Ransomware Ecosystem Research

Real-time victim posts, active group tracking, and cyberattack data sourced directly from ransomware.live. Filterable by group, country, and sector. Auto-refreshes every 5 minutes.

A playable ransomware-ecosystem disruption simulator. Spend action points across financial, infrastructure, legal, underground and protection-layer levers — the ecosystem adapts the way the framework says it does. Five historical operations plus current-ops scenarios, an analyst depth layer, and an in-game codex. “The protection is the real target.”

Node-by-node intelligence browser for all 15 Ecosystem Dependency Playbook modules. Structured for deep-dive analysis of individual ecosystem components.

23 structural profiles covering lineage, operational patterns, affiliate relationships, live victim data, and disruption timelines.

Wanted, indicted, and sanctioned ransomware principals with photographs, aliases, reward status, and confidence-labeled attribution.

8 profiles of exchanges serving Russia/CIS networks: volumes, illicit exposure, operator attribution, and sanctions history.

6 BPH provider profiles: ASN infrastructure, operator attribution, sanctions exposure, and disruption history.

Every OFAC, EU, UK, and AU designation, DOJ indictment, and Europol/NCA action mapped to entity profiles, with per-target status and a pressure matrix.

34 disruption operations scored 1-5 for real-world effect: which authorities' actions degrade the ecosystem, and which just displace it.

Longitudinal tracking of 9 disruption KPIs, quarterly from Q1 2024, rendered live from the canonical registry.

Family tree of ransomware groups: rebrand chains, affiliate migrations, and code lineage across the ecosystem.

Per-group tooling reference: encryptors, loaders, exfiltration utilities, and infrastructure preferences.

Arc visualization of relationships across groups, infrastructure, and financial nodes. A linear complement to the ecosystem map.