attributed the highest numbers to LockBit, BlackCat, and Clop, in that order. One of the notable new groups to emerge is Akira, which became active at the end of March 2023 and has hit at least 60 victims since then. As we look ahead to 2024, we...

its capabilities. New reports suggest that many of LockBit’s big affiliates are looking for other ransomware gangs, with the Akira threat group being a key receiver of these cyber criminal refugees.

such as dates of birth.” While Nissan has not acknowledged the threat actor behind the breach, the attack was claimed by the Akira ransomware gang, which claimed to have stolen 100 gigabytes of data from the company. “We’ve obtained 100GB of data of...

Corvus said. “Indeed, our data shows recent upticks in activity from other ransomware groups, such as Black Basta, Akira, Hunters International and BianLian. This trend supports the notion that affiliates are likely shifting their operations to...

within the network.” Microsoft’s researchers have seen ransomware deployments from several well-known gangs, including Akira and Black Basta. The hackers have been able to run a pair of commands to create a group called “ESX Admins” on a target domain...

was easily the most prevalent threat faced by organisations around the world, with groups such RansomHub, PLAY, and Akira staking a claim as operators to watch out for. And yet, despite the activity of law enforcement agencies, and being quiet most of...

10 and the number of leak posts made in the first three months of 2025: Clop 413 RansomHub 232 Babuk 168 Babuk-Bjorka 163 Akira 135 Lynx 115 Qilin 111 FunkSec 96 Cactus 94 Play 84 The big trends The Black Basta ransomware group appears to have...

like businesses. They collaborate, specialise and focus on return on investment. We have seen ransomware groups, like Akira and Conti affiliates, target Australian hospitality brands by exploiting third-party vendors and stolen credentials,” Craig...

of 2025, with only seven reported attacks. Perhaps unsurprisingly, Clop takes first place with 154 incidents, followed by Akira with 83, RansomHub with 82, and Lynx with 48. “Organisations must urgently enhance cyber security defences through the...

the first six months of 2024 – a 41.18 per cent increase. Qilin led the rankings with 209 victims, followed by SafePay and Akira (both with 130 victims), and the Play ransomware operation which listed 125 victims on its leak site. Lynx rounds out the...

the most impacted sub-sector. The Qilin group in particular led the charge with 138 incidents, and just four groups – Qilin, Akira, Play, and INC Ransom – accounted for 40 per cent of all those tracked. Emerging threats Entirely new and rebranding...

victims since. It has been far and away the most active ransomware group over the last three months, with its nearest rival, Akira, listing 193 victims so far in 2026, compared to Qilin’s 368. Like other RaaS operations, Qilin offers its ransomware to...

regarding the Russian invasion of Ukraine in 2022. Groups that are thought to be made of refugees from the group include Akira, Black Basta, Hunters International, and DevMan. UPDATE 09/04/26 - Clarified response from Jones Day's Australian office.

operators, with Qilin leading leak-site activity with 357 darknet leak posts, followed by The Gentlemen with 206 and Akira with 174. The company also observed widespread abuse of remote monitoring and management (RMM) tools, which accounted for 22.9 per...

be fragmented, however, with Qilin recording 357 leak-site posts during the quarter, followed by The Gentlemen with 206 and Akira with 174. It should be noted that not all leak posts equate to an actual leak of data, particularly, at the moment, in the...

nearly 700 leak posts. Qilin, which runs a ransomware-as-a-service operation, was followed by The Gentlemen, DragonForce, Akira, and Inc Ransom – all groups that have been active in the ANZ region. However, while the groups are different, the attacks...