How to Track Ransomware Groups Before They Hit Your Sector
By ScruteXPublished
More than 120 ransomware groups were active in 2025. Leak-site trackers counted somewhere between about 7,300 and 8,800 victims for the year, depending on whose method you trust, and the count keeps climbing as the market fragments into smaller operators.No security team can watch all of that, and watching all of it is not the point.
Key takeaways
- Relevance beats coverage. A handful of well-maintained actor profiles that overlap your technology and geography is worth more than a wall of feeds.
- A leak-site victim count describes claimed victims who did not pay, not all incidents, and trackers disagree. Use it to see patterns, not to predict.
- Intelligence becomes useful only when you map it to your own assets, credentials and vendors. External intelligence without internal context is noise.
What Is Ransomware Threat Intelligence?
Ransomware threat intelligence is analysed information about ransomware groups, their behaviour and their targets, produced to help defenders decide where to act. It is not a raw indicator feed. It is the interpretation layer that turns "this group is active" into "this group exploits technology we run, and here is where we are exposed".
It works at four levels. Strategic intelligence describes shifts in the ecosystem, such as which groups are growing and how ransomware-as-a-service is changing, and a CISO uses it to set priorities. Operational intelligence describes how a specific group operates now, its tactics and the vulnerabilities it exploits. Tactical and technical intelligence covers the concrete signals: indicators, exposed credentials, a known exploited vulnerability present in your estate. Actor intelligence is the profile that ties the other three to a named group.
Good intelligence answers "so what?" for your organisation. A feed that names an active group is data. Intelligence tells you whether that group can reach you.
Why Does Sector-Specific Ransomware Intelligence Matter?
Sector alone is a weak filter. Saying "ransomware groups target healthcare" tells a hospital almost nothing it can act on. The better question is: which groups are relevant to our exposure? Relevance depends on industry, but also on geography, organisation size, technology stack, external attack surface, identity exposure, third-party dependencies and data sensitivity.
Here is the nuance most reporting skips. Apparent sector targeting often reflects something other than a preference for that sector. A cluster of victims in one industry can come from shared technology, a common vulnerable product, geography, the availability of access brokers, or a widespread control gap. The clearest 2025 example is Cl0p and Oracle E-Business Suite, covered below: Cl0p found a critical unauthenticated flaw in a widely deployed application and hit everyone running it. The victim list looked like a spread of large organisations because that is who runs that software, not because Cl0p chose them by industry.
One caution to carry through the rest of this guide: observed victimology shows patterns, it does not guarantee future targeting. A group that has hit organisations like yours is worth watching. That is not the same as knowing it will hit you.
What Does It Mean to Track a Ransomware Group?
Tracking a group does not mean checking whether its name is in the news. A mature actor profile has several parts, and each connects to a defensive decision.
Table 1: What to track in a ransomware actor profile
| Intelligence area | What to track | Why it matters |
|---|---|---|
| Identity and aliases | Group name, rebrands, historical names, RaaS relationships | Groups rename constantly; without alias tracking you lose the thread |
| Victimology | Industries, countries, regions, organisation size, technology, changes over time | Shows observed patterns to compare against your own profile |
| Initial access | Stolen or stealer-log credentials, phishing, edge exploitation, IABs | Tells you which entry points to harden first |
| TTPs | Tactics, techniques and procedures, mapped to MITRE ATT&CK | Lets you test detections against how the group operates |
| Vulnerabilities | Specific CVEs and products they exploit | Maps directly to your patch queue |
| Tools | Loaders, C2 frameworks, credential dumpers, legitimate tools abused | Feeds detection engineering |
| Affiliates | Who runs attacks under the brand, and how that changes | Explains sudden shifts in TTPs and victim mix |
| Infrastructure | Leak sites, hosting patterns, infrastructure changes (defensive tracking) | Supports monitoring and attribution |
| Extortion model | Encryption, data theft only, double extortion, deadlines | Shapes incident response and legal planning |
| Activity trends | Volume changes, new victims, recruitment, victimology shifts | Tells you whether relevance is rising or falling |
The framework below shows how those fields feed into your own exposure and then into risk. That last step, mapping the profile to what you actually own, is where most programmes fall down.
