Officially wanted, indicted, or sanctioned ransomware principals and the supporting ecosystem selected for tracking. The first section covers operators, group leadership, and deployment affiliates (direct actors); the remaining sections cover function-specific support roles (access, laundering, hosting, facilitation). Photographs are drawn from official wanted pages where available and auto-load from the source; sanctions-only designations frequently carry no official photo. Confidence labels reflect the strength of public-source attribution. Not for operational use; verify against primary sources before action.