---
title: "Ransomware groups"
method: GET
path: "/ransomware/groups"
tags: ["ransomware"]
---

# Ransomware groups

`GET /ransomware/groups`

Every known group with its victim total (ransomware.live, cached by the
sync job), sorted by victim count descending, or with `sort=activity` by
claims posted on its leak site in the last 30 days. When the claim history
is cached, each group also carries `claims30d`, `claimsPrev30d` (the 30
days before), `lastClaimAt` and `firstClaimAt` (RFC 3339, null without a
dated claim), and `activity` gives the window: `{computedAt, dataAt,
windowDays, windowClaims, previousWindowClaims, activeGroups}` (null
otherwise). Duplicate postings of one victim on one day count once.
`total` is the number of groups known, `limit` the effective page size.
Costs one request of the monthly quota.

## Query parameters

- `limit` integer
- `sort` string

## Response `200`

`{"groups": [{"name", "victimCount", "claims30d", "claimsPrev30d", "lastClaimAt", "firstClaimAt"}], "total", "limit", "activity"}`

- object

## Other responses

- `401` — Unauthorized - Missing or invalid API key
- `429` — Too many requests - Rate limit exceeded
- `503` — No group data cached yet

## Changes

- **2026-09-27** `fe46a64acc79` — 1 info
  - added the new optional `query` request parameter `sort`
- **2026-09-23** `edb544398108` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/ransomware/groups/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) · [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/fe46a64acc79?raw)