| name | analyzing-ransomware-leak-site-intelligence |
| description | Safely monitor ransomware group Tor-hosted data leak sites (DLS) to collect and extract structured victim posting data, track group activity trends over time, and produce sector- and geography-specific ransomware risk assessments. Use when performing threat intelligence gathering on active ransomware groups or building proactive defense reporting from double-extortion leak-site activity. |
| domain | cybersecurity |
| subdomain | threat-intelligence |
| tags | ["ransomware","leak-site","data-leak","extortion","threat-intelligence","leak-site-monitoring","dls","victim-tracking"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"] |
| mitre_attack | ["T1657","T1486","T1567.002","T1591"] |
| mitre_f3 | {"version":"1.1","tactics":["monetization","reconnaissance"],"techniques":[{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"},{"id":"F1029","name":"Gather Customer Information","tactic":"reconnaissance","source":"f3"},{"id":"T1593","name":"Search Open Websites/Domains","tactic":"reconnaissance","source":"attack"},{"id":"F1025.003","name":"Electronic Funds Transfer: Wire Transfer","tactic":"monetization","source":"f3"}]} |
Analyzing Ransomware Leak Site Intelligence
Overview
Ransomware groups operating under double-extortion models maintain data leak sites (DLS) on Tor hidden services where they post victim names, stolen data samples, and countdown timers to pressure payment. In H1 2025, 96 unique ransomware groups were active, listing approximately 535 victims per month. Monitoring these sites provides intelligence on active threat groups, targeted sectors, geographic patterns, and emerging ransomware families. This skill covers safely collecting DLS intelligence, extracting structured data, tracking group activity trends, and producing sector-specific risk assessments.
When to Use
- When investigating security incidents that require analyzing ransomware leak site intelligence
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Python 3.9+ with
requests, beautifulsoup4, pandas, matplotlib libraries
- Tor proxy (SOCKS5) for accessing .onion sites or commercial DLS monitoring feeds
- Understanding of ransomware double-extortion business model
- Familiarity with major ransomware families (Qilin, Akira, LockBit, BlackCat, Clop)
- Access to ransomware tracking feeds (Ransomwatch, RansomLook, DarkFeed)
Key Concepts
Double Extortion Model
Modern ransomware groups encrypt victim data AND exfiltrate it before encryption. Leak sites serve as public pressure: victims are listed with a countdown timer, partial data samples, and file trees. If ransom is not paid, full data is published. Some groups have moved to triple extortion, adding DDoS threats or contacting victims' customers directly.
DLS Intelligence Value
Leak sites provide: victim identification (company name, sector, country), attack timeline (when listed, deadline, data published), data volume estimates, group capability assessment (sectors targeted, attack frequency, operational tempo), and trend analysis (new groups emerging, groups rebranding, law enforcement takedowns).
Safe Collection Practices
Never directly access DLS sites in a production environment. Use purpose-built monitoring services (Ransomwatch, DarkFeed, KELA, Flashpoint), Tor-isolated research VMs, commercial threat intelligence platforms, or community-maintained datasets. All analysis should be conducted in isolated environments with proper authorization.
Workflow
Step 1: Ingest Ransomware Leak Site Data from Public Feeds
