Anatomy of cyberattacker groups: who attacks, who the victims are, what motivations

We tend to talk about cyberattackers in the singular, "the hackers", "the crooks", as if they were one undifferentiated mass. The reality is the opposite: a segmented ecosystem of groups with radically different logics, targets and motivations. A ransomware cartel has nothing in common with a state intelligence unit, and even less with a hacktivist collective.

To untangle it, we drew on our own material: a representative sample of 60,000 cyber events, from which we reconstructed 13,573 incidents tied directly to a victim, and about 1,600 distinct groups.

1. Who attacks?

First surprise when ranking groups by incident volume: the top is not led by a single ransomware cartel, but by a data-extortion group, ShinyHunters, ahead of the historic cartels LockBit and Qilin.

This ranking already tells the story of the ecosystem: ransomware-as-a-service operators (LockBit, Qilin, Clop, Akira, DragonForce, Black Basta), a data-theft extortion specialist (ShinyHunters), a financially-driven North Korean state actor (Lazarus) and a hacktivist collective (Anonymous). Four different logics in a single top 10.

The ecosystem is also concentrated: the ten leading named groups alone account for 28% of attributed incidents. A handful of actors makes most of the noise, but a long tail of short-lived groups, successors and rebrands makes up the rest.

Origin, motivation, group: the geopolitical reading

Crossing attributed geographic origin, motivation and group, a strikingly readable geopolitical map emerges across the main groups with an identifiable origin:

Note: this diagram only covers the subset attributed to an origin (35% of incidents). Some top groups don't appear here for lack of confident geographic attribution, either because they are international collectives with no single country (ShinyHunters, Anonymous), or because their origin is still debated (DragonForce). That takes nothing away from their attack volume, visible in the ranking above.

Three national logics stand out clearly:

• Russia: the widest branch, and the most diverse. Mostly financial (the sprawling ransomware ecosystem, from LockBit and Clop to Conti, REvil and Black Basta), with a pro-Russian hacktivist fringe (NoName057, Killnet) and a sliver of state sabotage (Sandworm).
• North Korea (KP): an almost purely financial profile carried by Lazarus, plus an espionage strand (Kimsuky). The only state whose major cyber activity aims to generate revenue.
• China (CN): an unambiguous espionage profile (Mustang Panda), with no financial dimension.

Financial cybercrime is overwhelmingly Russian-speaking, intelligence is Chinese and North Korean, and sabotage remains a rare state signature.

2. Who are the victims?

On the target side, the geography is unambiguous: the United States concentrates around 35% of geolocated incidents, far ahead of a European cluster (United Kingdom, Italy, France, Germany) and a few large countries (India, Canada, Australia).

France sits in that leading European cluster, around 4% of geolocated incidents, consistent with our dedicated analysis on France's place among the most cyberattacked countries.

But country isn't everything: the victim's sector is at least as strong a determinant.

Technology dominates (software vendors, hosting providers, digital service firms), followed by government and the public sector, healthcare and finance. This public/health/finance trio is a constant: sensitive data, critical service continuity, and the ability (or obligation) to pay. Education and hospitality, often less mature in security, round out the picture.

3. What motivations?

When a group's motivation is identifiable, the verdict is clear-cut:

Among incidents with a known motivation, financial outweighs all the rest (ransomware and extortion), far ahead of hacktivism, espionage and sabotage. In other words: the vast majority of attacks seek neither to spy nor to destroy, but to monetize. That's good news for defenders, because a financial attacker is rational: they follow the money and back off when the cost gets too high. It's bad news for organizations that believe they have "nothing worth stealing": to a cartel, the only interesting data is your willingness to pay to get it back.

4. What's shifting: the trend

This is where many reports go wrong. They show a curve of the number of attacks per year that climbs steeply and conclude that cyberattacks are "exploding". Our raw data shows the same rise. But much of that increase comes down to our detection capabilities: today's technologies spot and identify incidents far more precisely than ten years ago, or even three years ago, and therefore surface a much larger volume. Presenting that curve as the measure of a trend would be misleading. That said, the threat is genuinely growing too: offensive tooling (ransomware-as-a-service, turnkey kits, AI) is increasingly accessible, widening the pool of attackers. A real increase exists, but it blends with the detection effect, which is why we reason in shares (%).

What is robust, because it's independent of collected volume, is the composition of attacks: the share of each type from one year to the next, over a window where our collection method stayed stable.

The shift is clear: data breach and theft progressively establish themselves as the dominant category, ahead of pure ransomware. That tracks the observed evolution of the cartels themselves: from encryption-only to double extortion (encryption + threat of disclosure), then to encryption-less extortion models, where stealing and threatening to publish is enough. The rise of ShinyHunters in our top 10 is the embodiment of that pivot.

Key takeaways

• The attacker ecosystem is segmented: financial (the vast majority), espionage, hacktivism, sabotage. Four logics not to be confused.
• The geography of attribution is readable: financial crime mostly Russian-speaking, Chinese and North Korean espionage, rare state sabotage.
• Victims are first American, then European; the tech, public, healthcare and finance sectors pay the heaviest price.
• The real trend isn't "more attacks", but a shift toward data theft and encryption-less extortion.

Read before quoting a figure

These figures come from our watch. Two acknowledged limits:

1. Attribution is partial. Only 35% of incidents are tied to a group. The "origin → motivation → group" map therefore covers only that attributed subset, and mechanically over-represents the best-documented groups.
2. Generic labels are excluded. Vague tags ("Russian hackers", "Iranian hackers") exist in the raw data but are not groups: they are removed from the rankings so as not to artificially inflate an origin.

Map percentages are computed on geolocated incidents, not on the total.

Sources

• Sample of ~60,000 major cyber events collected over 2026.
• Origin and motivation attribution: cross-referencing of open threat-intelligence sources (vendor reports, CERTs, specialist press), normalized in our actor reference.
• France focus: Why is France in the top 5 most cyberattacked countries?