Top 15 Ransomware Groups Targeting U.S. Businesses

Affiliate Networks

Most major ransomware groups no longer operate like traditional malware authors who write code and deploy it themselves. They run affiliate programs, recruiting experienced threat actors who deploy their ransomware in exchange for a percentage of ransom proceeds. This model means that a single ransomware brand can generate dozens of simultaneous attacks across unrelated industries.

Double Extortion

Nearly every major ransomware group now uses double extortion: encrypting files and threatening to publish stolen data on public leak sites if the ransom is not paid. This creates pressure even for organizations with functioning backups. If sensitive customer data was stolen before encryption, a working restore does not resolve the threat.

Is paying the ransom the only option when attackers threaten to publish stolen data?

LockBit

LockBit has operated the most prolific ransomware-as-a-service platform of the past three years, accounting for more attributed attacks than any other group. Their affiliate program is technically sophisticated, offering speed-optimized encryption and a self-service negotiation portal. Despite law enforcement disruption in 2024, LockBit has demonstrated repeated capacity to rebuild and continue operations.

Black Basta

Black Basta emerged in 2022 and quickly established itself as one of the most aggressive double-extortion operators. The group is believed to include former members of the Conti organization and has targeted critical infrastructure, healthcare, and professional services firms. Their initial access typically involves phishing and exploitation of known vulnerabilities in internet-facing services.

Clop

Clop is responsible for some of the largest mass-exploitation ransomware campaigns on record, most notably attacks on the MOVEit file transfer platform that compromised hundreds of organizations simultaneously. Rather than encrypting files and demanding ransom from each victim individually, Clop often focuses on data theft and threatens publication. Their campaigns are characterized by speed and scale.

BlackCat / ALPHV

BlackCat (also known as ALPHV) was technically advanced and uniquely operated in multiple operating system environments including Windows, Linux, and VMware ESXi, meaning they could encrypt both workstations and virtual infrastructure in a single attack. Despite a law enforcement takedown in late 2023, the group’s affiliate infrastructure remained active.

Hive

The FBI infiltrated Hive’s infrastructure in 2022 and 2023, recovering decryption keys for over 300 victims and preventing an estimated $130 million in ransom payments before dismantling the operation. Hive had targeted over 1,500 organizations in 80 countries, with a particular focus on healthcare.

Ryuk

Ryuk is one of the earliest enterprise-focused ransomware operators and pioneered the model of targeting large organizations rather than individuals. Ryuk attacks typically followed weeks of network access using TrickBot or BazarLoader malware, meaning by the time the ransomware deployed, attackers had already mapped the environment and exfiltrated data. The group is believed to have collected over $150 million in ransoms.

Conti

Conti was among the most professionally organized ransomware operations in history before internal data leaks and law enforcement pressure disrupted it in 2022. The leaks revealed a corporate-style operation with HR, IT support, and specialized attack teams. Former Conti members are believed to have seeded several successor groups including Black Basta.

REvil / Sodinokibi

REvil was responsible for the Kaseya VSA attack that simultaneously compromised hundreds of managed service providers and their clients in 2021. At their peak, REvil earned an estimated $200 million in a single year. Law enforcement operations disrupted the group in late 2021, though former members reappeared in subsequent operations.

AvosLocker

AvosLocker targeted critical infrastructure sectors including healthcare, financial services, and government. The group was notable for using legitimate remote administration tools, specifically AnyDesk, for persistence, making detection harder. CISA issued a specific advisory on AvosLocker TTPs in 2023.

Vice Society

Vice Society disproportionately targeted educational institutions and healthcare organizations in the U.S. and UK. Their attacks on school districts caused significant disruption and data exposure. Unlike some groups, Vice Society sometimes skipped encryption entirely and relied solely on data theft and extortion, a trend that other groups have since adopted.

Medusa

Medusa emerged as a significant threat in 2023, operating a public leak site and running a RaaS model that attracted experienced affiliates. The group has targeted manufacturing, education, and government sectors. Their aggressive negotiation tactics and willingness to publish data quickly after deadlines have made them particularly damaging.

Play

Play ransomware gained attention for targeting municipalities and critical infrastructure, with attacks on systems in California and across the U.S. The group exploits vulnerabilities in internet-facing systems and uses custom tools that complicate detection. Their attacks on public sector organizations have drawn significant law enforcement attention.

Scattered Spider

Scattered Spider is notable for using social engineering rather than purely technical exploits to gain initial access. The group has used SIM swapping, phishing, and help desk impersonation to compromise large enterprise environments. Their targeting of MGM Resorts and Caesars Entertainment in 2023 demonstrated their capability against major organizations with mature security programs.

Akira

The FBI calls Akira a ‘top five’ ransomware variant. Akira emerged in 2023 and quickly built a significant victim count across manufacturing, education, and healthcare. The group uses double extortion and operates a leak site. Security researchers have noted their encryption implementation has occasionally contained flaws, though organizations should not rely on this.

8Base

8Base operates primarily as a data theft and extortion group but also deploys ransomware when advantageous. Their targets have spanned professional services, construction, and healthcare. The group claims to represent ‘honest pen testers’ in communications, though their actual TTPs indicate sophisticated criminal operations.

The pattern across these groups is consistent: prolonged network access before encryption, credential theft, data exfiltration, and targeted attacks against backup infrastructure. Defending against them requires the same depth of approach.

If an attack is already underway, does knowing the threat actor group actually change the response?