October 5, 2025
Updated: November 3, 2026
Top 10 Hacking Groups In the World in 2026
Mohammed Khalil
In 2026, a relatively small set of well-resourced actors account for many of the most damaging incidents. State aligned units, including APT29, APT28, Sandworm, APT41, and Volt Typhoon, pursue durable access. They target cloud identities, email tenants, edge devices and routers, and suppliers. Financially motivated crews, including Scattered Spider, Qilin, Akira, and Clop, monetize access through data theft and extortion.
Looking for fictional portrayals instead? See our list of the top 50 cybersecurity and hacking movies.
Top risks: cloud token theft, OAuth abuse, password spraying at scale, supply chain compromise, living off the land inside IT that touches OT, large volume exfiltration before any encryption.
Top groups to track: Volt Typhoon for disruption risk, Lazarus for high value theft, APT29 and APT28 for cloud and email tradecraft, Sandworm for OT adjacent operations, Scattered Spider and leading ransomware brands for extortion pressure.
Top controls: phishing resistant MFA for all admin and service accounts, strict OAuth consent and app governance, rapid edge patching, vendor access gates with SBOM and key handling rules, protected and tested backups for critical apps, and rehearsed incident playbooks.
Measure progress with admin FIDO coverage, OAuth risk score, edge patch velocity, and mean time to contain.
If you are trying to understand who actually drives today's cyber incidents, you need to look at a small set of prolific threat groups that keep evolving. In 2026, the picture is clear. Russia- and China-aligned espionage units focus on cloud identities, critical infrastructure, edge devices, and supply chains. North Korea's Lazarus doubles down on high value crypto heists to fund the regime. Financially motivated collectives like Scattered Spider and RaaS crews such as Qilin, Akira, and Clop continue to pressure enterprises through extortion and data theft. For UK organizations, this guide gives a current, source-backed view of the top 10 hacking groups in 2026, what they did recently, how they operate, and the defenses that actually help. Key takeaways include identity-first hardening for cloud workloads, strict third-party risk controls, and prepared incident playbooks for extortion-driven attacks. Claims are checked against government advisories, court and law-enforcement announcements, and vendor threat-intel reports, so you can brief your leadership and tune controls with confidence.
Security leaders, IT, SecOps, OT owners, and procurement can use these profiles to brief leadership, prioritize identity first controls, and tune detections. Start with MFA coverage for admins and service accounts, OAuth governance, and edge patch velocity. Close with tabletop exercises and sector specific controls.
We include APTs, ransomware crews, and mixed motive actors. Ranking blends impact, recency, repeatability, and cross sector reach. The list is compiled from named third-party public reporting: government advisories, law-enforcement and court announcements, and vendor threat-intelligence and incident-response reports, each linked in the profile it supports. It reflects reporting available as of November 2, 2026. Examples include CISA and Five Eyes guidance on China-nexus actors, such as the August 2025 joint advisory on Salt Typhoon-linked network intrusions and the April 2026 advisory on covert router networks used by Volt Typhoon, plus joint advisories on Russian GRU activity.
We weigh four factors. Impact, recency, repeatability, and cross sector reach. Novel tradecraft earns weight, for example stealthy router botnets and living off the land operations in infrastructure pre-positioning. We adjust for visibility bias since some victims disclose more than others.
Who they are
APT29, also called Midnight Blizzard or Nobelium, is Russia’s SVR-linked espionage actor that targets governments, NGOs, and tech providers. They have a long track record of cloud provider and MSP compromises that let them pivot into downstream tenants. Microsoft
What they did in 2025-2026
After Microsoft disclosed in 2024 that the group had breached its corporate email and was using exfiltrated secrets to try to gain further access, Reuters, APT29 kept refining initial access. Check Point tracked a 2025 campaign against European diplomats that impersonated a European foreign ministry and used wine-tasting invitations to deliver the GRAPELOADER backdoor, Check Point. In August 2025 Amazon disrupted an APT29 watering-hole campaign that sent visitors to fake Cloudflare pages to trick them into authorizing attacker devices through Microsoft device code authentication, Amazon.
