Key Takeaways
- CrowdStrike tracked 281 organized hacker groups at the end of 2025, up from more than 170 in 2021.
- That is a roughly 65% increase in four years, with 21 to 34 new groups named annually.
- These are groups, not individuals – one entry can mean three people or several hundred.
The Story Behind the Numbers
Nobody knows how many hackers there are in the world. Criminals do not register, and the word covers everyone from a lone scammer to a government spy. But we can count the organized groups behind serious attacks.
Cybersecurity firm CrowdStrike keeps a running catalog of them. At the end of 2021 it tracked more than 170. By the end of 2025, that number reached 281 – roughly a 65% increase in four years. The growth has been steady: 21 new groups named in 2021, 33 in 2022, 34 in 2023, 25 in 2024 and 24 in 2025.
These are groups, not people. One entry might be a three-person ransomware crew or a government unit with hundreds of staff. CrowdStrike calls them “adversaries” because the list covers state-backed spies, criminals chasing money, and hacktivists pushing a cause. Alongside them sit dozens more clusters of activity that have been spotted but not yet identified.
Why This Data Is Important
A count of groups tells you something a count of people never could: hacking is organized work, not lone individuals.
Each of the 281 entries is a team with its own tools, targets and working hours. Some rent their software to others, so one group can power attacks by dozens of less skilled people. The total has risen every year since 2021.
The number also shows the list is incomplete. Those unnamed clusters mean the true figure is higher.
The practical takeaway: if you are targeted, it is not personal. Hiding your IP address and knowing what a VPN protects are routine precautions against an industry that attacks at scale.
Looking Ahead: Future Outlook
Expect the catalog to keep growing at roughly 25 new groups a year. The bigger change is AI. Activity from groups using AI tools rose 89% in 2025. Attacks are speeding up too: what once took 98 minutes to spread across a network now takes 29. As the pace picks up, the practical question shifts from whether you can spot an attack in progress to how much you were exposing in the first place.
Source & Methodology
Figures come from the CrowdStrike 2026 Global Threat Report and earlier editions in the same annual series. CrowdStrike counts named adversary groups, not individual hackers, and only those it can attribute with confidence. Totals for 2021 and 2022 were published as approximate minimums; figures from 2023 onward are exact.