Introduction
The ransomware economy in 2025 has matured into a sophisticated, multi-layered criminal enterprise where data exfiltration and public shaming are the primary weapons. At the center of this ecosystem are dark web leak sites — dedicated .onion portals where ransomware groups publish stolen data from victims who refuse to pay. These sites have evolved from simple data dumps into professional-grade extortion platforms complete with countdown timers, searchable databases, and press-style announcements. Understanding which groups maintain active ransomware leak sites in 2025 is no longer optional for cybersecurity teams; it is a core component of threat intelligence and incident response.
This article provides a comprehensive, evidence-based survey of 15 ransomware groups operating active leak sites as of mid-2025. We detail their current infrastructure, operational patterns, targeting preferences, and the tactical shifts that define this year's threat landscape. For security professionals responsible for external attack surface monitoring, third-party risk, or dark web intelligence, this annual update serves as a foundational reference for identifying, tracking, and responding to extortion events originating from the most active ransomware leak sites in 2025.
The Ransomware Leak Site Ecosystem in 2025
The concept of the leak site — sometimes called a "name-and-shame" portal — emerged around 2020 when groups like Maze and REvil began publishing stolen data to pressure victims. By 2025, the model has become universal among ransomware-as-a-service operations and independent threat actors alike. These sites serve dual roles: they amplify extortion pressure by publicly exposing sensitive data, and they signal operational credibility to the broader cybercriminal ecosystem.
The infrastructure behind these sites has grown more resilient. Most groups now deploy multiple onion domains behind CDN-style reverse proxies, use decentralized hosting arrangements, and maintain redundant fallback domains. Law enforcement takedowns, while impactful, often result in groups resurfacing under new domains within days or weeks. This cat-and-mouse dynamic means that any list of active ransomware leak sites must be continuously validated.
According to the IBM Cost of a Data Breach Report 2024, ransomware attacks involving data exfiltration and leak site publication increased costs by an average of $1.5 million compared to encryption-only incidents. The reputational damage from public data exposure often exceeds the ransom demand itself.
The targeting patterns visible across leak sites in 2025 reveal a clear shift toward critical infrastructure, healthcare, education, and government entities. These sectors face higher regulatory pressure to disclose breaches and greater operational disruption from data exposure, making them more likely to consider ransom payments. Threat actors have internalized this calculus and increasingly prioritize victims in regulated verticals.
Methodology: How We Track Active Ransomware Leak Sites
Maintaining an accurate inventory of active ransomware leak sites requires continuous, automated monitoring combined with manual verification. The landscape changes daily: domains go offline, new groups emerge, established groups rebrand, and law enforcement operations disrupt infrastructure. The following methodology underpins the list presented in this article.
Automated Dark Web Crawling
DarkThreat.AI operates a distributed network of Tor-based crawlers that index known and suspected leak site domains hourly. The crawlers capture site availability, page structure changes, new victim listings, and metadata such as PGP keys and contact channels. Any change in site availability triggers an alert for manual review.
Cross-Reference with Incident Reports
Every leak site listing is cross-referenced against publicly reported ransomware incidents, data breach notifications, and intelligence feeds from partners. This validation step confirms that a site is actively publishing new victims rather than merely remaining online as an archive. Groups that have not posted a new victim in over 90 days are excluded from the active list.
Forum and Telegram Intelligence
Ransomware groups frequently announce new leak site domains or infrastructure changes on underground forums such as RAMP, Exploit, and XSS, as well as Telegram channels. These sources often provide early warning of domain migrations before they appear in public threat intelligence feeds.
- Domain Freshness: Sites must have been accessible via Tor within the past 7 days and contain victim data published within the past 30 days.
- Operational Consistency: The leak site must demonstrate consistent operational patterns, including regular victim updates, contact mechanisms, and group branding.
- Exclusion Criteria: Archival or defunct sites, groups that have disbanded, and sites that have been seized by law enforcement (confirmed via official seizure banners) are excluded.
15 Active Ransomware Leak Sites in 2025
The following list represents 15 ransomware groups that maintain confirmed active leak sites as of mid-2025. Each entry includes the group's operational profile, infrastructure characteristics, targeting focus, and notable recent activity. The order reflects relative threat volume and impact rather than any ranking of severity.
1. LockBit 3.0
LockBit remains the most prolific ransomware operation in 2025 by victim count, despite a major law enforcement takedown in early 2024 that seized its primary infrastructure. The group rebuilt its leak site within 72 hours and has since operated through a distributed network of backup domains. LockBit 3.0's leak site features a sophisticated victim search interface, data preview capabilities, and an automated auction system for high-value datasets. The group continues to target manufacturing, logistics, and professional services sectors globally.
