Weekly intelligence Trend-first

Weekly ransomware & data leak landscape

A seven-day view of claim activity, leak escalation, actor concentration, sector shifts, and supporting news context from eCrime.ch.

Window: 2025-03-14 → 2025-03-20 UTC
Choose a report date
Previous week Next week
Observed events
363
Public claims in the selected week
Data leak indicators
127
35.0% of observed events
Active actors
40
Distinct groups with observed activity
Torrent-linked events
8
Events intersecting with torrent intelligence

What changed this week?

•
CL0P generated the highest visible claim volume this week, representing 44.4% of observed events.
•
35.0% of observed events in this window showed a public data-leak indicator, which is a stronger escalation signal than a fresh listing alone.
•
Transportation, Logistics, Supply Chain and Storage was the most represented sector in this window with 20 observed events.
•
5 actor(s) appeared active this week without matching activity in the prior 30-day lookback, suggesting fresh campaigns, rebrands, or resurfacing infrastructure.
•
8 observed events in this week intersected with torrent intelligence, which is useful for understanding data-distribution tactics beyond plain leak-site posts.
•
1 tracked leak sites were still online as of the report date snapshot, giving useful context on current ecosystem churn and monitoring pressure.

Coverage snapshot

As of 2025-03-20 UTC.
Leak sites observed this week
40
Leak sites online near report date
1
Threat actor profiles updated this week
2
Countries represented this week
31
Sectors represented this week
86

Top active actors

By observed claim volume
CL0P
161 events · 0 leak indicators
BABUK 2.0
41 events · 0 leak indicators
Frag
26 events · 26 leak indicators
LeakedData
19 events · 19 leak indicators
Akira
13 events · 8 leak indicators
RansomHub
11 events · 10 leak indicators
INC Ransom
9 events · 9 leak indicators
Qilin
9 events · 4 leak indicators

Emerging or resurfacing actors

No matching activity in prior 30 days
  • Frag 26 events
  • VanHelsing 3 events
  • Chaos 2 events
  • Orca 1 event
  • SecP0 1 event

Country mix

Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
United States216
  • CL0P127 events · 0 leak indicators
  • Frag22 events · 22 leak indicators
  • LeakedData17 events · 17 leak indicators
  • RansomHub6 events · 5 leak indicators
  • Akira5 events · 3 leak indicators
  • Medusa5 events · 5 leak indicators
  • Lynx4 events · 4 leak indicators
  • Qilin4 events · 1 leak indicator
Canada21
  • CL0P12 events · 0 leak indicators
  • Akira2 events · 0 leak indicators
  • Abyss1 event · 1 leak indicator
  • Frag1 event · 1 leak indicator
  • Hunters International1 event · 1 leak indicator
  • INC Ransom1 event · 1 leak indicator
  • LeakedData1 event · 1 leak indicator
  • Medusa1 event · 1 leak indicator
Germany10
  • CL0P2 events · 0 leak indicators
  • INC Ransom2 events · 2 leak indicators
  • Qilin2 events · 2 leak indicators
  • Akira1 event · 1 leak indicator
  • Cloak1 event · 0 leak indicators
  • PLAY1 event · 1 leak indicator
  • SAFEPAY1 event · 1 leak indicator
United Kingdom9
  • CL0P2 events · 0 leak indicators
  • INC Ransom2 events · 2 leak indicators
  • RansomHub2 events · 2 leak indicators
  • DragonForce1 event · 1 leak indicator
  • Medusa1 event · 1 leak indicator
  • Stormous1 event · 0 leak indicators
Spain7
  • CL0P2 events · 0 leak indicators
  • Akira1 event · 1 leak indicator
  • Fog1 event · 0 leak indicators
  • Qilin1 event · 1 leak indicator
  • RansomHub1 event · 1 leak indicator
  • Trinity1 event · 0 leak indicators
Italy5
  • CL0P1 event · 0 leak indicators
  • DragonForce1 event · 1 leak indicator
  • Lynx1 event · 1 leak indicator
  • Orca1 event · 0 leak indicators
  • Sarcoma1 event · 1 leak indicator
France4
  • CL0P1 event · 0 leak indicators
  • Lynx1 event · 1 leak indicator
  • RansomHub1 event · 1 leak indicator
  • VanHelsing1 event · 1 leak indicator
Mexico4
  • CL0P4 events · 0 leak indicators