Ransomware group vs family vs affiliate vs RaaS
These terms get used interchangeably and should not be. The difference changes how you track.
Table 2: Ransomware terms that are often confused
| Term | Meaning | Why it matters |
|---|---|---|
| Ransomware group | The operation behind a brand: operators, developers and affiliates | This is the unit you profile |
| Ransomware family | The malware strain or codebase (for example, code derived from leaked Conti source) | Different groups can share a family; a family alone does not identify an operator |
| Affiliate | A criminal who runs attacks using a group's tooling for a share of the ransom | Affiliates make one brand show very different TTPs and targets |
| RaaS | Ransomware-as-a-service: operators rent tooling, a builder and infrastructure to affiliates | Explains why one group can hit many sectors at once |
| Initial-access broker | A criminal who sells network access to affiliates | Access is often bought, not earned; credential hygiene breaks this market |
| Double extortion | Stealing data before encryption and threatening to leak it | The leak threat is often worse than the encryption and changes your obligations |
How Do Ransomware Groups Gain Initial Access?
Most ransomware intrusions start in a small number of ways, and government advisories from 2025 and 2026 keep naming the same categories. These are defensive intelligence categories, not instructions.
- Stolen and stealer-log credentials. Valid accounts, often bought on criminal markets, are among the most common entry points. Breachsense, which indexes leak sites daily, notes that most ransomware attacks begin with compromised credentials sourced from infostealer logs.
- Exploitation of public-facing applications. Unauthenticated flaws in internet-facing enterprise software, file-transfer tools and web applications.
- VPN and firewall appliance flaws. Authentication-bypass vulnerabilities in edge devices.
- Exposed remote services. RDP and remote-management tooling reachable from the internet.
- Phishing. Still used, though credential purchase and vulnerability exploitation now lead for many groups.
- Third-party and remote-support tooling. Access through a managed service provider or a widely used support product.
- Initial-access brokers. Access bought ready-made.
Your defensive priorities follow from which of these a relevant group actually uses. A group that buys credentials pushes you toward identity monitoring and MFA. A group that mass-exploits an edge appliance pushes you toward external attack surface visibility and patch speed. The earliest stages, before exfiltration and before your name reaches a leak site, are where you have the most room to act.
8 Ransomware Threat Intelligence Signals Security Teams Should Monitor
These are the practical signals worth watching. Each is an indicator to check, not proof of an attack.
Table 3: Ransomware signals and recommended actions
| # | Signal | What it may indicate | Internal check | Potential action |
|---|---|---|---|---|
| 1 | Rising sector activity | A relevant group or affiliate scaling in your vertical | Are we tracking who is active in our sector this quarter? | Reassess actor relevance; brief responders |
| 2 | New initial-access technique | A relevant group added a new vulnerability, credential or VPN method | Do we use the affected technology or method? | Validate exposure and patch status |
| 3 | Technology overlap | A relevant group repeatedly hits technology you run | Do we operate it, and is any instance internet-facing? | Trigger an exposure review |
| 4 | Vulnerability overlap | A group is exploiting a CVE present in your estate | Exposure, patch status, authentication, logs | Prioritise patch or mitigation |
| 5 | Credential exposure | Corporate credentials appear in stealer logs or breach corpora | Do exposed accounts still authenticate? Is MFA enforced? | Reset, invalidate sessions, enforce MFA |
| 6 | External attack-surface exposure | Internet-facing services, remote access or admin interfaces exposed | Do we know every internet-facing asset we own? | Discover, review and reduce exposure |
| 7 | Third-party exposure | A vendor or partner is a viable access path | Which vendors have access, and are any on leak sites? | Vendor review; scope access and data flows |
| 8 | Actor behaviour change | New affiliates, TTPs, infrastructure, extortion model or victimology | Do our detections and assumptions still match? | Update detections, profiles and risk register |
The discipline that makes this work is holding the line between indicator and proof. A relevant group adding a CVE you run is a strong reason to check exposure today. It is not evidence that an attack is underway.