2. BlackCat / ALPHV
BlackCat resurfaced in late 2024 after a controversial exit scam that saw the group absorb a $22 million ransom payment and disappear. The rebranded operation now runs a leaner leak site infrastructure with enhanced operational security. Their current leak site features a clean, minimal interface with victim data organized by industry vertical. BlackCat has shifted its targeting toward healthcare and financial services, with a particular focus on mid-market organizations in North America and Europe.
3. Clop
Clop's leak site has remained operational since the group's mass exploitation of FortiGate and MOVEit vulnerabilities in 2023. While victim volume has declined from the peak of those campaigns, Clop continues to post new victims from targeted intrusions involving file transfer appliances and edge devices. Their leak site is notable for its structured data navigation, allowing visitors to filter by industry, data type, and file size. Clop primarily targets enterprise organizations in technology, finance, and government sectors.
4. Play Ransomware
The Play ransomware group has maintained consistent leak site operations throughout 2025, posting multiple new victims per week. Their leak site uses a straightforward listing format with victim names, brief descriptions of data exfiltrated, and direct download links. Play has demonstrated a preference for targeting managed service providers and healthcare organizations, leveraging initial access gained through compromised RDP connections and VPN appliances.
5. BianLian
BianLian has evolved from a ransomware variant into a data extortion-only operation, and their leak site reflects this shift. Victims are listed with detailed descriptions of the stolen data, including sample files and database schemas. The group has refined its targeting to focus on architectural, engineering, and legal firms — sectors where confidential client data carries high extortion value. BianLian's leak site remains accessible and regularly updated as of 2025.
6. Rhysida
Rhysida emerged as a significant threat in 2023 and has since established a reputation for aggressive targeting of educational institutions and healthcare providers. Their leak site employs a distinctive visual design with victim data organized into categorized galleries. Rhysida has been linked to breaches at multiple major hospitals and university systems in 2025, posting what appears to be complete database exports in many cases. The group's leak site includes a countdown timer for each victim, escalating pressure as deadlines approach.
7. Cactus
The Cactus ransomware group has steadily grown its leak site operations throughout 2025, posting an increasing volume of victims month over month. Their leak site employs a simple, no-frills design with victim names listed alphabetically, each linking to a page containing sample files and ransom negotiation instructions. Cactus targets a broad range of industries with a slight preference for manufacturing and distribution companies in North America.
8. Akira
Akira's leak site has been persistently active since the group's emergence in 2023. The site features a clean, modern design with victim data organized by publication date and industry tag. Akira has demonstrated technical sophistication in its leak site operations, including automated data categorization and full-text search capabilities. The group targets small to medium enterprises across multiple sectors, with a notable concentration in professional services and technology.
9. Black Basta
Black Basta continues to operate one of the more active leak sites in 2025, posting victims consistently since its formation in 2022. The group's leak site includes a detailed victim dashboard with estimated data volumes, file type breakdowns, and sample previews. Black Basta has been particularly active against manufacturing, transportation, and logistics organizations, leveraging initial access through phishing campaigns and exploited vulnerabilities in internet-facing systems.
10. Hunters International
Hunters International emerged in late 2023 and quickly established a foothold as a significant extortion operation. Their leak site features a modern interface with victim data searchable by name, industry, and geographic region. The group has posted a steady stream of victims throughout 2025, with a focus on healthcare, finance, and government entities. Hunters International distinguishes itself through detailed victim write-ups that describe the nature of exfiltrated data in precise terms, increasing extortion pressure.
11. RansomHub
RansomHub has rapidly ascended as one of the most active ransomware operations in 2025, with a leak site that boasts a high victim posting frequency. The group's site employs a structured listing format with victim names, exfiltration dates, and data category tags. RansomHub has demonstrated a broad targeting profile but shows particular interest in technology companies and financial institutions. The group's operational tempo and leak site consistency make it a top-tier threat in the current landscape.
12. Fog Ransomware
Fog ransomware has maintained a targeted but consistent leak site presence in 2025. The group focuses primarily on the education sector, with a growing footprint in healthcare. Their leak site is relatively simple compared to larger operations but is notable for the high quality of data sample postings, which often include complete database backups and internal communications archives. Fog's targeting of schools and universities during academic cycles suggests strategic timing to maximize disruption.
13. Qilin
Qilin (formerly Agenda) has evolved its leak site into a polished extortion platform with multilingual support and a responsive design optimized for mobile browsing. The group posts victims with detailed metadata including data size, file count, and exfiltration method. Qilin targets organizations across multiple sectors with a geographic focus on Europe and North America. Their leak site also features a "hall of shame" for victims who have failed to respond to ransom demands, increasing reputational harm.
