Ransomware Gang.

A financially motivated cybercriminal group that develops, operates, or distributes ransomware to extort organisations through file encryption and data leak threats. It belongs to the Defense & Operations category of cybersecurity.

A financially motivated cybercriminal group that develops, operates, or distributes ransomware to extort organisations through file encryption and data leak threats.

Modern ransomware gangs operate as structured criminal enterprises. A core team builds the encryptor, runs the data-leak site, negotiates ransoms, manages cryptocurrency cash-out, and recruits affiliates under a ransomware-as-a-service (RaaS) model. Affiliates obtain initial access (often via initial access brokers, phishing, or VPN/Citrix exploits), perform reconnaissance, escalate privileges, exfiltrate data, then deploy the ransomware. Many gangs use double extortion (encryption plus leak threat) and increasingly triple extortion (DDoS, customer harassment). Known brands include LockBit, Conti, REvil, BlackCat/ALPHV, Cl0p, Royal/BlackSuit, Akira, Play, Hive, and 8Base. They are heavily targeted by law-enforcement disruptions, sanctions, and infrastructure takedowns.

Defences for Ransomware Gang typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Ransomware crew, Ransomware operator.