October 6, 2025
Updated: November 1, 2026
Unmasking the cyber criminals redefining digital warfare
Khaled Hassan
The most dangerous hackers of 2026 are not lone geniuses in hoodies; they are organized crews and state-backed units that run like businesses, a ransomware cartel with a help desk, a teenage social-engineering gang that talks its way past IT, a nation-state unit siphoning billions in crypto, and espionage groups sitting silently inside critical infrastructure. This guide profiles the most notorious hackers and hacking groups of 2026, the record-breaking attacks they pulled off, what changed since 2025, and the defenses that actually blunt them.
Updated: November 2026. Reflects North Korea's record ~$6.3B Binance theft (October 2026), the record 2025 ransomware year (Qilin), the ShinyHunters Salesforce campaign, Lazarus's $1.5B Bybit heist, Cl0p's Oracle EBS extortion, the 2026 Scattered Spider convictions, and the September-October 2026 ShinyHunters arrests.
| Group | Type | Known for |
|---|---|---|
| Scattered Spider | Social-engineering crew | Talking past help desks; MGM, UK retail, insurers, airlines |
| ShinyHunters | Data-theft extortion | Salesforce data theft; claimed the Salesloft Drift campaign |
| Lazarus Group | North Korean state | The $1.5B Bybit heist (2025) and the ~$6.3B Binance theft (Oct 2026), per the FBI |
| Qilin | Ransomware-as-a-service | The most prolific ransomware operation of 2025 |
| Cl0p | Mass-exploitation extortion | MOVEit, Cleo, and the 2025 Oracle EBS zero-day wave |
| Salt Typhoon | Chinese espionage APT | Breaching US telecoms and wiretap systems |
| Volt Typhoon | Chinese disruption APT | Pre-positioning in US critical infrastructure |
| Predatory Sparrow | Israel-linked destructive | Burning $90M at Iran's Nobitex exchange |
The one-line theme of 2026: cybercrime is industrialized and specialized, and the line between financially-motivated gangs and state operations keeps blurring.
Looking for fictional portrayals instead? See our list of the top 50 cybersecurity and hacking movies.
Notoriety today is measured in impact and reach, not technical mystique. The groups below earn the label because they caused record financial losses, breached the systems the rest of the internet depends on, or demonstrated capabilities that redraw the threat model. Three profiles dominate: ransomware and extortion crews chasing money at scale, state-sponsored units pursuing espionage or strategic disruption, and hybrid social-engineering gangs that weaponize people rather than exploits. Understanding who they are is the first step to defending against them, which is why this sits alongside our broader threat coverage like ransomware groups.
Scattered Spider (also tracked as UNC3944, Octo Tempest) is the crew that proved you don't need zero-days when you can just call the help desk. Made up largely of English-speaking teenagers and young adults in the US and UK, it specializes in social engineering: impersonating employees to IT support, abusing MFA reset workflows, and SIM-swapping to hijack accounts, then pivoting to ransomware or extortion. The FBI and CISA document these techniques in a joint Scattered Spider advisory, and the wider pattern shows up in our social engineering statistics.
After the infamous 2023 MGM and Caesars casino breaches, the group tore through 2025, with attacks on UK retailers (Marks & Spencer, Co-op, Harrods), insurers, and airlines linked to it. Law enforcement has landed real blows: Noah Urban was sentenced to 10 years in US federal prison in August 2025, Tyler Buchanan (extradited from Spain) pleaded guilty in April 2026, and in July 2026 UK courts sentenced Thalha Jubair and Owen Flowers to five years and six months each for the 2024 Transport for London attack, which cost TfL an estimated £29 million. Jubair also faces a US indictment alleging 120 intrusions and at least $115 million in ransom payments, charges that remain unproven. Yet the wider network kept operating, partly by merging efforts with other crews under the "Scattered LAPSUS$ Hunters" banner. It is the clearest proof that the human layer, not the firewall, is the modern soft target.
ShinyHunters, an extortion brand that Google now describes as several threat clusters operating under one name, was at the center of one of the largest data-theft waves of 2025. Google tracks a voice-phishing campaign that tricked Salesforce users into authorizing malicious apps as UNC6040, and a separate August 2025 campaign that abused stolen OAuth tokens for the Salesloft Drift integration to pull data from hundreds of downstream Salesforce environments as UNC6395; the Drift intrusion traced back to access to Salesloft's GitHub account months earlier. The campaign was documented by Google Threat Intelligence, which has not formally attributed UNC6395 to ShinyHunters, but the group publicly claimed the attacks and told reporters it stole about 1.5 billion Salesforce records from 760 companies, a figure that has not been independently verified. Confirmed Drift-related victims include Cloudflare, Zscaler, Palo Alto Networks, Tenable, and Proofpoint, followed by extortion demands, and Grubhub disclosed a data theft in January 2026 that reporting tied to credentials stolen in the same campaign.
It is the defining SaaS supply-chain attack of the era: one trusted integration became a skeleton key to a thousand tenants. The lesson for defenders is that your third-party OAuth grants are attack surface, exactly the third-party risk problem, and that data-theft extortion is now as damaging as encryption-based ransomware.
