Recommended Sources for Ransomware Information

Recommended Sources for Ransomware Information

There are a lot of great free resources out there to help cybersecurity professionals prevent and detect ransomware - but you have to know where to look! In our recent SANS Threat Analysis Rundown (STAR) livestream, we talked about many sources we use to track the ransomware ecosystem. Here are some of the key resources we covered. Of course, make sure to vet all sources yourself - especially before uploading any data!

General Sources

https://thedfirreport.com/
- They have a Patreon account too: https://www.patreon.com/thedfirreport
https://otx.alienvault.com/dashboard/new

https://id-ransomware.blogspot.com/
https://id-ransomware.malwarehunterteam.com/ (make a risk assessment before uploading any data!)
Florian Roth’s spreadsheet for historical data (not currently updated)

https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/

https://www.virustotal.com (just research, don't upload sensitive samples!)

Leak Sites

Several sources scrape dark web sites where ransomware operators post names of victims as well as exfiltrated data. It's useful for researchers to be aware if their organization is listed on one of these sites. Before accessing these sites, and particularly before downloading any stolen data directly from them, talk to your lawyers!

https://github.com/captainGeech42/ransomwatch

Here's an example of how this could be integrated into Slack:

https://ransomwatch.org

https://darkfeed.io/indexransomware/

Darknet/Tor Research

If you are interested in setting up your own TOR browser to access these sites themselves, here is a video that shows you how to do this in a more secure way:

https://www.youtube.com/watch?v=LAcGiLL4OZU

For more information on the TorBrowser project, please see:

https://tb-manual.torproject.org/about/
And for downloads:
- https://www.torproject.org/download/

And finally, learn about Tails, the operating system designed for anonymity and built with Tor enabled at all times:

https://tails.boum.org/

Twitter

Twitter is an excellent source of information about ransomware itself as well as the many ransomware precursor malware families. TweetDeck (https://tweetdeck.twitter.com/) can help organize various accounts and hashtags of interest, and Twitter lists can also help with this. Like all of these sources, you will need to curate the accounts you follow and determine which ones work for your needs. There are so many good accounts that we can't possibly list all of them here, but if you start with this list, Twitter will recommend other similar accounts to you.

Blogs

We recommend setting up an RSS feed with the blog posts from various organizations in the community. There are many RSS feed options, including a free version of Feedly. You may also want to follow these companies on Twitter.

Many of these blogs are maintained by vendors, who regularly share information about incidents they observe. Again, there are far too many sources for us to list here, so this is just a sample of what's out there. Remember the different companies see different parts of the ransomware ecosystem, so it can be helpful to track many perspectives.

BlackBerry

Red Canary

https://www.coveware.com/blog

https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html

https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/

https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/

https://www.secureworks.com/research/lv-ransomware

https://research.nccgroup.com/2021/06/15/handy-guide-to-a-new-fivehands-ransomware-variant/

https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/modern-ransomwares-double-extortion-tactics-and-how-to-protect-enterprises-against-them

https://www.sentinelone.com/blog/meet-darkside-and-their-ransomware-sentinelone-customers-protected/

https://www.welivesecurity.com/wp-content/uploads/2021/05/eset_threat_report_t12021.pdf

https://adversary.crowdstrike.com/en-US/adversary/pinchy-spider/