The internet never stops shaking.
Tremor is a seismograph for cybercrime. Every mark below is a real, sourced record from the last seven days: ransomware claims, flaws under active exploitation, crypto heists and the headlines that follow. Nothing here is simulated.
Seven days on the drum
One row per day, in UTC. Each pen is a sensor. A spike is a record arriving, and a taller spike is a heavier one. Point at a spike to read it. Press a pen to lift it off the paper.
Where it hit
Home countries of the organizations named in ransomware claims. Rings grow with the number of claims. This shows victims, not where the attackers sit.
The wire
Everything the sensors picked up, newest first.
Who is claiming, and against whom
Ransomware groups ranked by the victims they have claimed, and the industries those victims work in.
Most active groups
Industries hit most
Flaws under attack right now
The newest entries in CISA's Known Exploited Vulnerabilities catalog. Every flaw on it has been used in real attacks.
| Added | CVE | Product | Flaw | Ransomware use | Fix by |
|---|
Crypto heists
Hacks and exploits against exchanges, bridges and protocols, as logged by DefiLlama.
| Date | Target | Lost | Chain | How |
|---|
Background noise
What scanners and botnets are doing while you read this.
Ports under the heaviest probing
Addresses sending the most probes
The great quakes
Sixteen incidents that moved the ground. Magnitudes here are our own ranking of impact, not a measurement.
How this works
A small server function asks each source for its latest data every five minutes and passes it to this page untouched apart from trimming. If a source is down, its pen goes quiet and the panel says so. Nothing is filled in.
The activity index is 2.5 + 1.5 × log10(1 + E). E adds up the last 24 hours: 3 for each ransomware claim, 5 for each flaw added to CISA's catalog, and 4 or more for each crypto heist depending on its size. Headlines are drawn on the drum but do not count. It compares one day with another. It is not a scientific measure.
A ransomware claim is a criminal group's own announcement, indexed by ransomware.live. A listing is not proof that an organization was breached. Records that carry a date but no time are drawn at midnight or noon UTC.
Sensors
- Waiting for the first reading.
Map outlines from Natural Earth. SANS ISC data is shared under CC BY-NC-SA.