Where Can Security Teams Monitor Ransomware Groups?
The challenge is not finding feeds. It is correlating external intelligence with your actual exposure. These are the main sources, and they are not equally reliable.
Advisories and KEV are the highest-confidence sources. Vendor research is useful but sometimes carries promotional framing, so verify specific claims. Leak-site data is the least reliable as a predictor: it counts claimed victims who did not pay, some claims are exaggerated or fabricated, and different trackers produce different totals. Treat it as a view of the past, imperfectly.
How to Build a Ransomware Threat-Tracking Programme
You do not need a large team. You need a repeatable loop.
- Define your exposure. Document industry, geography, critical systems, sensitive data, internet-facing assets, cloud, remote access, identity systems and critical third parties. You cannot judge relevance without this baseline.
- Identify relevant groups. Prioritise by sector, geography, victim profile, technology overlap, vulnerability overlap and observed activity. A few maintained profiles beat a wall of feeds.
- Build actor profiles. Track the fields in Table 1: identity and aliases, victimology, initial access, TTPs, vulnerabilities, affiliates, infrastructure, extortion model and recent activity.
- Track TTP changes. Profiles decay. Groups add vulnerabilities, change affiliates and rebrand. Treat each profile as a living document.
- Map intelligence to internal assets. External intelligence (a group is exploiting a remote-access flaw) meets internal context (you run that product) meets risk context (it is internet-facing) and produces an action. This does not prove an attack is underway.
- Connect threats to risk. Translate the finding into a line on your risk register with an owner and a due date, not a note in an inbox.
- Assign ownership. Ransomware risk cuts across security operations, vulnerability management, IT, identity, vendor management, risk, incident response and business continuity. Name owners in advance.
- Monitor continuously. Reassess both actor profiles and your own exposure, because both change.
From Raw Feed to Actionable Intelligence
The gap between a feed and a decision is organisational context.
Raw: "Ransomware group X has targeted organisations in healthcare."
Actionable: "Group X recently began exploiting a vulnerability in a remote-access product. Our asset inventory shows two internet-facing instances of that product. Security should validate exposure, patch status, authentication controls and relevant logs, and confirm whether either instance is registered in our asset process."
The formula is: threat intelligence plus organisational context equals actionable intelligence. Without the internal half, a feed adds noise, and noise is what most teams already have too much of. The path runs external signal, internal context, risk, control, action, verification.
Real-World Ransomware Group Examples
Three current, government-documented groups show why the same tracking discipline applies differently to each.
Play
Observed behaviour. Active since June 2022, Play (also called Playcrypt) has been one of the most active groups of the period, running double extortion and recompiling its binary per victim to frustrate signature detection.
Initial access. Valid accounts likely bought on criminal markets, plus exploitation of public-facing applications, including known FortiOS and Microsoft Exchange flaws, and RDP and VPN. Affiliates have also exploited remote-support tooling.
Relevant signal. New credential exposure and exposed edge services in your estate.
What defenders should check. MFA coverage, exposed remote services, and whether any FortiOS or Exchange instances are internet-facing and patched.
Tracking lesson. For a group like this, identity monitoring and edge-service exposure are your leading indicators. A joint FBI, CISA and ACSC advisory updated in June 2025 reported roughly 900 affected entities as of May 2025, about three times the previously reported figure.
Cl0p
Observed behaviour. Cl0p mass-exploits file-transfer and enterprise software zero-days, and has largely moved to data-theft extortion rather than encryption. Prior campaigns hit MOVEit in 2023 and a Cleo file-transfer tool in 2024.
Initial access. In 2025 it exploited CVE-2025-61882, a critical unauthenticated remote-code-execution flaw (CVSS 9.8) in Oracle E-Business Suite, in the wild from at least early August before Oracle patched it in early October.
Relevant signal. A newly weaponised flaw in enterprise software you run.
What defenders should check. Whether you run the affected product, whether any instance is internet-facing, and patch status against CISA KEV, which listed the flaw on 6 October 2025.
