Actor Profile

🏹 Disinformation — Ransomware

🔄 Pivot:🏹 Disinformation

Classification

Ransomware

Leak-site victims

1
Ransomware.live

Associated IoCs

200
local intel

MITRE techniques

—
ATT&CK

Tracked

Local
PIVOT🔍 Advanced Search🕵 OSINT Pivot🔗 Link Analysis🕑 Timeline📤 Export STIX/MISP

🔥 Leak-Site Victims (1)

VictimCountryPublishedDomain
— —

Source: Ransomware.live leak-site monitoring (cached, offline-safe).

Associated Indicators (200)

IndicatorTypeThreat
i.handlers domain profile
V.xV domain profile
this.extensions domain profile
https://dfrlab.org/wp-content/uploads/si url profile
window.addEventListener domain profile
a.type domain profile
t.K7.metrics domain profile
this.binaryType domain profile
https://dfrlab.org/2026/06/30/two-coordi url profile
document.addEventListener domain profile
a.request domain profile
O.bt domain profile
this.messageOrigin domain profile
https://dfrlab.org/wp-content/uploads/si url profile
Math.random domain profile
s.some domain profile
e.runtime.onerror domain profile
this.messageCount domain profile
https://dfrlab.org/staff/dfrlab/ url profile
n.gm domain profile
s.length domain profile
this.runtime.releaseIds domain profile
this.messageBytes domain profile
https://dfrlab.org/2026/06/09/kremlin-al url profile
e.getRandomValues domain profile
n.forEach domain profile
e.slice domain profile
this.messageBytesMin domain profile
https://dfrlab.org/wp-content/uploads/si url profile
t.getRandomValues domain profile
t.bind domain profile
this.removeOnAbort domain profile
this.messageBytesMax domain profile
https://dfrlab.org/staff/sopo-gelava/ url profile
o.push domain profile
n.push.bind domain profile
e.runtime.isRecording domain profile
this.messageTypes domain profile
https://dfrlab.org/2026/06/05/from-chisi url profile
o.join domain profile
document.createDocumentFragment domain profile
q.jT domain profile
this.sendCount domain profile
https://dfrlab.org/wp-content/uploads/si url profile
e.charCodeAt domain profile
c.mo.NONE domain profile
e.byteLength domain profile
this.sendBytes domain profile
https://dfrlab.org/2026/06/04/russian-na url profile
Math.imul domain profile
e.feature domain profile
e.size domain profile
this.sendBytesMin domain profile
https://dfrlab.org/wp-content/uploads/si url profile
Math.floor domain profile
flags.includes domain profile
w.ee domain profile
this.sendBytesMax domain profile
https://dfrlab.org/2026/05/21/the-domest url profile
performance.now domain profile
v.REGISTER domain profile
g.gm.XMLHttpRequest domain profile
this.sendTypes domain profile
https://dfrlab.org/wp-content/uploads/si url profile
location.href domain profile
e.experimental.register domain profile
n.debugId domain profile
this.closedAt domain profile
https://dfrlab.org/staff/eto-buziashvili url profile
t.port domain profile
v.RESOURCES domain profile
e.YM domain profile
this.closeCode domain profile
https://dfrlab.org/2026/05/01/the-real-t url profile
t.hostname domain profile
e.experimental.resources domain profile
g.gm.Promise domain profile
this.closeReason domain profile
https://dfrlab.org/wp-content/uploads/si url profile
t.pathname domain profile
u.wk domain profile
g.gm.setInterval domain profile
this.closeWasClean domain profile
https://dfrlab.org/staff/konstantinos-ko url profile
t.search domain profile
u.BB domain profile
n.context domain profile
this.connectedDuration domain profile
https://dfrlab.org/2026/04/29/the-case-f url profile
t.protocol.slice domain profile
e.mask domain profile
o.targets domain profile
this.hasErrors domain profile
https://dfrlab.org/wp-content/uploads/si url profile
t.protocol.indexOf domain profile
e.block domain profile
r.addEventListener domain profile
a.TZ domain profile
https://dfrlab.org/staff/mark-scott/ url profile
t.protocol domain profile
g.WN domain profile
e.readyState domain profile
e.init.feature domain profile
https://dfrlab.org/2026/04/27/fabricated url profile
t.host domain profile
this.session domain profile
a.resolved domain profile
e.init.web domain profile
https://dfrlab.org/wp-content/uploads/si url profile
r.port domain profile
b.consented domain profile
h.prototype domain profile
