Ransomware actors are deploying a growing array of data-exfiltration tools in their attacks and, over the past three months alone, Symantec has found attackers using at least doze…
Weekly intelligence
Trend-first
Weekly ransomware & data leak landscape
A seven-day view of claim activity, leak escalation, actor concentration, sector shifts, and supporting news context from eCrime.ch.
Window: 2024-03-02 → 2024-03-08 UTC
Choose a report date
Observed events
66
Public claims in the selected week
Data leak indicators
43
65.2% of observed events
Active actors
20
Distinct groups with observed activity
Torrent-linked events
3
Events intersecting with torrent intelligence
What changed this week?
•
Medusa generated the highest visible claim volume this week, representing 18.2% of observed events.
•
65.2% of observed events in this window showed a public data-leak indicator, which is a stronger escalation signal than a fresh listing alone.
•
Construction was the most represented sector in this window with 4 observed events.
•
3 actor(s) appeared active this week without matching activity in the prior 30-day lookback, suggesting fresh campaigns, rebrands, or resurfacing infrastructure.
•
3 observed events in this week intersected with torrent intelligence, which is useful for understanding data-distribution tactics beyond plain leak-site posts.
•
1 tracked leak sites were still online as of the report date snapshot, giving useful context on current ecosystem churn and monitoring pressure.
Coverage snapshot
As of 2024-03-08 UTC.
Leak sites observed this week
20
Leak sites online near report date
1
Threat actor profiles updated this week
4
Countries represented this week
26
Sectors represented this week
48
Top active actors
By observed claim volumeMedusa
12 events · 12 leak indicators
LockBit 3.0
8 events · 6 leak indicators
Akira
6 events · 3 leak indicators
Stormous
6 events · 3 leak indicators
Donex
5 events · 0 leak indicators
8BASE
4 events · 4 leak indicators
Qilin
4 events · 3 leak indicators
RansomHub
4 events · 3 leak indicators
Emerging or resurfacing actors
No matching activity in prior 30 days- Donex 5 events
- BlackByte 1 event
- Mallox 1 event
Country mix
Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
United States31
- LockBit 3.07 events · 5 leak indicators
- Medusa6 events · 6 leak indicators
- Akira3 events · 2 leak indicators
- BianLian3 events · 1 leak indicator
- PLAY2 events · 2 leak indicators
- 8BASE1 event · 1 leak indicator
- BlackByte1 event · 0 leak indicators
- Blacksuit1 event · 1 leak indicator
Canada5
- Medusa4 events · 4 leak indicators
- MEOW1 event · 0 leak indicators
Belgium2
- Donex1 event · 0 leak indicators
- Stormous1 event · 1 leak indicator
Brazil2
- RansomHub1 event · 1 leak indicator
- Stormous1 event · 0 leak indicators
China2
- AlphVM1 event · 1 leak indicator
- LockBit 3.01 event · 1 leak indicator
South Korea2
- Stormous1 event · 1 leak indicator
- Underground1 event · 0 leak indicators
Spain2
- 8BASE1 event · 1 leak indicator
- Stormous1 event · 1 leak indicator
Sweden2
- 8BASE1 event · 1 leak indicator
- Medusa1 event · 1 leak indicator
Sector mix
Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
Construction4
- Medusa2 events · 2 leak indicators
- BianLian1 event · 0 leak indicators
- Qilin1 event · 1 leak indicator
Financial Services3
- Donex1 event · 0 leak indicators
- Medusa1 event · 1 leak indicator
- PLAY1 event · 1 leak indicator
Business Consulting and Services2
- Akira2 events · 0 leak indicators
Civic and Social Organizations2
- Donex1 event · 0 leak indicators
- LockBit 3.01 event · 1 leak indicator
Environmental Services2
- BlackByte1 event · 0 leak indicators
- INC Ransom1 event · 1 leak indicator
Higher Education2
- CL0P1 event · 0 leak indicators
- Medusa1 event · 1 leak indicator
Legal Services2
- Medusa2 events · 2 leak indicators
Plastics Manufacturing2
- 8BASE1 event · 1 leak indicator
- Stormous1 event · 0 leak indicators
Organization size bands
Share of weekly events by employee-size group across the last 12 reporting windows.
