Live ransomware activity

Recent ransomware leak-site claims merged across multiple trackers — Ransomlook, mythreatintel, ransomfeed.it, ransomwatch, ransomware.live, and Andrea Fortuna. Deduped by (group + victim + day), newest first. Per-victim screenshots when Ransomlook has captured one; the other trackers fill coverage gaps and keep the page populated when any single source is degraded. Reference only; verify before acting.

Refreshed hourly from upstream. See also ransomware negotiations (demand vs. paid + transcripts).