Status as of November 2026: law enforcement has closed in. Dutch police arrested a 24-year-old in Amsterdam in September 2026 whom the FBI called one of the alleged leaders of ShinyHunters, a suspect known as "Rey" and described as the public face of Scattered LAPSUS$ Hunters was reportedly detained in Jordan, and on October 5 the FBI said it had worked with partners to arrest multiple subjects. None of them has been convicted, and the brand's loose structure means activity may continue.
Lazarus (with sub-clusters like TraderTraitor) is North Korea's state hacking apparatus, and its mission is to steal money to fund the regime, especially cryptocurrency. In February 2025 it pulled off what was then the largest crypto heist ever, exploiting a third-party signing weakness in Bybit's cold-wallet workflow to steal roughly $1.5 billion in Ethereum. The FBI attributed the theft to North Korean actors it tracks as TraderTraitor. That record fell in October 2026: the FBI said North Korea's TraderTraitor actors were responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29, 2026, and Binance put the impact at about $6.3 billion and said it would cover user losses from company funds. Lazarus has been behind a long string of exchange and DeFi thefts, and it launders proceeds through mixers, DeFi services, and instant-swap services at blistering speed.
Lazarus matters because it shows a nation-state running cybercrime at industrial scale for revenue, blurring the line between espionage and theft, a dynamic we track in our crypto crime coverage.
If 2025 had a ransomware king, it was Qilin. The ransomware-as-a-service operation was the most prolific ransomware group of 2025 by leak-site victim count: Searchlight Cyber counted 697 Qilin victims in the second half of 2025 alone, out of a record 7,458 leak-site victims for the year, as Qilin filled the gap left when RansomHub went dark in April 2025. Its victim list is indiscriminate: courts, school districts, healthcare practices, and manufacturers. Its September 2025 attack on Asahi Group halted production at the brewer's Japanese plants and potentially exposed personal data of about 1.5 million customers. Qilin remained one of the most active groups into 2026, even after Japanese police arrested an alleged core member, a 28-year-old Russian national, in Osaka in May 2026 and handed him to Germany.
Qilin embodies the RaaS model that dominates the ransomware economy: the operators build and rent the malware and leak site, affiliates do the breaking in, and everyone shares the payout, which lowers the skill barrier and multiplies the volume.
Cl0p perfected a different model: mass exploitation of a single zero-day for bulk extortion. Instead of encrypting one victim at a time, Cl0p finds a vulnerability in a widely-used enterprise product, exploits it across every exposed instance at once, steals data, and extorts everyone. It ran this playbook through MOVEit (2023), Cleo (2024), and the Oracle E-Business Suite zero-day (CVE-2025-61882) in 2025. Google Threat Intelligence says exploitation of Oracle EBS likely began in July 2025, weeks before extortion emails went out from an actor claiming the Cl0p brand (Google notes overlaps with FIN11), and dozens of organizations were hit, including Harvard University and The Washington Post. We covered the Oracle EBS zero-day patch when it landed. Our dedicated Cl0p ransomware profile covers the group in depth.
Cl0p is why patch cadence on internet-facing enterprise software is a survival issue: the group turns one unpatched appliance into a mass-breach event.
The two most consequential state actors of the period are China's "Typhoon" units, and they do opposite jobs. Salt Typhoon ran an espionage campaign that breached major US telecom carriers and even the lawful-intercept (wiretap) systems, the subject of a CISA joint advisory and detailed in our Salt Typhoon vs Volt Typhoon comparison. In February 2026 an FBI official called the threat still very much ongoing and estimated that Salt Typhoon intrusions had affected more than 80 countries. Volt Typhoon is not spying at all, it is pre-positioning inside energy, water, and transportation infrastructure to enable disruption in a future conflict, covered in CISA's Volt Typhoon advisory and our state-sponsored APT threats overview. Together they represent the most strategically serious hacking of the decade: one listens, the other prepares to break things.
Not all notorious hackers chase money. Predatory Sparrow (Gonjeshke Darande), a group widely assessed as Israel-linked, conducts destructive attacks against Iran. In June 2025, amid rising tensions, it disrupted Iran's state-owned Bank Sepah and then hit the crypto exchange Nobitex, stealing about $90 million and deliberately burning it by sending it to unrecoverable addresses to make a political point rather than a profit. It is a marquee example of destructive, politically-motivated hacking, the hacktivist-meets-state model that defines a growing slice of the threat landscape.
| Attack | Group | Impact |
|---|---|---|
| Binance theft (Oct 2026) | Lazarus / TraderTraitor (per FBI) | ~$6.3B in crypto stolen, the largest crypto heist on record |
| Bybit heist (Feb 2025) | Lazarus / TraderTraitor (per FBI) | ~$1.5B in Ethereum stolen, the record until 2026 |
| Salesforce / Salesloft Drift (2025) | Claimed by ShinyHunters | Hundreds of orgs hit via stolen OAuth tokens; 1.5B records claimed, unverified |
| Oracle EBS extortion (2025) | Cl0p | Dozens of organizations breached via a single zero-day |
| Nobitex (June 2025) | Predatory Sparrow | ~$90M stolen and destroyed to make a political point |
| US telecom breaches | Salt Typhoon | Carrier core networks and wiretap systems compromised |
No single control stops a list this varied, but a consistent program raises the cost for all of them.