- 11-50 employees 16
- 51-200 employees 15
- 201-500 employees 10
- 1,001-5,000 employees 6
- 2-10 employees 6
- 501-1,000 employees 6
Notable actor profile updates
Active actor records only.
New ransom note observed
No ransom-note change logged in this reporting window.
New actor infrastructure / contact channel
No infrastructure/contact-channel change logged in this reporting window.
New vuln / TTP intelligence
No vuln/TTP change logged in this reporting window.
Recent signal samples
Selected weekly signals.
| Actor | Sector | Country | Leak proof | Seen |
|---|---|---|---|---|
| LockBit 3.0 | Civic and Social Organizations | United States | Data leak | 2024-03-08 |
| Blacksuit | Railroad Equipment Manufacturing | United States | Data leak | 2024-03-08 |
| RansomHub | Renewable Energy Semiconductor Manufacturing | Slovakia | Data leak | 2024-03-08 |
| RansomHub | Retail | United States | Claim only | 2024-03-08 |
| LockBit 3.0 | Restaurants | United States | Data leak | 2024-03-07 |
| Qilin | Architecture and Planning | France | Claim only | 2024-03-07 |
| BianLian | Construction | United States | Claim only | 2024-03-07 |
| Donex | Transportation, Logistics, Supply Chain and Storage | Netherlands | Claim only | 2024-03-07 |
| Donex | Financial Services | United States | Claim only | 2024-03-07 |
| Donex | Wholesale | Italy | Claim only | 2024-03-07 |
| Donex | Entertainment Providers | Czech Republic | Claim only | 2024-03-07 |
| Donex | Civic and Social Organizations | Belgium | Claim only | 2024-03-07 |
News and research context
Recent articles from the same time window.
Breaching the security infrastructure of any organization, institution or agency is nothing more than a criminal act and the perpetrators are criminals that should be portrayed as…
Meldung - DRK-KV Mannheim e.V.
2024-03-08
Der Deutsche Rote Kreuz Kreisverband Mannheim e.V. ist in der Nacht vom 26. auf den 27. Februar Opfer eines Cyberangriffs geworden. Ein Spezialisten-Team wurde sofort eingerichtet…
Die Kampf GmbH wurde am Morgen des 24. Februar 2024 Opfer einer gezielten und kriminellen Cyber-Attacke, welche durch eine spezielle Software zu einer teilweisen Verschlüsselung u…
Related actor: AlphVM
We are working aggressively on the restoration of our systems and services. Assuming we continue at our current rate of progress, we expect our key system functionality to be rest…
Black Press, the Canada-US news group that owns NNSL and entered creditor protection in January, is finalizing a sale. It also suffered a ransomware attack.
Hackers hit Black P…
Security researchers are increasingly seeing active exploit attempts using the latest vulnerabilities in JetBrains' TeamCity that in some cases are leading to ransomware deploymen…
The Anatomy of a BlackCat (ALPHV) Attack
2024-03-07
Related actor: AlphVM
Explore Sygnia's detailed analysis of the BlackCat ransomware attack, revealing tactics, techniques, and prevention strategies.
Related actor: PLAY
07.03.2024 - Nach dem Hackerangriff auf die Firma Xplain hat das Bundesamt für Cybersicherheit (BACS), das damalige Nationale Zentrum für Cybersicherheit (NCSC), die Koordination…
The Good Spirit School Division (GSSD) announced this week that they are currently dealing with a “cyber-incident,” that occurred on Feb. 27. GSSD oversees 27 schools in west cent…
Notes
- Observed events reflect monitored leak-site and extortion activity, not independent confirmation of every intrusion.
- Data-leak indicators reflect visible public leak evidence or escalation, which is stronger than a fresh listing alone.
- Country, sector, and company-size metadata can be incomplete. Unknown values are excluded from the public mix views.
- The goal is to explain concentration, escalation, churn, and patterns — not to build a wall of named victims.
Method
- The page uses a fixed seven-day window based on the selected date.
- Only public-facing actor and event records are included.
- Counts and breakdowns are designed for trend review, not incident confirmation.