Groove
- First seen
- 2021-08-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Profile updated
- 2026-07-07 13:46:54
Targeted industries: financial-services government-and-public-sector
Targeted regions: country_code:us
Context
Groove was a short-lived ransomware group and cybercrime gang that emerged in August 2021 and became notable for its aggressive, publicity-driven tactics. Unlike traditional Ransomware-as-a-Service (RaaS) groups, Groove functioned more as a loose criminal collective, encouraging other threat actors to join forces in attacking U.S. entities, particularly in the government and financial sectors. The group ran a Tor-based leak site where it published stolen data, but its operators claimed to focus more on building an “underground alliance” than on ransomware deployment itself. Analysts noted overlaps between Groove and actors behind Babuk and BlackMatter, as well as forum personas known for data theft operations. By early 2022, Groove’s activity had largely ceased, with some experts suggesting the group was either a short-term recruitment campaign or a misinformation effort.
Reports & references
- McAfee — How Groove Gang Is Shaking Up The Ransomware As A Service Market To Empower Affiliates (report)
- intel471.com — Groove Gang Ransomware Babuk Revil Blackmatter (report)
- ransomlook.io — Groove (report)