Contact us Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

About Ransomware.live

What is Ransomware.live?

Ransomware.live is a free, independent, and continuously updated threat intelligence platform tracking ransomware groups and their victims worldwide. It passively monitors ransomware groups' Data Leak Sites (DLS), aggregates publicly disclosed victim data, and presents it in a structured, actionable format — no paywall, no ads, no corporate backing.

The platform serves cybersecurity professionals, journalists, researchers, and incident responders who need reliable, real-time situational awareness of the ransomware landscape. It does not host or distribute any leaked data, and does not engage in speculation or intrusion — only what is already publicly visible on the internet.

Author

Julien Mousqueton

Field CISO EMEA at Cohesity  ·  Lecturer in Cyber Security at École 2600

Ransomware.live is a personal project built and maintained independently, outside of working hours. It is not affiliated with or endorsed by his employer.

Sources & Credits

Ransomware.live enriches its data thanks to the work of these researchers and organizations:

Zscaler ThreatLabz — ransomware profiles and ransom notes
Valéry Rieß-Marchive — cyberattack reporting and negotiation chat data
Will Thomas — Ransomware Tools Matrix and Vulnerability Matrix
Crocodyli — MITRE ATT&CK TTP mapping
Hudson Rock — infostealer attribution and enrichment
Support the project

Hosting, the domain, and AI enrichment all have a cost. If Ransomware.live has been useful to you, consider buying a coffee — it keeps the site independent and free for everyone.

Buy a coffee

Legal Disclaimer

Ransomware.live does not host or distribute any leaked data. All content is derived from:

  • Public disclosures by ransomware groups on their Data Leak Sites (DLS)
  • Open-source cybersecurity research and threat intelligence feeds
  • Press coverage and public incident reports

The platform does not encourage or facilitate cybercrime. Its sole purpose is transparency and awareness.

If you believe a published item is incorrect or raises a privacy concern, contact support@ransomware.live. Requests are evaluated in accordance with the project's ethical guidelines.