — it is not part of the ICHI composite score.

—

posts 24h

—

posts 7d

—

groups active 7d

—

groups online

—

markets online

—

Last 24 hours · 0

Trailing 7 days · 0

Note: entries link to the clearnet ransomware.live / ransomlook aggregator page for each victim, never to the operators' .onion leak sites. A listing is a claim published by a ransomware group and may be unverified, recycled, or withdrawn. Counts reflect the merged, de-duplicated view across both trackers.