Ransomware Activity

Victims as claimed on gang extortion sites, refreshed every two minutes. A claim means data was already stolen. Where shown, a gang's country is an assessed link from public law-enforcement and industry reporting, not telemetry.