| name | analyzing-ransomware-leak-site-intelligence |
| description | Monitor and analyze ransomware group data leak sites (DLS) to track victim postings, extract threat intelligence on group tactics, and assess sector-specific ransomware risk for proactive defense. |
| domain | cybersecurity |
| subdomain | threat-intelligence |
| tags | ["ransomware","leak-site","data-leak","extortion","threat-intelligence","leak-site-monitoring","dls","victim-tracking"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"] |
| mitre_attack | ["T1657","T1486","T1567.002","T1591"] |
| source | https://github.com/mukul975/Anthropic-Cybersecurity-Skills |
| source_commit | 04450304b12645cb2b974ab96d28c0664758a88d |
| note | Vendored verbatim from an external Apache-2.0 security-skill library, pinned by commit. Exceeds the internal 300-line skill guideline (agent-code-constraints.md) -- kept as-is because this is vendored reference material (forensics/threat-intel procedure), not Yana AI-authored content, and trimming would damage technical accuracy. |
Analyzing Ransomware Leak Site Intelligence
Overview
Ransomware groups operating under double-extortion models maintain data leak sites (DLS) on Tor hidden services where they post victim names, stolen data samples, and countdown timers to pressure payment. In H1 2025, 96 unique ransomware groups were active, listing approximately 535 victims per month. Monitoring these sites provides intelligence on active threat groups, targeted sectors, geographic patterns, and emerging ransomware families. This skill covers safely collecting DLS intelligence, extracting structured data, tracking group activity trends, and producing sector-specific risk assessments.
When to Use
- When investigating security incidents that require analyzing ransomware leak site intelligence
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Python 3.9+ with
requests, beautifulsoup4, pandas, matplotlib libraries
- Tor proxy (SOCKS5) for accessing .onion sites or commercial DLS monitoring feeds
- Understanding of ransomware double-extortion business model
- Familiarity with major ransomware families (Qilin, Akira, LockBit, BlackCat, Clop)
- Access to ransomware tracking feeds (Ransomwatch, RansomLook, DarkFeed)
Key Concepts
Double Extortion Model
Modern ransomware groups encrypt victim data AND exfiltrate it before encryption. Leak sites serve as public pressure: victims are listed with a countdown timer, partial data samples, and file trees. If ransom is not paid, full data is published. Some groups have moved to triple extortion, adding DDoS threats or contacting victims' customers directly.
DLS Intelligence Value
Leak sites provide: victim identification (company name, sector, country), attack timeline (when listed, deadline, data published), data volume estimates, group capability assessment (sectors targeted, attack frequency, operational tempo), and trend analysis (new groups emerging, groups rebranding, law enforcement takedowns).
Safe Collection Practices
Never directly access DLS sites in a production environment. Use purpose-built monitoring services (Ransomwatch, DarkFeed, KELA, Flashpoint), Tor-isolated research VMs, commercial threat intelligence platforms, or community-maintained datasets. All analysis should be conducted in isolated environments with proper authorization.
Workflow
Step 1: Ingest Ransomware Leak Site Data from Public Feeds
