Ransomware Groups Guide: LockBit, Akira, Qilin and Others

Ransomware groups rebrand, split, share code and rent their malware to affiliates, so a gang name on a leak site tells defenders far less than it seems. This guide profiles the groups that government advisories and MITRE ATT&CK document in detail, explains how the ransomware-as-a-service (RaaS) economy works, and shows how to turn group intelligence into prioritised detections and controls. It is for threat intelligence analysts, detection engineers, incident responders and security leaders. Group facts come from joint #StopRansomware advisories, law enforcement announcements and ATT&CK v20; status statements carry an "as of" date because this landscape changes monthly.

Key takeaways

• Track the affiliate, not just the brand. RaaS operators supply malware and leak sites; affiliates choose victims and run intrusions, and they move between brands. RansomHub was "attracting high-profile affiliates from other prominent variants such as LockBit and ALPHV" within months of launch, according to CISA and the FBI.
• Initial access is mostly identity and edge devices. Advisories repeatedly name VPNs without MFA (Akira), help desk impersonation (ALPHV), vishing through Teams (Black Basta), password spraying (RansomHub) and exploited file transfer or firewall products (Cl0p, Gunra).
• The end game looks the same everywhere. Across 60 ransomware group and software entries in ATT&CK v20, 55 map to T1486 Data Encrypted for Impact, 39 to T1490 Inhibit System Recovery and 31 to T1685 Disable or Modify Tools. Detect these once and you cover most brands.
• Extortion no longer needs encryption. Cl0p "preferred to rely mostly on data exfiltration over encryption" from 2021, and some ALPHV affiliates extorted victims without deploying ransomware. Exfiltration detection matters as much as backup.
• Takedowns disrupt, they rarely end the threat. Hive, ALPHV, LockBit and 8Base were hit by law enforcement, but leaked builders, reused code and mobile affiliates keep their techniques alive.

How the ransomware economy works

Most modern ransomware is run as a service. The joint LockBit advisory describes the model: a core group maintains the ransomware and administration panel and recruits affiliates who carry out intrusions with its tools and infrastructure. ATT&CK describes Water Galura (G1050), the operators of Qilin, as handling "payload generation, ransom negotiations, and the publication of stolen data" for affiliates "recruited on Russian cybercrime forums".

Payment terms vary: LockBit let affiliates receive ransoms before passing a cut to the core group, while Phobos affiliates paid administrators for decryption keys, according to the DOJ.

Extortion models

• Double extortion: data is stolen before encryption and the group threatens publication. Akira, Black Basta, Play, RansomHub and Medusa advisories all describe it. LockBit supplied its affiliates with StealBit (S1200) for this purpose.
• Data theft only: Cl0p's mass exploitation of Accellion FTA (2020 and 2021), GoAnywhere (early 2023) and MOVEit Transfer (from 27 May 2023, CVE-2023-34362) relied mainly on theft and leak threats. See the Oracle E-Business Suite Cl0p zero-day breach for the 2025 repeat of this pattern.
• Triple extortion and re-extortion: the Medusa advisory records a victim who paid and was then contacted by a separate actor asking for half the payment again for the "true decryptor".
• Leak site pressure: Medusa's .onion leak site shows countdowns and, as of August 2026, offers to add a day for $10,000. Gunra advertises "the sale of datasets from specific victims".

Major ransomware groups: reference table

IDs are ATT&CK v20 Group (G) and Software (S) entries; "first seen" is as stated in ATT&CK or the cited advisory. Status is as of the source date shown, not a statement that a group is inactive today.

Lineage, rebrands and older families

Many current brands descend from earlier ones, which is why defences built against one family often transfer.

Other families with ATT&CK entries: SamSam (S0370, manually operated), Pysa (S0583), LockerGoga (S0372), MegaCortex (S0576), EKANS (S0605, kills ICS processes), RobbinHood (S0400), Netwalker (S0457, disrupted 2021), ProLock (S0654), Avaddon (S0640), AvosLocker (S1053), Ragnar Locker (S0481, FIN8), SynAck (S0242; unrelated to the security firm of similar name), ShrinkLocker (S1178, abuses BitLocker), ThiefQuest (S0595, macOS, effectively a wiper), and state-linked uses: Pay2Key (S0556, Fox Kitten), JCry (S0389) and ROADSWEEP (S1150, against Albania).

