From 534748f16a20ea23eca9b022896e10709f4ac0dd Mon Sep 17 00:00:00 2001 From: Guillaume BOURGEOIS Date: Wed, 15 Jul 2026 18:56:50 +0200 Subject: [PATCH] feat(ransomware-live): add Ransomware.live OSINT integration MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ransomware.live API v2 — OSINT tracking of ransomware/extortion groups and their claimed victims. 9 read-only commands: recent victims, list groups, group profile, group victims, and search victims by keyword, country, or date, plus recent cyberattacks and a test-connection check. Useful for third-party / supply-chain exposure checks (is a partner or domain listed as a victim?). API key is optional (sent as X-API-KEY when configured; keyless otherwise). stdlib-only Python (urllib), no extra dependencies. category: threat_intel. Co-Authored-By: Claude Opus 4.8 (1M context) --- integrations/ransomware-live/manifest.yaml | 115 ++++++++++++++++++ .../scripts/country_victims.py | 57 +++++++++ .../ransomware-live/scripts/get_group.py | 49 ++++++++ .../ransomware-live/scripts/group_victims.py | 57 +++++++++ .../ransomware-live/scripts/list_groups.py | 43 +++++++ .../scripts/recent_cyberattacks.py | 49 ++++++++ .../ransomware-live/scripts/recent_victims.py | 49 ++++++++ .../ransomware-live/scripts/search_victims.py | 57 +++++++++ .../scripts/test_connection.py | 43 +++++++ .../scripts/victims_by_date.py | 59 +++++++++ 10 files changed, 578 insertions(+) create mode 100644 integrations/ransomware-live/manifest.yaml create mode 100644 integrations/ransomware-live/scripts/country_victims.py create mode 100644 integrations/ransomware-live/scripts/get_group.py create mode 100644 integrations/ransomware-live/scripts/group_victims.py create mode 100644 integrations/ransomware-live/scripts/list_groups.py create mode 100644 integrations/ransomware-live/scripts/recent_cyberattacks.py create mode 100644 integrations/ransomware-live/scripts/recent_victims.py create mode 100644 integrations/ransomware-live/scripts/search_victims.py create mode 100644 integrations/ransomware-live/scripts/test_connection.py create mode 100644 integrations/ransomware-live/scripts/victims_by_date.py diff --git a/integrations/ransomware-live/manifest.yaml b/integrations/ransomware-live/manifest.yaml new file mode 100644 index 0000000..077ce33 --- /dev/null +++ b/integrations/ransomware-live/manifest.yaml @@ -0,0 +1,115 @@ +id: ransomware_live +name: Ransomware.live +version: 1.0.0 +description: "Ransomware.live (API v2) — OSINT tracking of ransomware & extortion groups and their claimed victims. Query recent victims, list and profile threat groups, pull a group's victims, and search victims by keyword, country, or date. Ideal for third-party/supply-chain exposure checks (is a partner or domain listed as a victim?). An API key is optional — set it if your ransomware.live plan requires one; it is sent as the X-API-KEY header. Stdlib-only, no extra Python dependencies." +changelog: "1.0.0 — Initial release: recent victims, groups, group profile, group victims, search victims (keyword/country/date), recent cyberattacks." +category: threat_intel + +# Per-instance configuration. Ransomware.live's v2 API may require a free API key +# depending on your plan; leave it blank to call keyless endpoints. When set, it +# is sent as the X-API-KEY header. +config_schema: + properties: + api_key: + type: string + description: "Ransomware.live API key (optional — sent as X-API-KEY when set)" + x-soar-sensitive: true + base_url: + type: string + description: "API base URL" + default: "https://api.ransomware.live/v2" + required: [] + +commands: + - id: recent_victims + name: ransomware-live-recent-victims + description: "Most recently disclosed ransomware victims across all groups." + risk: read + inputs_schema: + properties: + limit: { type: number, description: "Max victims to return (0 = all, default 0)" } + required: [] + outputs_schema: { properties: {} } + + - id: list_groups + name: ransomware-live-list-groups + description: "List all tracked ransomware / extortion groups." + risk: read + inputs_schema: + properties: {} + required: [] + outputs_schema: { properties: {} } + + - id: get_group + name: ransomware-live-get-group + description: "Profile of a specific group (description, leak-site locations, profiles/TTP links)." + risk: read + inputs_schema: + properties: + group: { type: string, description: "Group name/slug (e.g. lockbit3, akira, play)" } + required: [group] + outputs_schema: { properties: {} } + + - id: group_victims + name: ransomware-live-group-victims + description: "All victims