Key TTPs to watch
Password spraying of legacy or service accounts, OAuth abuse, device code phishing, residential proxies, and spear-phish with RDP or LNK lures. NCSC and CISA note direct targeting of cloud identities. NCSC
How to defend
Mandate phishing-resistant MFA for admins and service accounts, restrict OAuth app consent, disable the device code flow where it is not needed, and monitor token issuance and new device authorizations for anomalies. Review any supplier email threads that contain secrets.
Sandworm, APT44
Who they are
Sandworm is a GRU unit associated with disruptive operations against Ukraine and European infrastructure, including ICS targets. Google Cloud
What they did in 2025-2026
In February 2025 Microsoft exposed a Sandworm (Seashell Blizzard) subgroup running a multiyear "BadPilot" initial access operation, Microsoft. Separate research shows Sandworm using trojanized KMS activation tools to spy on Ukrainian targets. In late December 2025 a DynoWiper attack on Poland's energy sector caused no disruption that ESET is aware of; ESET attributes it to Sandworm with medium confidence, ESET.
Key TTPs to watch
Supply-chain compromise, wipers, and abuse of cracked software in target environments. Prepare for OT pivot risk. EclecticIQ Blog
How to defend
Control unlicensed software, segment OT from IT, and simulate ICS failover. Validate backups can restore ICS historian and HMI servers quickly.
Lazarus Group
Who they are
North Korea's premier threat actor mixes espionage with large-scale theft. Since 2025 its focus has included record crypto exchange heists, largely through the TraderTraitor cluster, and developer-focused supply-chain attacks.
What they did in 2025-2026
Chainalysis puts total crypto theft in 2025 at over $3.4 billion, with North Korean hackers stealing at least $2.02 billion, a record, Chainalysis. The largest single theft of 2025, and the largest on record until October 2026, was about $1.5 billion from Bybit on February 21, 2025, which the FBI attributed to North Korea's TraderTraitor, FBI. The pace continued in 2026: Chainalysis says a $387 million theft from Bitget on September 24, 2026 pushed North Korea-attributed theft for the year past $1 billion, Chainalysis. On October 29, 2026, about $6.4 billion was drained from Binance hot wallets, the largest crypto theft on record. In a preliminary assessment based on on-chain activity, published October 30, 2026, Chainalysis attributed it to TraderTraitor, the North Korean cluster tied to Lazarus, and reported that about $2.8 billion had been frozen, Chainalysis. Kaspersky also detailed Operation SyncHole, a Lazarus watering-hole and software-exploit campaign that hit at least six South Korean organizations between November 2024 and February 2025, Kaspersky.
Key TTPs to watch
Malicious npm packages, credential theft, social engineering of devs, and exploitation of zero-days in local software.
How to defend
Lock down developer package sources, enforce hardware keys for crypto systems, and monitor for unusual Git or CI activity that touches secrets.
Volt-Typhoon
Who they are
A PRC-aligned group pre-positioning in US critical infrastructure. Agencies warn this is not typical espionage, it aims to enable disruption during crises. CISA
What they did in 2025-2026
Volt Typhoon remains the reference case for pre-positioning. In April 2026 the UK NCSC, CISA, the FBI, NSA, and agencies from eight other countries warned that most China-nexus actors now operate through covert networks of compromised routers and IoT devices, noting that Volt Typhoon's KV Botnet was built mainly from end-of-life Cisco and Netgear routers and used to pre-position on critical infrastructure, CISA. A separate August 2025 joint advisory covered Salt Typhoon-linked actors compromising telecom and network backbone routers worldwide, CISA. Analysts continue to highlight living-off-the-land tradecraft, stealthy router botnets, and long dwell time.