Other names tracked without a primary profile read for this guide: DragonForce, Lynx, Cactus, SafePay, Hunters International (named only as a RaaS that Storm-0501 used), Rhysida.

Name collisions: the FBI states Medusa ransomware "is unrelated to the MedusaLocker variant and the Medusa mobile malware variant", and ATT&CK's MEDUSA (S1220) is a Linux rootkit. "Play" is both the group (G1040) and an alias of Playcrypt (S1162).

Where the groups converge: TTPs to prioritise

ATT&CK software entries describe the encryptor, so impact techniques dominate; advisories describe how affiliates got in. Read both.

The Akira advisory notes that in some incidents data was exfiltrated "in just over two hours from initial access", so detections at the access and exfiltration stages buy the only real response time. The LockBit advisory warns that abuse of legitimate tools should not be attributed to the tools themselves, so detections need context: who ran it, where and when. See the Detection Engineering Guide.

Using group intelligence for defence

Group profiles are only useful when they change what you build, test or patch. A practical programme:

1. Select relevant groups. Filter advisories by sector (Black Basta hit 12 of 16 US critical infrastructure sectors) and by your technology: VPN vendor, file transfer products, RMM tools, ESXi or Nutanix. Start with five to eight groups.
2. Build a technique layer. Combine ATT&CK G and S entries with advisory TTP tables into one ATT&CK Navigator layer and score each technique by how many selected groups use it.
3. Map to controls and detections. Record the preventive control, detection rule and log source for each high-scoring technique; gaps go on the backlog with an owner.
4. Test in a controlled way. Run authorised emulation of the selected behaviours in a test segment or pilot ring; deploy new rules in alert-only mode first, measure false positives for two weeks, then promote to blocking or paging. Roll back by reverting the rule version if analysts are flooded.
5. Treat indicators as perishable. Load advisory IOCs for retro-hunting over the last 90 days, then expire them; IP addresses and hashes are rotated quickly, behaviours are not.
6. Re-run on every new advisory. New #StopRansomware advisories keep coming (Gunra and a Medusa update in August 2026); diff each TTP table against your layer.

Small organisations can skip the group selection and implement the controls that every advisory repeats: phishing-resistant MFA on remote access and email, rapid patching of internet-facing devices, offline backups and EDR with tamper protection. Large organisations gain more from affiliate-level tracking, because the same affiliate's pre-encryption tradecraft will recur under a new brand. See the Threat Intelligence Guide and the Ransomware Prevention Guide.

Where identity fits

• Remote access accounts: the Akira advisory leads with "a virtual private network (VPN) service without MFA configured". Inventory every VPN and RDP entry point and the accounts that can use it. See the Remote Access Identity Guide.
• Help desk and vishing: ALPHV affiliates posed as IT staff by phone or SMS to obtain credentials; Storm-1811 floods inboxes then calls as the help desk to install remote access tools. See the Account Recovery and Help Desk Security Guide.
• MFA and session theft: ALPHV affiliates used Evilginx2 adversary-in-the-middle phishing; Gunra bypassed MFA (T1556.006) and stole session cookies (T1539). The ALPHV advisory recommends FIDO/WebAuthn or PKI-based MFA.
• Service and hybrid identities: the LockBit advisory recommends restricting service account remote logon, and the Storm-0501 hybrid cloud attacks show a ransomware affiliate using stolen Entra Connect Sync credentials to reach the cloud. See the Service Account Security Guide.

