ThreatIntel: CISAThreatGroups.md
Recurso del BushidoUK Ransomware Tool Matrix - ThreatIntel.
CISA Threat Groups
> [!IMPORTANT]
> The Threat Groups mentioned in other files in this repository are highlighted in the following list of #StopRansomware CISA Alerts. It was important to use this list of publicly available reports as the main source as it makes it so the research can be independently peer reviewed.
| Date Published | Ransomware/Extortionist | #StopRansomware Report |
|---|---|---|
| 22 July 2025 | Interlock | <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a" rel="noopener" target="_blank">CISA Alert aa25-203a</a> |
| 12 March 2025 | Medusa | <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a" rel="noopener" target="_blank">CISA Alert aa25-071a</a> |
| 19 February 2025 | Ghost/Cring | <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-050a" rel="noopener" target="_blank">CISA Alert aa25-050a</a> |
| 29 August 2024 | RansomHub | <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-242a" rel="noopener" target="_blank">CISA Alert aa24-242a</a> |
| 28 August 2024 | *Br0k3r (NoEscape, Ransomhouse, BlackCat, Pay2Key) | <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a" rel="noopener" target="_blank">CISA Alert aa24-241a</a> |
| 7 August 2024 | BlackSuit (aka Royal) | <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a" rel="noopener" target="_blank">CISA Alert aa23-061a</a> |
| 10 Nay 2024 | Black Basta | <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-131a" rel="noopener" target="_blank">CISA Alert aa24-131a</a> |
| 18 April 2024 | Akira | <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a" rel="noopener" target="_blank">CISA Alert aa24-109a</a> |
| 29 February 2024 | Phobos | <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-060a" rel="noopener" target="_blank">CISA Alert aa24-060a</a> |
| 27 February 2024 | ALPHV/BlackCat | <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-353a" rel="noopener" target="_blank">CISA Alert aa23-353a</a> |
| 18 December 2023 | PLAY | <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a" rel="noopener" target="_blank">CISA Alert aa23-352a</a> |
| 12 December 2023 | Karakurt | <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-152a" rel="noopener" target="_blank">CISA Alert aa22-152a</a> |
| 16 November 2023 | Scattered Spider | <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a" rel="noopener" target="_blank">CISA Alert aa23-320a</a> |
| 15 November 2023 | Rhysida | CISA Alert aa23-319a
| 11 October 2023 | AvosLocker | CISA Alert aa23-284a | | 20 September 2023 | Snatch | CISA Alert aa23-263a | | 7 June 2023 | CL0P | CISA Alert aa23-158a | | 16 May 2023 | BianLian | CISA Alert aa23-136a | | 16 March 2023 | LockBit | CISA Alert aa23-075a / CISA Alert aa23-165a / CISA Alert aa23-325a | | 5 January 2023 | Cuba | CISA Alert aa22-335a | | 25 November 2022 | Hive | CISA Alert aa22-321a | | 26 October 2022 | Daixin | CISA Alert aa22-294a | | 8 September 2022 | Vice Society | CISA Alert aa22-249a | | 11 August 2022 | Zeppelin | CISA Alert aa22-223a | | 11 August 2022 | Medusa | CISA Alert aa22-181a | | 9 March 2022 | Conti | CISA Alert aa21-265a | | 18 October 2021 | BlackMatter | CISA Alert aa21-291a | | 8 July 2021 | DarkSide | CISA Alert aa21-131a | | 6 May 2021 | FiveHands | CISA Alert ar21-126a |