Key TTPs to watch
LotL commands through native admin tools, legacy router exploitation, and credentialed lateral movement in IT networks that touch OT. CISA
How to defend
Eliminate end-of-life network devices, rotate device creds, enable deep command telemetry, and rehearse manual operations for OT. DFPI
Expert note: In March 2025 written testimony to the House Homeland Security Committee, Rush Doshi quoted then-Deputy National Security Adviser Anne Neuberger, who described the Volt Typhoon shift away from data theft as "countries pre-positioning in the critical infrastructure of another country," access that could be used to pressure a government during a crisis. Council on Foreign Relations
APT41, Wicked Panda
Who they are
A long-running China-linked collective that blends state espionage and cybercrime. It targets many sectors and is known for supply-chain and custom malware operations. IBM In September 2020 the US Justice Department announced charges against five Chinese nationals tied to APT41 intrusions against more than 100 victims; they were described as fugitives in China. U.S. Department of Justice
What they did in 2025
In May 2025 Google's threat team detailed TOUGHPROGRESS, APT41 malware that used Google Calendar for command and control, Google Cloud. Proofpoint tracked July and August 2025 spear-phishing by TA415, which overlaps with APT41, against US government, think tank, and academic experts on US-China trade, using VS Code Remote Tunnels for access, Proofpoint. Kaspersky linked APT41 activity to an intrusion at government IT services in southern Africa, Kaspersky.
Key TTPs to watch
Spear-phishing with policy lures, web app exploits, abuse of cloud services for command and control, ShadowPad ecosystem tools. Dark Reading
How to defend
Harden public apps, isolate management interfaces, and require step-up auth for admins. Google Cloud
APT28, Fancy Bear
Who they are
Russia’s GRU-linked intrusion set. It has targeted European logistics and IT firms since 2022 with recurring 2025 activity. CERT-EU
What they did in 2025-2026
A May 2025 joint advisory calls out APT28's campaign against Western logistics and technology companies, U.S. Department of War. CERT-FR and CERT-EU flagged ongoing targeting of French government entities, CERT-EU. In early 2026 CERT-UA reported APT28 exploiting the Microsoft Office flaw CVE-2026-21509 against Ukraine and EU countries, CERT-UA, and in April 2026 the UK NCSC and FBI exposed APT28 hijacking vulnerable TP-Link and MikroTik routers to run DNS hijacking and steal email and web credentials, NCSC.
Key TTPs to watch
Spear-phishing with government-themed lures, fast weaponization of Office flaws, Outlook backdoors, SOHO router compromise for DNS hijacking, and LAMEHUG, malware that queries an LLM to generate commands, which CERT-UA linked to APT28 with medium confidence in July 2025. BleepingComputer
How to defend
Block third-party OAuth grants by default, inspect email auth, and hunt for unusual mail rule creation. U.S. Department of War
Scattered Spider, Octo Tempest
Who they are
A financially motivated group known for elite social engineering, SIM swaps, and RaaS partnerships. Targets include telcos, airlines, retail, insurance, and finance. MITRE ATT&CK
What they did in 2025-2026
Microsoft documented attacks on retail, food services, hospitality, insurance, and then airlines between April and July 2025, using AiTM phishing, help-desk impersonation, and DragonForce ransomware aimed at VMware ESX hypervisors, Microsoft. CISA and partners updated their Scattered Spider advisory in July 2025. Law enforcement then hit core members. UK police arrested Thalha Jubair and Owen Flowers in September 2025, and the US Justice Department unsealed a complaint alleging Jubair took part in at least 120 network intrusions whose victims paid at least $115 million in ransom, U.S. Department of Justice. In July 2026 both were sentenced in the UK to five years and six months for the 2024 Transport for London attack, and the NCA said the arrests effectively halted the group's criminal activity, National Crime Agency. Others may still use the brand and its playbook.
Key TTPs to watch
Help-desk pretexting, MFA fatigue, SSO session theft, ESXi impact. CSO Online
How to defend
Adopt number-matching or FIDO2 for admins, block legacy voice or SMS MFA for high-risk roles, and train help-desk staff on strict identity proofing. CISA
Who they are
Qilin is a ransomware-as-a-service brand with visible victim postings and aggressive extortion that took over much of the market RansomHub left behind. RansomHub had been one of the most prolific operations of 2024, with CISA counting at least 210 victims between February and August 2024, CISA. Its infrastructure went dark on April 1, 2025, and researchers saw signs that its affiliates migrated to Qilin, Group-IB.