Tracking lesson. The signal that matters is technology and vulnerability overlap, watched continuously, because the window between a flaw becoming known and mass exploitation is short. The victim spread reflected who runs Oracle EBS, not a chosen vertical.
Gunra
Observed behaviour. First observed in April 2025 and built on leaked Conti source code, Gunra began Windows-only, then added a Linux variant. It runs double extortion with a five to seven day deadline.
Initial access. Affiliates exploited Fortinet FortiOS and FortiProxy authentication-bypass flaws (CVE-2024-55591 and CVE-2025-24472) in internet-facing devices.
Relevant signal. Edge-appliance CVEs and new affiliate or alias activity.
What defenders should check. Fortinet edge exposure and patch status, and whether MFA can be bypassed on those paths.
Tracking lesson. Aliases and affiliate changes matter for a group evolving this fast. A joint advisory led by CISA and the FBI, published on 10 August 2026, reported that Gunra launched a formal RaaS affiliate program in early 2026, adopted the alias Golden Community, and recruits penetration testers as initial-access brokers.
Common Ransomware Intelligence Mistakes
- Tracking every group equally. Attention is finite. Prioritise by relevance.
- Treating leak-site lists as prediction. They count claimed victims who did not pay, not all incidents, and trackers disagree.
- Collecting feeds without internal context. A feed with no asset, identity or vendor mapping is noise.
- Focusing only on malware indicators. Hashes age fast. TTPs, identity and vulnerabilities are more durable.
- Ignoring credentials. The most common entry point is a valid account, invisible to a malware-only view.
- Ignoring vendors. Third-party access is a first-class path in.
- Stale actor profiles. A profile that is not reassessed is a false sense of safety.
- Separating CTI from risk management. If findings do not become owned risks with due dates, nothing changes.
How Early Can Threat Intelligence Warn You?
There is no universal ransomware warning period. Threat intelligence may give you weeks, days or hours of useful lead time, and sometimes none at all. A newly weaponised, mass-exploited zero-day can compress the window to almost nothing. The goal is not certainty. It is better prioritisation and preparedness: patching the exploited flaw before it is your turn, resetting the exposed credential before it is used, and knowing which vendor to call first. Anyone selling guaranteed advance warning of a ransomware attack is selling something that does not exist.
Could Your Organisation Be Exposed to a Relevant Ransomware Group?
Run this as a self-assessment. The aim is problem recognition, not fear.
- ☐ Do we know which ransomware groups are active in our sector and geography this quarter?
- ☐ Do we track their initial-access methods and the vulnerabilities they exploit?
- ☐ Do we know whether those technologies exist in our environment, and whether any are internet-facing?
- ☐ Can we name every internet-facing asset we own, from a recently reconciled register?
- ☐ Do we monitor corporate credential exposure in stealer logs and breach corpora?
- ☐ Do we understand which third parties have access, and whether any appear on leak sites?
- ☐ Do we map ransomware intelligence to our risk register, with named owners?
- ☐ Do we reassess actor relevance when a group changes TTPs or adds a vulnerability?
A conceptual view of the same idea, as a monitoring dashboard, might look like this. Illustrative example, not live threat intelligence.
| Signal | Status | Why it matters | Suggested review |
|---|---|---|---|
| Sector targeting | Raised | A relevant group is scaling in our vertical | Reassess actor relevance |
| TTP overlap | Watch | New method matches our environment | Validate detections |
| Vulnerability exposure | Action | Exploited CVE present and internet-facing | Patch or mitigate now |
| Credential exposure | Action | Exposed accounts still authenticate | Reset and enforce MFA |
| External attack surface | Watch | Unregistered internet-facing asset found | Investigate and reduce |
| Vendor exposure | Watch | A supplier category is being hit | Vendor review |
A Simple Ransomware Threat-Tracking Operating Model
An example cadence, not a universal requirement.
Daily: critical actor developments, exploited vulnerabilities, credential exposure, major advisories.
Weekly: relevant groups and new victims, TTP changes, vulnerability overlap, external exposure, vendor exposure.