Sector mix

Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
Transportation, Logistics, Supply Chain and Storage20
  • CL0P15 events · 0 leak indicators
  • Chaos2 events · 2 leak indicators
  • Arcus Media1 event · 0 leak indicators
  • Frag1 event · 1 leak indicator
  • RansomHub1 event · 1 leak indicator
Manufacturing17
  • CL0P11 events · 0 leak indicators
  • Akira2 events · 0 leak indicators
  • DragonForce1 event · 1 leak indicator
  • Monti1 event · 0 leak indicators
  • NightSpire1 event · 1 leak indicator
  • VanHelsing1 event · 1 leak indicator
Retail Apparel and Fashion16
  • CL0P13 events · 0 leak indicators
  • RansomHub2 events · 1 leak indicator
  • INC Ransom1 event · 1 leak indicator
IT Services and IT Consulting15
  • CL0P9 events · 0 leak indicators
  • Qilin2 events · 1 leak indicator
  • 3AM1 event · 1 leak indicator
  • Frag1 event · 1 leak indicator
  • Hellcat1 event · 0 leak indicators
  • SecP01 event · 0 leak indicators
Law Practice13
  • LeakedData9 events · 9 leak indicators
  • Frag2 events · 2 leak indicators
  • Cloak1 event · 0 leak indicators
  • Qilin1 event · 0 leak indicators
Wholesale13
  • CL0P9 events · 0 leak indicators
  • Akira1 event · 0 leak indicators
  • Frag1 event · 1 leak indicator
  • INC Ransom1 event · 1 leak indicator
  • Lynx1 event · 1 leak indicator
Truck Transportation10
  • CL0P9 events · 0 leak indicators
  • Arcus Media1 event · 0 leak indicators
Construction9
  • Frag2 events · 2 leak indicators
  • RansomHub2 events · 2 leak indicators
  • CL0P1 event · 0 leak indicators
  • DragonForce1 event · 1 leak indicator
  • INC Ransom1 event · 1 leak indicator
  • PLAY1 event · 1 leak indicator
  • Space Bears1 event · 1 leak indicator

Organization size bands

Share of weekly events by employee-size group across the last 12 reporting windows.
  • 51-200 employees 102
  • 11-50 employees 69
  • 201-500 employees 52
  • 1,001-5,000 employees 19
  • 501-1,000 employees 19
  • 2-10 employees 14

Notable actor profile updates

Active actor records only.
New ransom note observed
No ransom-note change logged in this reporting window.
New actor infrastructure / contact channel
No infrastructure/contact-channel change logged in this reporting window.
New vuln / TTP intelligence
No vuln/TTP change logged in this reporting window.

Recent signal samples

Selected weekly signals.
Actor Sector Country Leak proof Seen
INTERLOCK Education Administration Programs United States Data leak 2025-03-20
RansomHub Transportation, Logistics, Supply Chain and Storage United States Data leak 2025-03-20
DragonForce Construction United States Data leak 2025-03-20
Space Bears Accounting United States Data leak 2025-03-20
Cloak Primary and Secondary Education United States Claim only 2025-03-20
Cloak Law Practice United States Claim only 2025-03-20
Cloak Legal Services Germany Claim only 2025-03-20
RansomHub Accounting United Kingdom Data leak 2025-03-20
RansomHub Biotechnology Research France Data leak 2025-03-20
Space Bears Construction United States Data leak 2025-03-20
Akira Business Consulting and Services Spain Data leak 2025-03-20
Kill Security Investment Management India Data leak 2025-03-20

News and research context

Recent articles from the same time window.
HellCat hackers go on a worldwide Jira hacking spree 2025-03-20
Related actor: Hellcat
Jira is a project management and issue-tracking platform commonly used by software developers and IT teams to track and manage projects. The platform often contains sensitive data…
2025年3月19日（水）、「北海道じゃらん」のWebサイトにおいて、不正アクセスが確認されました。 2025-03-20
「北海道じゃらん」の名前を使った不審なメールやSNS等の配信にご注意ください。 当該メールの開封、ならびにメッセージ上のURLをクリックすることや、 記載の連絡先に連絡をするなどはしないようご留意ください。 なお、当該不正アクセスはじゃらんnetなど、リクルートが運営する他のサービスでの発生は確認しておりません。 ご利用の皆様には、ご心配とご不…
RansomHub: Attackers Leverage New Custom Backdoor 2025-03-20
Related actor: RansomHub
Betruger backdoor being used by at least one affiliate of RansomHub. At least one affiliate of the RansomHub ransomware-as-a-service (RaaS) has begun using a new custom backdoor…
Impersonation of Babuk Ransomware group 2025-03-18
Related actor: BABUK 2.0
Babuk Locker 2.0, also known as Bjorka or SkyWave, after failing to make any profit from selling public databases on forums, decided to impersonate Babuk Ransomware group. He then…

Notes

  • Observed events reflect monitored leak-site and extortion activity, not independent confirmation of every intrusion.
  • Data-leak indicators reflect visible public leak evidence or escalation, which is stronger than a fresh listing alone.
  • Country, sector, and company-size metadata can be incomplete. Unknown values are excluded from the public mix views.
  • The goal is to explain concentration, escalation, churn, and patterns — not to build a wall of named victims.

Method

  • The page uses a fixed seven-day window based on the selected date.
  • Only public-facing actor and event records are included.
  • Counts and breakdowns are designed for trend review, not incident confirmation.