This repository is a structured and continuously evolving collection of intelligence on various ransomware families and the threat actors (TAs) behind them. It contains ransom notes, analysis tools, YARA rules, indicators of compromise (IoCs), and other resources aimed at:
- Identifying ransomware strains and activity
- Understanding their behavior, tooling, and impact
- Clustering and tracking threat actors
This resource supports analysts, researchers, and defenders in their efforts to combat ransomware attacks.
The repository is organized by ransomware family or threat actor, with each folder containing relevant files. Below is an example of the structure:
Ransomware/
├── Babuk/
│ ├── tools/
│ └── Babuk.yar
└── HsHarada/
├── Unlocker/
├── ransom_notes/
├── tools/
├── HsHarada.yar
├── HsHarada_samples.txt
├── IoCs.txt
├── attackers.txt
└── readme.txt
ransom_notes/– Unique ransom note samples.tools/– Scripts or utilities for ransomware analysis, decryption, or forensic purposes.*.yar– YARA rules to detect specific ransomware variants.*_samples.txt– Hashes of discovered samples, compilation timestamps, and metadata.IoCs.txt– IPs, domains, file paths, and hashes associated with the TA.attackers.txt– Contact details or handles used by the threat actors for communication.readme.txt– External references, such as blog posts or threat reports.
This project is licensed under the Apache License 2.0.