Makop Ransomware Operations is a threat campaign tracked across 1 threat cluster and 1 intelligence report mention on ThreatCluster. First observed December 16, 2025; most recent activity December 16, 2025.
Makop Ransomware Operations is an active ransomware threat campaign identified by researchers as an ongoing operation with a broad victim set. Recent findings show a pronounced geographic footprint, with India accounting for the majority of observed victims (about 55%), highlighting a regional targeting pattern and significant impact on Indian organizations. The report underscores Makop's persistence as a notable cybersecurity risk in 2025.
Acronis Research reveals that India accounts for 55% of victims targeted by the Makop ransomware group. This shift in tactics involves the use of a loader, which helps attackers evade detection by security tools, making…