| Control | Which threat it blunts |
|---|---|
| Phishing-resistant MFA (FIDO2/passkeys) | Scattered Spider social engineering, credential theft |
| Help-desk identity-verification hardening | Scattered Spider's help-desk and MFA-reset abuse |
| Rigorous patching of internet-facing software | Cl0p mass exploitation, APT edge-device access |
| Audit and limit third-party OAuth/SaaS grants | ShinyHunters-style SaaS supply-chain theft |
| Network segmentation (IT/OT) and monitoring | Volt Typhoon pre-positioning, ransomware lateral movement |
| Immutable backups and a tested IR plan | Qilin and all ransomware; speeds recovery |
| Dark-web and credential monitoring | Data-theft extortion and initial-access sales |
| Continuous penetration testing | Validates that all of the above actually hold |
Two priorities cut across every group on this list. First, harden identity and the help desk, phishing-resistant MFA plus strict verification defeats the social engineering that so many of these crews rely on. Second, patch and test the perimeter relentlessly, because Cl0p and the state APTs get in through exposed, unpatched software. A rehearsed incident response plan then decides how much damage any successful intrusion actually causes.
The 2026 roster makes one thing clear: you are not defending against a stereotype, you are defending against organizations, each with a specialty. A social-engineering gang, a RaaS cartel, a mass-exploitation crew, and a nation-state require overlapping but distinct defenses, and the common threads, identity, patching, third-party exposure, segmentation, and rehearsed response, are exactly where most programs have gaps. Knowing who the adversaries are is only useful if it drives you to test whether your defenses hold against how they actually operate.
DeepStrike's penetration testing emulates the real techniques these groups use, social engineering, edge-device exploitation, lateral movement, and SaaS abuse, and shows you where a Scattered Spider, a Cl0p, or a Salt Typhoon could actually get in. To scope an engagement, see our penetration testing services.
The most notorious groups of 2026 include Scattered Spider (social engineering), ShinyHunters (data-theft extortion), North Korea's Lazarus Group (crypto theft), the Qilin and Cl0p ransomware operations, China's Salt Typhoon and Volt Typhoon espionage and infrastructure units, and the Israel-linked destructive group Predatory Sparrow. They span financially-motivated crime, state espionage, and destructive politics.
Two stand out. Lazarus Group's February 2025 theft of roughly $1.5 billion in Ethereum from the Bybit exchange was the largest cryptocurrency heist on record at the time; it was surpassed in October 2026 by the roughly $6.3 billion Binance theft the FBI attributed to North Korea. In parallel, the Salesloft Drift campaign, claimed by ShinyHunters, abused stolen OAuth tokens to steal data from hundreds of organizations; the group claims 1.5 billion records from 760 companies, a figure that has not been independently verified.
Yes, though weakened. Alleged members have been arrested and charged across 2024-2026, and several have now been convicted, including two UK members sentenced to five years and six months each in July 2026 for the Transport for London attack. The wider network continued operating through 2025 and into 2026, partly by collaborating with other crews under the "Scattered LAPSUS$ Hunters" banner, which was itself hit by arrests in the Netherlands and Jordan in September and October 2026. Its reliance on social engineering rather than a fixed toolset makes it resilient to individual arrests.
Qilin was the most prolific ransomware operation of 2025 by leak-site victim count (Searchlight Cyber counted 697 Qilin victims in the second half of 2025 alone), filling the gap left by RansomHub's disappearance, and it remained one of the most active groups in 2026 even after an alleged core member was arrested in Japan in May 2026. It runs a ransomware-as-a-service model, renting its malware and infrastructure to affiliates.
Cl0p specializes in mass exploitation rather than one-victim-at-a-time attacks. It finds a zero-day in a widely-used enterprise product, MOVEit, Cleo, and Oracle E-Business Suite in successive years, exploits every exposed instance at once, steals data, and extorts all victims. This makes a single unpatched appliance a potential mass-breach event.
Both are Chinese state-sponsored groups. Salt Typhoon is an espionage operation that breached US telecom carriers and wiretap systems to intercept communications. Volt Typhoon pre-positions inside energy, water, and transportation infrastructure to enable disruptive attacks during a future conflict. Salt listens; Volt prepares to break things.
Focus on the common threads: deploy phishing-resistant MFA and harden help-desk identity verification against social engineering, patch internet-facing software fast to counter mass exploitation, audit third-party OAuth and SaaS access, segment networks, keep immutable backups with a tested incident response plan, and validate all of it with continuous penetration testing.
Stay secure with DeepStrike penetration testing services. Reach out for a quote or customized technical proposal today
Contact Us
