Connecting to feeds

Global Threat Board

Live ransomware activity around the world, and the software flaws attackers are exploiting right now. Then the tools to clean an infected machine — all checked, all from the vendor direct.

—Attack Claims

—Countries Hit

—Active Groups

—Exploited Flaws

—Used In Ransomware

Where it is happening

Attack claims by country

Equirectangular · marker area ∝ claim count

Loading…

Statistics

Derived from the same claims as everything above — moves with the range tabs

Loading…

Sectors targeted

Victim sector, where disclosed

Loading…

Claims per hour

Rolling window, UTC

Loading…

Who these groups are

Profiles for the groups currently claiming victims

Aliases, first seen, tooling and MITRE ATT&CK tactics — for the groups on the board above

Loading…

Exploited in the wild right now

Latest additions to the CISA Known Exploited Vulnerabilities catalogue

If you run any of this software, patching it is urgent — these are confirmed under active attack

Loading…

Malware removal tools

Every link checked · vendor pages only, never a direct download

Read this first

Only ever download from the vendor's own site. Search results for "free virus removal" are a well-known malware delivery route. Every link below goes to the official page — not to a direct installer, because those move and get mirrored by others.
On-demand scanners are safe to stack; real-time antivirus is not. The scanners in the first group run once and exit, so you can use several for a second opinion. Never install two always-on antivirus products together.
If the machine is badly infected, scan it from outside. Malware with kernel access can hide from any tool running inside the infected Windows. That is what the rescue media group is for.
Back up your files before running an aggressive remover — on a drive you then unplug. Removal can break a system that was limping along, and ransomware can encrypt an attached backup.
Never pay a ransom before checking No More Ransom. A free decryptor already exists for many strains. Paying funds the next attack and often gets you nothing.
Tools deliberately not listed here: ComboFix (long obsolete and can break modern Windows), anything marketed as a "registry cleaner" (does not remove malware), and Kaspersky's TDSSKiller — discontinued, and its signed driver has been abused by ransomware crews to switch off security software.

1 · Free on-demand scanners

Start here. Each runs once, checks the machine and exits, so several can be used together for a second opinion without conflicting with the antivirus you already have.

Malwarebytes Free The standard second opinion. Strong on the adware, PUPs and browser hijacks that traditional antivirus tends to wave through. Free scan & removeWindows · macOS ESET Online Scanner A full one-off scan with ESET's engine, nothing left installed afterwards. Consistently one of the better detection rates. FreeWindows Kaspersky Virus Removal Tool Portable single-file scanner, no installation. Useful when you cannot install anything on the machine. FreeWindows Microsoft Safety Scanner Microsoft's own on-demand scanner. Note it expires ten days after download — fetch a fresh copy each time you need it. FreeWindows Emsisoft Emergency Kit Runs straight from a USB stick, so it is worth keeping one prepared before you need it. Free for personal use. Free (personal)Windows · Portable Dr.Web CureIt! Another portable one-shot scanner with a good record on stubborn infections. Free for home use. Free (home)Windows AdwCleaner Specialist for adware, toolbars, hijacked search engines and bundled junk. Fast, and often the only tool needed for pop-up problems. FreeWindows Trend Micro HouseCall Long-running free on-demand scanner. A reasonable extra opinion when two tools disagree. FreeWindows · macOS HitmanPro (Sophos) Checks findings against several engines at once, which cuts false positives. Sophos now publishes the old Scan & Clean tool here too. Free scan, paid removalWindows

2 · Bootable rescue media

For when Windows will not start, a scanner is being killed as it launches, or a rootkit is suspected. These boot the machine from a USB stick and scan the drive while the infection is not running — the only reliable way to deal with malware that has kernel access. Prepare them on a clean computer.

Microsoft Defender Offline Already on every Windows machine — Windows Security → Scan options → Microsoft Defender Antivirus (offline scan). Reboots into a clean environment. Try this first; it costs nothing and needs no USB stick. Free · built inWindows Kaspersky Rescue Disk Mature bootable Linux scanner that can also read and copy your files off a machine that no longer boots. FreeBootable USB ESET SysRescue Live ESET's engine on bootable media, from their tools and utilities page. FreeBootable USB Dr.Web LiveDisk Bootable rescue environment with a decent record on boot-sector and ransomware damage. FreeBootable USB

3 · Hit by ransomware

Identify the strain before doing anything else — free decryptors exist for a great many of them, and law enforcement releases new keys regularly. Keep the encrypted files even if no decryptor exists today; one may appear later. Do not reformat in a hurry.

No More Ransom Start here. The Europol-backed project: upload two sample files, it identifies the strain and points you at a free decryptor if one exists. The largest collection there is. FreeEuropol · Web ID Ransomware Identifies the strain from the ransom note or an encrypted file, and recognises more families than anything else. Identification only — it does not decrypt. FreeWeb Emsisoft Decryptors A large, actively maintained set of free per-family decryptors. Read each tool's notes before running it. FreeWindows Kaspersky NoRansom Kaspersky's free decryptor collection, covering families the others sometimes miss. FreeWindows Avast Decryption Tools Another free per-family decryptor set. Worth checking if the others draw a blank. FreeWindows

4 · Technician tools

These diagnose and expose; they do not clean up after themselves, and a wrong move can leave a machine unbootable. Included for completeness — if you are not confident reading their output, stop here and get help rather than guessing.

RKill Terminates malware processes so a real scanner can actually start. It removes nothing and the infection returns on reboot — run your scanner before restarting. FreeExpert Autoruns Microsoft Sysinternals. Shows every single thing configured to start automatically, which is where persistence hides. Can check entries against VirusTotal. Free · MicrosoftExpert Process Explorer Task Manager with the lid off — parent processes, loaded DLLs, signatures, and a VirusTotal lookup on everything running. Free · MicrosoftExpert Farbar Recovery Scan Tool Produces the detailed diagnostic log that malware-removal forums ask for. Its fix mode acts on a script you supply and will destroy a system if that script is wrong. FreeExpert · risk of data loss VirusTotal Check a suspicious file or link against seventy-odd engines before you open it. Remember anything uploaded is shared with the security industry, so never upload confidential documents. FreeWeb · Google Sysinternals Suite The whole Microsoft toolkit, including TCPView for live network connections and Process Monitor for file and registry activity. Free · MicrosoftExpert

5 · Leave one of these running

Once the machine is clean, one always-on product — and only one. Windows' own is genuinely competent now and needs no licence, no renewal and no upselling.

Windows Security Already installed, already updating, and it scores well in independent testing. For most people this plus good habits is the right answer. Free · built inWindows Bitdefender Antivirus Free Light on resources with a strong detection record, if you would rather not rely on Microsoft's. Free tierWindows Avast One Essential Capable free tier. Expect a fair amount of prompting to upgrade, and check the privacy settings after install. Free tierWindows · macOS

Think you have picked something up?

If a machine is behaving oddly, showing pop-ups, running hot, or you have opened something you wish you hadn't — I clean infections properly and recover data where it is recoverable. Based in Taunton, Somerset, remote or in person.

Get it looked at

Attack data from ransomware.live, which aggregates public ransomware leak-site postings. Vulnerability data from the CISA Known Exploited Vulnerabilities catalogue (public domain).

Counts only. Attack claims are made by the attackers themselves on their own leak sites and are not independently verified, so this page reports totals by country, group and sector and deliberately does not name any organisation. Figures describe what has been published in the feed window, not every attack that occurred.