Criminal Ransomware Groups (No State Nexus Established)
Non-state: Russian-speaking ransomware groups (DarkSide, Conti, ALPHV/BlackCat); public assessments do not establish state sponsorship
- State organ
- None named
- MITRE ATT&CK groups
- G0102
- Attribution basis
- Government advisories and law-enforcement actions naming the criminal groups.
Mission Type
Financial extortion through ransomware, sometimes with severe effects on public services
Primary Sectors
Operational Period
2020 – present
Attributed Cases
3
Attributed Cases
Activity Timeline
Attribution Basis
How firmly each operation is tied to this actor, and by whom. Confidence reflects the weight of public evidence, not intelligence-community ground truth (see methodology §08).
Attributed by US Government, Academic/Private Sector · Consequences: Law-Enforcement Action, Public Naming
Attributed by US Government, Academic/Private Sector · Consequences: Public Naming
Attributed by US Government, Academic/Private Sector · Consequences: Public Naming
TTP Pattern Summary
Ransomware-as-a-service operations: initial access through stolen credentials or affiliates, data theft, then encryption and extortion.
Behavioural Signature
Profit-driven, but the choice of targets (a fuel pipeline, a national government, a health-claims clearinghouse) produced effects comparable to state operations.
Governance Footprint
Responses were regulatory and law-enforcement measures rather than state attribution: TSA pipeline directives, a US reward offer for Conti leaders, cryptocurrency seizure, and healthcare security measures.