claimed by a specific group." + risk: read + inputs_schema: + properties: + group: { type: string, description: "Group name/slug (e.g. lockbit3, akira, play)" } + limit: { type: number, description: "Max victims to return (0 = all, default 0)" } + required: [group] + outputs_schema: { properties: {} } + + - id: search_victims + name: ransomware-live-search-victims + description: "Search claimed victims by keyword (company name or domain) — supply-chain / brand exposure checks." + risk: read + inputs_schema: + properties: + keyword: { type: string, description: "Company name or domain to search (e.g. acme, acme.com)" } + limit: { type: number, description: "Max victims to return (0 = all, default 0)" } + required: [keyword] + outputs_schema: { properties: {} } + + - id: country_victims + name: ransomware-live-country-victims + description: "Victims located in a given country." + risk: read + inputs_schema: + properties: + country: { type: string, description: "ISO 3166-1 alpha-2 country code (e.g. FR, US, DE)" } + limit: { type: number, description: "Max victims to return (0 = all, default 0)" } + required: [country] + outputs_schema: { properties: {} } + + - id: victims_by_date + name: ransomware-live-victims-by-date + description: "Victims disclosed in a given year, optionally narrowed to a month." + risk: read + inputs_schema: + properties: + year: { type: number, description: "Year, e.g. 2025" } + month: { type: number, description: "Month 1-12 (optional)" } + limit: { type: number, description: "Max victims to return (0 = all, default 0)" } + required: [year] + outputs_schema: { properties: {} } + + - id: recent_cyberattacks + name: ransomware-live-recent-cyberattacks + description: "Recently reported cyberattacks (press / OSINT), beyond leak-site claims." + risk: read + inputs_schema: + properties: + limit: { type: number, description: "Max entries to return (0 = all, default 0)" } + required: [] + outputs_schema: { properties: {} } + + - id: test_connection + name: ransomware-live-test-connection + description: "Verify the ransomware.live API is reachable (used by the Test button)." + risk: read + inputs_schema: + properties: {} + required: [] + outputs_schema: { properties: {} } diff --git a/integrations/ransomware-live/scripts/country_victims.py b/integrations/ransomware-live/scripts/country_victims.py new file mode 100644 index 0000000..1fd8650 --- /dev/null +++ b/integrations/ransomware-live/scripts/country_victims.py @@ -0,0 +1,57 @@ +import json, os, sys, urllib.parse, urllib.request, urllib.error + +DEFAULT_BASE = "https://api.ransomware.live/v2" + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def _get(cfg, path): + base = (cfg.get("base_url") or DEFAULT_BASE).rstrip("/") + headers = {"User-Agent": "Riposte-SOAR", "Accept": "application/json"} + key = str(cfg.get("api_key") or "").strip() + if key: + headers["X-API-KEY"] = key + req = urllib.request.Request(base + path, headers=headers) + with urllib.request.urlopen(req, timeout=60) as r: + raw = r.read() + return json.loads(raw) if raw else None + + +def _req(inputs, key): + v = str(inputs.get(key) or "").strip() + if not v: + raise ValueError(key + " is required") + return v + + +def _cap(data, inputs): + items = data if isinstance(data, list) else [] + n = int(inputs.get("limit") or 0) + return items[:n] if n and n > 0 else items + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(cfg, inputs): + country = _req(inputs, "country").upper() + data = _get(cfg, "/countryvictims/" + urllib.parse.quote(country, safe="")) + victims = _cap(data, inputs) + return {"country": country, "count": len(victims), "victims": victims} + + +_run(main) diff --git a/integrations/ransomware-live/scripts/get_group.py b/integrations/ransomware-live/scripts/get_group.py new file mode 100644 index 0000000..6735b30 --- /dev/null +++ b/integrations/ransomware-live/scripts/get_group.py @@ -0,0 +1,49 @@ +import json, os, sys, urllib.parse, urllib.request, urllib.error + +DEFAULT_BASE = "https://api.ransomware.live/v2" + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def _get(cfg, path): + base = (cfg.get("base_url") or DEFAULT_BASE).rstrip("/") + headers = {"User-Agent": "Riposte-SOAR", "Accept": "application/json"} + key = str(cfg.get("api_key") or "").strip() + if key: + headers["X-API-KEY"] = key + req = urllib.request.Request(base + path, headers=headers) + with urllib.request.urlopen(req, timeout=60) as r: + raw = r.read() + return json.loads(raw) if raw else None + + +def _req(inputs, key): + v = str(inputs.get(key) or "").strip() + if not v: + raise ValueError(key + " is required") + return v + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(cfg, inputs): + group = _req(inputs, "group") + return _get(cfg, "/group/" + urllib.parse.quote(group, safe="")) + + +_run(main) diff --git a/integrations/ransomware-live/scripts/group_victims.py b/integrations/ransomware-live/scripts/group_victims.py new file mode 100644 index 0000000..964384b --- /dev/null +++ b/integrations/ransomware-live/scripts/group_victims.py @@ -0,0 +1,57 @@ +import json, os, sys, urllib.parse, urllib.request, urllib.error + +DEFAULT_BASE = "https://api.ransomware.live/v2" + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def _get(cfg, path): + base = (cfg.get("base_url") or DEFAULT_BASE).rstrip("/") + headers = {"User-Agent": "Riposte-SOAR", "Accept": "application/json"} + key = str(cfg.get("api_key") or "").strip() + if key: + headers["X-API-KEY"] = key + req = urllib.request.Request(base + path, headers=headers) + with urllib.request.urlopen(req, timeout=60) as r: + raw = r.read() + return json.loads(raw) if raw else None + + +def _req(inputs, key): + v = str(inputs.get(key) or "").strip() + if not v: + raise ValueError(key + " is required") + return v + + +def _cap(data, inputs): + items = data if isinstance(data, list) else [] + n = int(inputs.get("limit") or 0) + return items[:n] if n and n > 0 else items + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(cfg, inputs): + group = _req(inputs, "group") + data = _get(cfg, "/groupvictims/" + urllib.parse.quote(group, safe="")) + victims = _cap(data, inputs) + return {"group": group, "count": len(victims), "victims": victims} + + +_run(main) diff --git a/integrations/ransomware-live/scripts/list_groups.py b/integrations/ransomware-live/scripts/list_groups.py new file mode 100644 index 0000000..4e49840 --- /dev/null +++ b/integrations/ransomware-live/scripts/list_groups.py @@ -0,0 +1,43 @@ +import json, os, sys, urllib.request, urllib.error + +DEFAULT_BASE = "https://api.ransomware.live/v2" + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def _get(cfg, path): + base = (cfg.get("base_url") or DEFAULT_BASE).rstrip("/") + headers = {"User-Agent": "Riposte-SOAR", "Accept": "application/json"} + key = str(cfg.get("api_key") or "").strip() + if key: + headers["X-API-KEY"] = key + req = urllib.request.Request(base + path, headers=headers) + with urllib.request.urlopen(req, timeout=60) as r: + raw = r.read() + return json.loads(raw) if raw else None + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(cfg, inputs): + data = _get(cfg, "/groups") + groups = data if isinstance(data, list) else [] + return {"count": len(groups), "groups": groups} + + +_run(main) diff --git a/integrations/ransomware-live/scripts/recent_cyberattacks.py b/integrations/ransomware-live/scripts/recent_cyberattacks.py new file mode 100644 index 0000000..a7e1931 --- /dev/null +++ b/integrations/ransomware-live/scripts/recent_cyberattacks.py @@ -0,0 +1,49 @@ +import json, os, sys, urllib.request, urllib.error + +DEFAULT_BASE = "https://api.ransomware.live/v2" + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def _get(cfg, path): + base = (cfg.get("base_url") or DEFAULT_BASE).rstrip("/") + headers = {"User-Agent": "Riposte-SOAR", "Accept": "application/json"} + key = str(cfg.get("api_key") or "").strip() + if key: + headers["X-API-KEY"] = key + req = urllib.request.Request(base + path, headers=headers) + with urllib.request.urlopen(req, timeout=60) as r: + raw = r.read() + return json.loads(raw) if raw else None + + +def _cap(data, inputs): + items = data if isinstance(data, list) else [] + n = int(inputs.get("limit") or 0) + return items[:n] if n and n > 0 else items + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(cfg, inputs): + data = _get(cfg, "/recentcyberattacks") + items = _cap(data, inputs) + return {"count": len(items), "cyberattacks": items} + + +_run(main) diff --git a/integrations/ransomware-live/scripts/recent_victims.py b/integrations/ransomware-live/scripts/recent_victims.py new file mode 100644 index 0000000..02ce739 --- /dev/null +++ b/integrations/ransomware-live/scripts/recent_victims.py @@ -0,0 +1,49 @@ +import json, os, sys, urllib.parse, urllib.request, urllib.error + +DEFAULT_BASE = "https://api.ransomware.live/v2" + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def _get(cfg, path): + base = (cfg.get("base_url") or DEFAULT_BASE).rstrip("/") + headers = {"User-Agent": "Riposte-SOAR", "Accept": "application/json"} + key = str(cfg.get("api_key") or "").strip() + if key: + headers["X-API-KEY"] = key + req = urllib.request.Request(base + path, headers=headers) + with urllib.request.urlopen(req, timeout=60) as r: + raw = r.read() + return json.loads(raw) if raw else None + + +def _cap(data, inputs): + items = data if isinstance(data, list) else [] + n = int(inputs.get("limit") or 0) + return items[:n] if n and n > 0 else items + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(cfg, inputs): + data = _get(cfg, "/recentvictims") + victims = _cap(data, inputs) + return {"count": len(victims), "victims": victims} + + +_run(main) diff --git a/integrations/ransomware-live/scripts/search_victims.py b/integrations/ransomware-live/scripts/search_victims.py new file mode 100644 index 0000000..4b3dad3 --- /dev/null +++ b/integrations/ransomware-live/scripts/search_victims.py @@ -0,0 +1,57 @@ +import json, os, sys, urllib.parse, urllib.request, urllib.error + +DEFAULT_BASE = "https://api.ransomware.live/v2" + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def _get(cfg, path): + base = (cfg.get("base_url") or DEFAULT_BASE).rstrip("/") + headers = {"User-Agent": "Riposte-SOAR", "Accept": "application/json"} + key = str(cfg.get("api_key") or "").strip() + if key: + headers["X-API-KEY"] = key + req = urllib.request.Request(base + path, headers=headers) + with urllib.request.urlopen(req, timeout=60) as r: + raw = r.read() + return json.loads(raw) if raw else None + + +def _req(inputs, key): + v = str(inputs.get(key) or "").strip() + if not v: + raise ValueError(key + " is required") + return v + + +def _cap(data, inputs): + items = data if isinstance(data, list) else [] + n = int(inputs.get("limit") or 0) + return items[:n] if n and n > 0 else items + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(cfg, inputs): + keyword = _req(inputs, "keyword") + data = _get(cfg, "/searchvictims/" + urllib.parse.quote(keyword, safe="")) + victims = _cap(data, inputs) + return {"keyword": keyword, "count": len(victims), "victims": victims} + + +_run(main) diff --git a/integrations/ransomware-live/scripts/test_connection.py b/integrations/ransomware-live/scripts/test_connection.py new file mode 100644 index 0000000..ccf3abd --- /dev/null +++ b/integrations/ransomware-live/scripts/test_connection.py @@ -0,0 +1,43 @@ +import json, os, sys, urllib.request, urllib.error + +DEFAULT_BASE = "https://api.ransomware.live/v2" + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def _get(cfg, path): + base = (cfg.get("base_url") or DEFAULT_BASE).rstrip("/") + headers = {"User-Agent": "Riposte-SOAR", "Accept": "application/json"} + key = str(cfg.get("api_key") or "").strip() + if key: + headers["X-API-KEY"] = key + req = urllib.request.Request(base + path, headers=headers) + with urllib.request.urlopen(req, timeout=60) as r: + raw = r.read() + return json.loads(raw) if raw else None + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(cfg, inputs): + data = _get(cfg, "/groups") + n = len(data) if isinstance(data, list) else 0 + return {"ok": True, "groups": n} + + +_run(main) diff --git a/integrations/ransomware-live/scripts/victims_by_date.py b/integrations/ransomware-live/scripts/victims_by_date.py new file mode 100644 index 0000000..f7ea659 --- /dev/null +++ b/integrations/ransomware-live/scripts/victims_by_date.py @@ -0,0 +1,59 @@ +import json, os, sys, urllib.parse, urllib.request, urllib.error + +DEFAULT_BASE = "https://api.ransomware.live/v2" + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def _get(cfg, path): + base = (cfg.get("base_url") or DEFAULT_BASE).rstrip("/") + headers = {"User-Agent": "Riposte-SOAR", "Accept": "application/json"} + key = str(cfg.get("api_key") or "").strip() + if key: + headers["X-API-KEY"] = key + req = urllib.request.Request(base + path, headers=headers) + with urllib.request.urlopen(req, timeout=60) as r: + raw = r.read() + return json.loads(raw) if raw else None + + +def _cap(data, inputs): + items = data if isinstance(data, list) else [] + n = int(inputs.get("limit") or 0) + return items[:n] if n and n > 0 else items + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(cfg, inputs): + year = inputs.get("year") + if year in (None, ""): + raise ValueError("year is required") + year = int(year) + path = "/victims/" + urllib.parse.quote(str(year), safe="") + month = inputs.get("month") + has_month = month not in (None, "") + if has_month: + month = int(month) + path += "/" + urllib.parse.quote(str(month), safe="") + data = _get(cfg, path) + victims = _cap(data, inputs) + return {"year": year, "month": (month if has_month else None), "count": len(victims), "victims": victims} + + +_run(main)