e.init.page domain profile
https://dfrlab.org/staff/nika-aleksejeva url profile
r.pathname domain profile
action.enabled domain profile
https://dfrlab.org/2026/04/24/china-link url profile
r.pathname.startsWith domain profile
d.jsAttributes domain profile
m.then domain profile
e.init.performance.capture domain profile
https://dfrlab.org/wp-content/uploads/si url profile
console.debug domain profile
g.bv domain profile
y.data domain profile
e.init.performance.resources.enabled domain profile
https://dfrlab.org/2026/04/10/morocco-ba url profile
https://github.com/newrelic/newrelic-bro url profile
d.jsAttributes.isWorker domain profile
a.resolve domain profile
e.init.user domain profile
https://dfrlab.org/wp-content/uploads/si url profile
Object.prototype.hasOwnProperty domain profile
e.runtime domain profile
document.createTextNode domain profile
actions.enabled domain profile
https://dfrlab.org/staff/valentin-chatel url profile
n.call domain profile
Object.defineProperties domain profile
r.on domain profile
this.removeOnAbort.abort domain profile
https://dfrlab.org/2026/04/08/pravda-in- url profile
e.every domain profile
v.proxy.assets domain profile
f.length domain profile
o.WS domain profile
https://dfrlab.org/wp-content/uploads/si url profile
s.has domain profile
e.startsWith domain profile
g.gm.Request domain profile
e.get domain profile
https://dfrlab.org/2026/04/03/sanctioned url profile
s.get domain profile
e.runtime.configured domain profile
g.gm.Response domain profile
Et.forEach domain profile
https://dfrlab.org/wp-content/uploads/si url profile
e.toString domain profile
e.info.beacon domain profile
g.gm.fetch domain profile
t.nrData.closedAt domain profile
https://dfrlab.org/staff/iryna-adam/ url profile
t.includes domain profile
e.info.errorBeacon domain profile
r.debugId domain profile
t.nrData.closeCode domain profile
https://dfrlab.org/2026/04/03/tiktok-acc url profile
s.set domain profile
e.init.proxy.assets domain profile
r.emit domain profile
t.nrData.closeReason domain profile
https://dfrlab.org/wp-content/uploads/si url profile
e.init.proxy.beacon domain profile
i.apply domain profile
t.nrData.closeWasClean domain profile
https://dfrlab.org/staff/victoria-olari/ url profile
e.has domain profile
e.init.ajax.deny domain profile
c.then domain profile
t.nrData.openedAt domain profile
https://dfrlab.org/2026/04/03/how-sputni url profile
e.add domain profile
e.init.ajax.block domain profile
je.forEach domain profile
t.nrData.connectedDuration domain profile
https://dfrlab.org/wp-content/uploads/si url profile
n.ee.emit domain profile
e.beacons domain profile
s.targets domain profile
e-t.nrData.openedAt domain profile
https://dfrlab.org/2026/03/31/foreign-an url profile
this.url domain profile
e.runtime.ptid domain profile
t.headers.get domain profile
t.nrData domain profile
https://dfrlab.org/wp-content/uploads/si url profile
Math.max domain profile
e.agentIdentifier domain profile
s.rxSize domain profile
t.targets domain profile
MITRE ATT&CK Groups ↗ Ransomware.live ↗ APT Theater →

📁 Case Management

+ New case from this

🏹 Campaigns & malware

Campaigns →Malware families →Nation-State theater →Sanctions →Wanted & Rewards →

🏹 Add to case

Attach Disinformation (Actor / APT) and pull all linked entities:

🗃 Data Management

+ Case+ CampaignWatchlistTagSave searchWhitelistExport STIX/MISPReport

🧩 Advanced Capabilities

Link AnalysisPivot ExplorerTimelineThreat HuntingAnalyticsDetection RulesBlockchainOSINT PivotPassive DNSTAXII 2.1MISP FeedCreate Alert RuleNetFlowCoverage & Gaps

🧭 Intelligence disciplines

CYBINT →OSINT →HUMINT →GEOINT →
Live group profile & victims via Ransomware.live; ATT&CK technique hints are a static reference for well-known groups. All network calls cached & offline-safe.
Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

⚡ AI Skills

All SkillsResolveEnrichCorrelateSummarize

🔍 Lookup & Enrich

EnrichmentsPivotLink Analysis

📚 Docs & Reports

DocumentationGenerate ReportAPIPlatforms Hub

💡 Recommendations

⚙ Automation

Operations Center

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook

🔗 Related Tools

Mission CommandAdvanced SearchOperations Center