14. DragonForce
DragonForce emerged in 2024 and has quickly established an active leak site presence in 2025. The group's site features a straightforward listing of victims with associated data descriptions and sample files. DragonForce targets a broad range of industries but has shown particular interest in government organizations at the municipal and state level. The group's leak site is updated frequently, with multiple new victims appearing each week.
15. 8Base
8Base continues to operate an active leak site in 2025, maintaining a steady victim posting cadence. The group's site uses a minimal design with victim names listed in sequential order, each linking to a page containing sample data and contact instructions. 8Base targets small to medium enterprises, with a focus on professional services, retail, and hospitality. The group's leak site has remained consistently accessible despite periodic law enforcement interest.
Trends Shaping Ransomware Leak Sites in 2025
The operational patterns visible across active ransomware leak sites in 2025 reveal several strategic shifts that threat intelligence teams must account for when conducting dark web investigations and exposure assessments.
Multi-Channel Extortion Pressure
Leak sites are no longer the sole channel for data publication. Most groups now combine leak site postings with Telegram channel broadcasts, direct email notifications to journalists and regulators, and automated social media posts. This multi-channel approach amplifies pressure on victims and complicates takedown efforts. DarkThreat.AI's monitoring infrastructure tracks these cross-platform signals to provide complete visibility into extortion campaigns targeting client organizations.
Data Enrichment and Searchability
Groups are investing in leak site features that improve data discoverability, including full-text search, category filters, and automated data classification. These features increase the value of stolen data to other cybercriminals and make it easier for journalists, researchers, and competitors to locate sensitive information. The trend toward richer leak site functionality represents a maturation of the extortion business model.
- Automated Data Tagging: Groups like Qilin and Akira use automated classifiers to tag victim data by type, sensitivity level, and industry relevance, making their leak sites more useful as data marketplaces.
- Search Engine Optimization: Some groups have begun leaking data indexed by mainstream search engines through clever use of redirects and cached pages, extending the reach of their publications beyond the dark web.
- API Access: Advanced operations now offer API endpoints for querying victim data programmatically, enabling automated monitoring and analysis by downstream threat actors.
Resilience and Redundancy
The operational security of leak site infrastructure has improved dramatically. Groups deploy multiple fallback domains, use decentralized hosting on platforms like IPFS, and maintain offline backup posting mechanisms through Telegram and forum mirror threads. Law enforcement takedowns that once disrupted operations for months now result in downtime measured in hours or days.
According to Chainalysis's 2025 Crypto Crime Report, ransomware-related cryptocurrency flows reached an estimated $1.3 billion in 2024, with leak site publication correlated with a 34% higher payment probability in cases involving data exfiltration. The financial incentive for maintaining robust leak site infrastructure continues to grow.
How Threat Intelligence Platforms Monitor Ransomware Leak Sites
For organizations seeking to operationalize intelligence from active ransomware leak sites, manual monitoring is neither scalable nor sustainable. The volume of data published across multiple groups, combined with the technical challenges of Tor-based crawling and domain volatility, requires automated threat intelligence platforms designed specifically for dark web monitoring.
Automated Victim Discovery
Platforms like DarkThreat.AI continuously crawl known and newly discovered leak site domains, extracting victim names, publication dates, data descriptions, and sample files. Automated matching engines compare extracted data against client asset inventories, supply chain lists, and branded intellectual property, generating alerts when a relevant victim posting is detected.
Domain and Infrastructure Tracking
Leak site domains change frequently as groups rotate infrastructure to evade takedown. Threat intelligence platforms maintain databases of known group domains, monitor for new domains appearing on forums and Telegram channels, and track domain resolution patterns through Tor network analysis. When a group migrates to a new domain, the platform automatically updates its monitoring targets.
- PGP Key Verification: Many groups sign their leak site postings with PGP keys to verify authenticity. Automated systems verify these signatures and alert on inconsistencies that may indicate imposter sites or law enforcement infiltration.
- Content Change Detection: Platforms detect structural changes to leak site pages, including new victim sections, updated countdown timers, and modified ransom messages, providing early warning of active extortion campaigns.
- Cross-Platform Correlation: Intelligence platforms correlate leak site postings with forum discussions, Telegram broadcasts, and ransomware negotiation chats to build a complete picture of the extortion campaign lifecycle.
