analyzing-ransomware-payment-wallets

name	analyzing-ransomware-payment-wallets
description	Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs, identifying wallet clusters and tracking fund movement through mixers and exchanges to support law enforcement attribution. Use when tracing ransomware bitcoin payments, performing cryptocurrency wallet forensics, or gathering blockchain threat intelligence on extortion payments.
domain	cybersecurity
subdomain	ransomware-defense
tags	["ransomware","blockchain","cryptocurrency","forensics","threat-intelligence","bitcoin"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.DS-11","RS.MA-01","RC.RP-01","PR.IR-01"]
mitre_attack	["T1657","T1486"]
mitre_f3	{"version":"1.1","tactics":["monetization","stealth"],"techniques":[{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"},{"id":"F1017","name":"Conversion to Physical Monetary Instruments","tactic":"monetization","source":"f3"},{"id":"F1017.001","name":"Conversion to Physical Monetary Instruments: Cash","tactic":"monetization","source":"f3"},{"id":"F1047","name":"Transfer of funds","tactic":"monetization","source":"f3"},{"id":"F1045","name":"Structuring","tactic":"stealth","source":"f3"}]}

Analyzing Ransomware Payment Wallets

When to Use

• An organization has been hit by ransomware and the ransom note contains a Bitcoin or cryptocurrency wallet address that needs investigation
• Law enforcement or incident responders need to trace where ransom payments flowed after the victim paid
• Threat intelligence analysts are attributing ransomware campaigns by clustering payment infrastructure across incidents
• Investigators need to determine if a ransomware group is reusing wallet infrastructure across multiple victims
• Compliance or legal teams need evidence of fund flows for prosecution, sanctions enforcement, or insurance claims

Do not use this skill for live payment interception or to interact directly with ransomware operators. All analysis should be passive and read-only against public blockchain data.

Prerequisites

• Python 3.8+ with requests, json, and hashlib libraries
• Access to blockchain explorer APIs (blockchain.com, WalletExplorer.com, Blockstream.info)
• Familiarity with Bitcoin transaction model (UTXOs, inputs, outputs, change addresses)
• Understanding of common obfuscation techniques (mixers, tumblers, peel chains, cross-chain swaps)
• Optional: Chainalysis Reactor license for enterprise-grade cluster analysis
• Optional: OXT.me for advanced transaction graph visualization

Workflow

Step 1: Extract Wallet Address from Ransom Note

Parse the ransom note to identify the payment address(es):

Common address formats:
  Bitcoin (P2PKH):   1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa  (starts with 1)
  Bitcoin (P2SH):    3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy  (starts with 3)
  Bitcoin (Bech32):  bc1qar0srrr7xfkvy5l643lydnw9re59gtzzwf5mdq (starts with bc1)
  Monero:            4... (95 characters, much harder to trace)
  Ethereum:          0x... (40 hex chars)

Step 2: Query Blockchain Explorer for Transaction History

Retrieve all transactions associated with the wallet:

import requests

def get_wallet_transactions(address):
    """Query blockchain.com API for address transactions."""
    url = f"https://blockchain.info/rawaddr/{address}"
    resp = requests.get(url, timeout=30)
    resp.raise_for_status()
    data = resp.json()
     {
        : address,
        : data.get(, ),
        : data.get(, ),
        : data.get(, ),
        : data.get(, ),
        : data.get(, []),
    }