Sanctions, payment and status caveats

• Sanctions exposure: OFAC's September 2021 advisory says civil penalties apply on a strict liability basis, even if a person "did not know or have reason to know" a payment reached a sanctioned party. It covers facilitators such as insurers and incident response firms, reviews licence applications "with a presumption of denial", and lists Evil Corp (designated December 2019).
• Mitigating factors: OFAC treats preventive steps such as offline backups, prompt reporting to law enforcement and full cooperation as significant mitigating factors, and the US government "strongly discourages the payment" of ransoms. Build legal review, sanctions screening and reporting into the response plan in advance. See the Incident Response Guide.
• Payment does not end the data risk: the NCA said after Operation Cronos that paying "does not guarantee that data will be deleted", and the Medusa re-extortion case shows a second demand can follow.
• Attribution is fluid: brands rebrand (Knight to RansomHub), code leaks (LockBit 3.0 builder, Babuk), and state actors use ransomware (Moonstone Sleet with Qilin). Record an "as of" date and source for every attribution.
• Leak site claims are unverified: confirm impact through your own telemetry and supplier statements.

Detection, measurement and framework mapping

Monitor: remote logins without MFA or from hosting providers; new remote access software on servers; LSASS access and NTDS.dit copies (T1003.001, T1003.003); GPO and boot configuration changes; EDR tamper and driver loads; log clearing (Event ID 1102); shadow copy deletion; bulk uploads to cloud storage; ESXi shell and SSH enablement.

Metrics that show the programme works:

• Share of the top 20 techniques for your selected groups with a tested detection (target above 80%).
• Time from a new #StopRansomware advisory to a completed TTP diff and retro-hunt (target under five working days).
• Internet-facing systems with a known exploited vulnerability older than 14 days.
• Remote access accounts without phishing-resistant MFA.
• Median exercise time from exfiltration alert to containment, against Akira's two-hour window.

Common failure patterns

• Tracking brands instead of behaviours: blocklists of one group's hashes are obsolete after a rebrand, while the affiliate's VPN and RMM tradecraft carries over.
• Waiting for encryption: data-theft-only campaigns never trigger encryption alerts. The Oracle E-Business Suite Cl0p campaign extorted victims through stolen data and executive email.
• Treating a takedown as the end: after the December 2023 ALPHV disruption, an administrator urged affiliates to target hospitals, and healthcare became the most victimised sector among nearly 70 leaked victims.
• Single-factor remote access left in place: the leading Akira vector, and a recurring LockBit and Play entry point.
• Ignoring hypervisors: Akira, LockBit, Qilin, RansomHub, Medusa and The Gentlemen all have ESXi or other hypervisor lockers, often outside EDR coverage.
• Trusting legitimate tools: AnyDesk, ScreenConnect, Splashtop and Quick Assist recur in advisories; unmanaged installs should alert.

Practitioner checklist

• Select five to eight ransomware groups relevant to your sector and technology, and record the source and "as of" date for each.
• Build an ATT&CK Navigator layer from their G and S entries and #StopRansomware TTP tables; score techniques by frequency.
• Confirm tested detections for T1486, T1490, T1489, T1685 and T1484.001, including on ESXi hosts.
• Enforce phishing-resistant MFA on VPN, RDP gateways, webmail and administrator accounts; remove single-factor remote access.
• Patch internet-facing VPNs, firewalls and file transfer products against known exploited vulnerabilities within days.
• Allowlist approved remote access tools and alert on any other installation.
• Alert on Rclone, WinSCP or FileZilla execution on servers and on bulk uploads to cloud storage.
• Keep offline or immutable backups out of reach of domain credentials and test restores.
• Add sanctions screening, legal review and law enforcement reporting steps to the ransomware incident response playbook.
• Review every new #StopRansomware advisory within five working days and update the layer.

Standards and references

• CISA and FBI: #StopRansomware: Akira Ransomware (AA24-109A)
• CISA, FBI and international partners: Understanding Ransomware Threat Actors: LockBit (AA23-165A)
• CISA, FBI and HHS: #StopRansomware: Medusa Ransomware (AA25-071A)
• CISA and FBI: #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability
• MITRE ATT&CK: Akira (G1024)
• US Treasury OFAC: Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments
• National Crime Agency: International investigation disrupts the world's most harmful cyber crime group
• US Department of Justice: Fact Sheet: CCIPS Enforcement Actions to Combat Cybercrime

Related NHI Mgmt Group resources: Ransomware Prevention Guide · Threat Intelligence Guide · Incident Response Guide · Malware Guide · Detection Engineering Guide