Loading threat actor…
L Group is a ransomware threat actor observed in 2026 conducting victim-claim activity on public extortion infrastructure. The group emerged in weekly ransomware tracking as a comparatively active operator, including a period in which it was listed among the most active groups with 27 claimed victims before dropping out of the following week’s top rankings. Reported victimology includes organizations in the United States and the professional services sector. Available reporting supports classifying L Group as a financially motivated cybercriminal actor engaged in ransomware and associated extortion activity. Its known behavior includes claiming compromises of victim organizations and publicly associating those incidents with ransomware attacks and data breaches, indicating use of leak-site style pressure and data-theft extortion. High-confidence attribution beyond that, including specific malware lineage, affiliate structure, or national sponsorship, is not currently available.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting a ransomware attack against compendiumusa.net, a U.S.-based organization in the professional services sector.
Mentioned only as a comparison to the prior week's ranking; absent from this week's top 10.
Ransomware group newly prominent in the weekly rankings with a notable number of claimed victims.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.