Integration with Incident Response
When a client organization appears on a ransomware leak site, speed is critical. DarkThreat.AI's platform integrates directly with incident response workflows, providing immediate notifications, evidence packages for law enforcement reporting, and automated data exposure assessments that help organizations comply with breach notification requirements under GDPR, HIPAA, and state privacy laws.
The Operational Security of Leak Sites
Understanding how ransomware groups protect their leak site infrastructure provides valuable insight for takedown planning and intelligence collection. The operational security measures deployed in 2025 reflect lessons learned from multiple law enforcement operations that have successfully seized or disrupted leak sites in previous years.
Distributed Hosting and CDN Evasion
Most active leak sites now operate behind multiple layers of infrastructure designed to obscure the true hosting location. Groups use combinations of Tor hidden services, IPFS gateways, and bulletproof hosting providers in jurisdictions with limited law enforcement cooperation. Some groups have begun experimenting with blockchain-based hosting for static data dumps, creating permanent records that cannot be taken down by any single authority.
Authentication and Access Controls
While leak sites must remain publicly accessible to maximize extortion pressure, many groups implement authentication requirements for certain features. Advanced search, full data downloads, and API access may require credentials verified through forum vouches or cryptocurrency payments. These access controls help groups monitor who is accessing their data and identify law enforcement or security researchers.
The MITRE ATT&CK framework includes data publication as part of the Impact tactic, specifically under T1485 (Data Destruction) and T1564 (Hide Artifacts). However, leak site publication also maps to Exfiltration Over Alternative Protocol (T1048) and External Defacement (T1491). Modern threat intelligence platforms map leak site activity against the MITRE framework to help SOC teams understand the full kill chain.
Counter-OPSEC for Researchers
Ransomware groups actively monitor for security researchers and law enforcement accessing their leak sites. Some groups deploy JavaScript-based fingerprinting, Tor exit node blocklists, and browser feature detection to identify and block automated crawlers. Groups have also been known to plant misleading data or fake victim entries specifically to identify and expose researchers who publish findings based on their leaks. Threat intelligence platforms must employ countermeasures including rotating Tor circuits, browser profile randomization, and decoy traffic generation to maintain effective monitoring without being detected or blocked.
Implications for Cybersecurity Teams
The proliferation and professionalization of active ransomware leak sites in 2025 carry direct implications for how organizations structure their threat intelligence, incident response, and third-party risk management programs.
Third-Party and Supply Chain Risk
Leak sites increasingly expose data from smaller vendors and service providers that serve larger enterprise clients. A single compromised MSP can lead to dozens of victim organizations appearing on leak sites simultaneously. Organizations must extend their monitoring coverage to include their supply chain ecosystem, not just their own digital assets.
Regulatory and Legal Obligations
Appearance on a ransomware leak site triggers data breach notification obligations under multiple regulatory frameworks. Organizations must have pre-established workflows for verifying leak site postings, assessing data sensitivity, and notifying affected parties within statutory timelines. Failure to monitor leak sites proactively can result in regulatory penalties for delayed disclosure.
- Notification Timelines: GDPR requires notification within 72 hours of becoming aware of a breach. Leak site publication constitutes awareness, making continuous monitoring a compliance requirement rather than a security best practice.
- Evidence Preservation: Leak site postings must be preserved as evidence for law enforcement investigations. Automated archiving and chain-of-custody tracking are essential for maintaining evidentiary value.
- Public Relations Preparedness: Organizations discovered on leak sites must have crisis communication plans ready, including internal notification protocols, customer communication templates, and media response strategies.
Conclusion
The landscape of active ransomware leak sites in 2025 reflects a mature, resilient, and increasingly sophisticated extortion economy. The 15 groups detailed in this article represent the most persistent and impactful operations currently posting victim data on the dark web, but the list is neither static nor exhaustive. New groups emerge, existing groups evolve, and infrastructure shifts on a daily basis. For cybersecurity professionals, maintaining accurate, real-time visibility into which leak sites are active and what data they are publishing is a foundational requirement for effective threat intelligence and incident response.
DarkThreat.AI provides the continuous, automated dark web monitoring infrastructure needed to track active ransomware leak sites in 2025 and beyond. Our platform delivers real-time alerts when client organizations, partners, or supply chain entities appear on leak sites, along with the contextual intelligence needed to respond effectively. In a threat landscape where data publication can occur within hours of exfiltration, waiting for manual discovery is no longer a viable strategy. Organizations that invest in proactive leak site monitoring gain critical hours — sometimes days — of response advantage over those that rely on reactive detection. The ransomware economy will continue to evolve, but the value of early warning against the most active ransomware leak sites in 2025 remains constant.