Monthly: actor relevance, threat scenarios, the risk register, critical controls, incident response readiness, and backup and recovery readiness.
Ransomware Threat-Tracking Checklist
- ☐ Identify relevant ransomware groups
- ☐ Track aliases and rebrands
- ☐ Monitor victimology
- ☐ Track initial-access methods
- ☐ Track TTPs
- ☐ Track exploited vulnerabilities
- ☐ Monitor credential exposure
- ☐ Monitor external attack surface
- ☐ Review third-party exposure
- ☐ Map intelligence to assets
- ☐ Assign risk owners
- ☐ Create mitigation tasks
- ☐ Verify remediation
Where ScruteX Fits
Everything above works with open-source advisories, a spreadsheet and discipline. The hard part at scale is the mapping step: keeping actor profiles current and connecting them to your live exposure across assets, credentials and vendors, without a full-time analyst doing it by hand. That is the work most teams cannot sustain.
ScruteX is a Continuous Threat Exposure Management (CTEM) platform for external risk. Its Threat Insights module maps active threat actors, their TTPs and their indicators to your region and sector, rather than handing you a generic feed to triage. Its Exploit Context Layer enriches each finding with weaponisation status, active campaign intelligence and whether the affected asset is actually reachable, so a CVE a group is exploiting is checked against your specific assets and exposure. Vulnerability Insights discovers the internet-facing assets nobody registered. Data Exposure Insights matches your domains against dark web, paste-site and breach sources for leaked credentials and stealer-log appearances. Vendor Insights flags a supplier's exposure before it reaches your procurement team's news alert.
What Security Teams Should Do Now
- Identify the ransomware groups relevant to your organisation.
- Track their victimology, TTPs and exploited vulnerabilities.
- Monitor credentials, sessions and external exposure.
- Correlate external signals with internal assets.
- Assign owners to findings, with due dates.
- Reassess continuously, because actors and your surface both change.
FAQ
What is ransomware threat intelligence?
Ransomware threat intelligence is analysed information about ransomware groups, their behaviour and their targets, produced to help defenders prioritise. It works at strategic, operational, tactical and actor levels, and its value is telling you not just that a group is active, but whether it can reach your organisation.
How do you track ransomware groups?
Build actor profiles for the groups relevant to your sector, geography and technology; track their victimology, TTPs, initial-access methods and exploited vulnerabilities; map that to your own exposure; prioritise where relevance and exposure overlap; and reassess continuously.
How do organisations identify ransomware groups relevant to their industry?
By reviewing victimology from government advisories and reputable research and comparing it to their own profile. A caution: a sector victim cluster can reflect shared technology or vulnerability exposure rather than a preference for that industry, so treat it as a reason to check overlap, not as a forecast.
What information should you track about a ransomware group?
Identity and aliases, victimology, initial access, TTPs, exploited vulnerabilities, tools, affiliates, infrastructure, extortion model and activity trends.
What are common ransomware initial-access methods?
Stolen or stealer-log credentials, exploitation of public-facing applications and edge appliances, exposed RDP and VPN, phishing, third-party and remote-support tooling, and access bought from initial-access brokers.
Can ransomware threat intelligence predict an attack?
No. It provides context and signals that help prioritise defensive action. It cannot tell you when, or whether, an attack will happen, and it offers no guaranteed warning window.
How often should ransomware intelligence be reviewed?
Continuously for high-priority signals, weekly for relevant groups and exposure changes, and monthly for a broader reassessment of actor relevance, scenarios and controls.
How does ransomware intelligence connect to risk management?
Through the chain of external signal, internal context, risk, control, action and verification. A finding that becomes an owned risk with a due date is intelligence doing its job. One that stays in an inbox is not.
You cannot prioritise a ransomware group you have not connected to your own exposure. ScruteX maps active actors, TTPs and exploited vulnerabilities to your region and sector, then checks them against your external assets, credentials and vendors, so the list you act on is scoped to who could actually reach you. Start with a domain. ScruteX offers a free tier with no credit card required.