What does n'guard's Ransomware Intelligence show?

It shows which ransomware groups are currently publishing organisations from Switzerland and the DACH region, which sectors are affected and how the listings have developed over 24 months. The service is free of charge and updated continuously.

Where does the Ransomware Intelligence data come from?

The data comes from ransomware.live, an open community project that automatically scrapes publication sites on the Tor network. Country and sector are partly assigned automatically there and may differ in individual cases.

Why do the figures differ from official statistics?

Authorities such as the BACS count reported incidents, whereas leak site monitoring counts publications by the attackers. Each captures only part of the picture; together they give a more realistic view.

What should you do if your organisation is named on a leak site?

Trigger your own incident response or bring in external help, isolate your systems and inform authorities such as the BACS and the police. Depending on the data involved, the individuals affected must also be informed. Do not negotiate with the group without specialists.

Where does the data come from?

From ransomware.live, an open project that continuously and automatically reads the leak sites of active ransomware groups. n'guard prepares this data for the DACH region, translates industries and group profiles and classifies them for Swiss SMEs.

Ransomware Intelligence

ENEnglish

LiveUpdated hourly

Ransomware Intelligence

Who is attacking right now, and whom.

Q: What is a ransomware leak site?

A leak site is the publication site of a ransomware group on the Tor network. Victims are named there, and stolen data is threatened with release or published, in order to pressure them into paying the ransom. A listing means that data has already been exfiltrated.

Live evaluation of the publication pages of active ransomware groups for Switzerland and the DACH region: groups, industries, history and profiles. Updated hourly from public sources.

in 24 hours

in 30 days

active groups

Leak site mentions per month

Last 24 months, from discovery date

Comparison in the DACH region

Mentions from the last 12 months

Actors and targets

Most active groups and affected industries.

Most active groups, 12 months

Green dot: Leak site currently accessible. Click opens the group profile.

Affected industries, 12 months

Allocation by ransomware.live, partially automated

Victim tracker

Published victims in the last 12 months.

Organizations publicly named by the groups themselves. n'guard does not add names or evaluate individual cases.

Date	Organization	Sector	Group
Loading …

Source: ransomware.live. Organizations that have been published on leak sites related to the selected country are shown. This is a subset of all ransomware incidents.

Latest publications worldwide

The 20 most recent entries across all countries

Date	Organization	Country	Group
Loading …

From observation to action

Are you the next target?

Ransomware groups are not looking for specific companies, but rather for open doors: accessible remote access, unpatched systems, leaked access data. The free Dark Web & Exposure Check shows in one minute whether your domain has such doors.

Over 80% of the attacks listed here start with one of three patterns: credentials, missing patches, phishing.

Check your own domain

In simple words

What does the Ransomware Intelligence show?

The n'guard Ransomware Intelligence is a free, constantly updated evaluation of the leak sites of active ransomware groups with a focus on Switzerland and the DACH region. It shows which groups organizations from the region are currently publishing, which sectors are affected, how the number of mentions has developed over 24 months and how Switzerland compares to Germany, Austria and Liechtenstein. Each group has a profile with a description, activity, target countries and the status of their publication pages.

The data comes from ransomware.live, an open community project that automatically reads publishing sites on the Tor network. n'guard does not collect its own underground data, but rather prepares, translates and classifies it for management, IT managers and security officers of SMEs.

Limits of data

Leak site mentions only show attacks in which the victim did not pay or the group wanted to build pressure. Ransoms paid, attacks stopped early and cases without data theft do not appear here. Country allocation and industry are partly determined automatically by ransomware.live and may vary in individual cases.

FAQ

Answers to ransomware groups and leak sites.

Which ransomware groups are attacking Swiss companies?

The ranking above shows which groups have published Swiss organizations on their leak sites in the last twelve months. The composition is constantly changing: groups are broken up, renamed or re-emerge as successors with the same tools. More important than the name is the pattern behind it, and that is stable for years.

What is a Ransomware Leak Site?

The publishing page of a ransomware group on the Tor network. Victims are named there and stolen data is threatened or published in order to put pressure on the ransom payment. A mention means that the victim’s data has already been leaked, not just encrypted.

Why do the numbers differ from official statistics?

Authorities like BACS count reported incidents, leak site monitoring counts publications by the perpetrators. Both only capture a part. Together they create a more realistic picture than either source alone, which is why the Cyber Threat Monitor from n'guard shows both.

What should you do if your organisation is listed here?

Trigger your incident response immediately or get outside help, isolate systems, and inform the authorities (BACS, police) and, depending on the data, the people affected. Do not negotiate with the group without involving specialists. n'guard supports the initial response at Contact.

Continuous monitoring, not a snapshot

Your name should never appear here.

n'guard’s Managed SOC detects the early stages of a ransomware attack, such as stolen credentials, suspicious logins and vulnerabilities at the perimeter, before encryption begins.

Get to know Managed SOC →Request a pentest