What they did in 2025-2026
CIS ranked Qilin the top ransomware threat to US state, local, tribal, and territorial governments in Q2 2025, CIS. It kept the top spot in Q1 2026 with 353 claimed attacks, ahead of The Gentlemen (202) and Akira (201), Comparitech.
Key TTPs to watch
Data theft first, then selective encryption. Steady use of bought access and affiliates.
How to defend
Patch edge devices, monitor for exfiltration channels, and stage clean rebuilds for core apps.
Who they are
A prominent ransomware operation, active since March 2023, that hits SMBs, large enterprises, and critical infrastructure across North America, Europe, and Australia. CISA
What they did in 2025-2026
In November 2025 CISA, the FBI, and partners updated their Akira advisory, reporting about $244.17 million in ransom proceeds as of late September 2025 and new payloads aimed at Nutanix AHV virtual machines, CISA. Akira ranked third by claimed attacks in Q1 2026, Comparitech. Activity includes VPN abuse, such as SonicWall access via stolen credentials or CVE-2024-40766, and dual extortion.
Key TTPs to watch
Credential reuse, targeting of NAS and ESXi, quick exfil to leak portals.
How to defend
Rotate VPN creds, enforce device certificates, and disable unmanaged legacy VPN protocols.
Who they are
Best known for mass exploitation campaigns and pure data-theft extortion. Still relevant in 2026 rankings despite law-enforcement pressure, with 122 claimed attacks in Q1 2026. Comparitech
What they did in 2025-2026
From late September 2025, an actor claiming the CL0P brand emailed executives at many organizations claiming to have stolen data from their Oracle E-Business Suite environments. Google Threat Intelligence and Mandiant found exploitation of what may be CVE-2025-61882 as a zero-day as early as August 9, 2025, before Oracle shipped emergency patches on October 4. Google has not formally attributed the activity to a tracked group but notes overlaps with FIN11. Google Cloud The playbook prioritizes mass exploitation over noisy encryption.
Key TTPs to watch
Zero-day exploitation of file transfer or edge services, large multipart exfiltration runs.
How to defend
Track vendor advisories, apply virtual patching with WAF rules, and pre-approve outage windows to patch fast.
DeepStrike's Red Teaming Services replicate the identity-first tradecraft these groups use, from OAuth abuse to help-desk pretexting.
Who is the most dangerous hacking group in 2026?
For disruption risk, Volt Typhoon worries defenders because it pre-positions in civilian infrastructure. For theft, Lazarus leads: North Korean hackers stole at least $2.02 billion in crypto in 2025, and Chainalysis attributes the roughly $6.4 billion Binance theft of October 29, 2026 to North Korea's TraderTraitor in a preliminary assessment. CISA, Chainalysis
Are nation-state actors still using ransomware?
Yes, some do. In July 2024 the U.S. Justice Department charged Rim Jong Hyok, an alleged member of North Korea’s Andariel (APT45) group, over Maui ransomware attacks on U.S. hospitals and other healthcare providers, DOJ. Other state-linked groups, such as APT41, blend espionage with profit. IBM
What single control reduces most risk now?
Phishing-resistant MFA plus conditional access for all administrator roles, including third parties. CISA
Is DDoS still a serious threat in 2026?
Yes. ENISA's Threat Landscape 2025 found DDoS made up 77% of the incidents it analyzed, much of it hacktivist activity around political events, although infrastructure takedowns can slow specific groups. ENISA
Which ransomware groups should I track first?
Qilin, The Gentlemen, Akira, and Clop rank high in 2026 incident data, and DragonForce has been used in Scattered Spider intrusions. Prepare for double extortion and quick exfiltration. Comparitech
Stay secure with DeepStrike penetration testing services. Reach out for a quote or customized technical proposal today
Contact Us
