🔒 Ransomware theater

Follows ransomware-as-a-service brands, affiliates, and extortion campaigns encrypting and leaking victim data. Prioritized for its operational and economic impact on critical services.

🏹 Threat Actors

🦠 Malware & Tools

🛡 Exploited Vulnerabilities

🧭 Intelligence disciplines

📚 Priority sources & datasets

🔄 Live Datasets & APIs (2 key-free · ingestible)

📜 Ransomware Playbook

1. Monitor leak sites, StopRansomware alerts, and IR feeds for new ransomware activity and victims.
2. Extract encryptor hashes, ransom notes, TOR negotiation portals, and payment wallets.
3. Correlate the intrusion to an initial-access CVE or broker and the affiliate program used.
4. Attribute to a RaaS brand or affiliate via encryptor lineage, note templates, and infrastructure.
5. Publish a victim advisory with decryptor availability and mitigation guidance.
6. Block indicators, trace ransom payments on-chain, and patch the exploited entry vector.

⚡ AI Skills & Automation

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

🧩 Advanced Capabilities

🔗 Cross-domain pivots

🔄 Data Feeds & Datasets