f3nris
5ee7352652
Ransomware.live's v2 API is free and needs no authentication. Remove the optional api_key config field and the X-API-KEY header logic from all commands so instance creation requires no credentials. Only an optional base_url override remains. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
111 lines
4.3 KiB
YAML
111 lines
4.3 KiB
YAML
id: ransomware_live
|
|
name: Ransomware.live
|
|
version: 1.0.0
|
|
description: "Ransomware.live (API v2) — OSINT tracking of ransomware & extortion groups and their claimed victims. Query recent victims, list and profile threat groups, pull a group's victims, and search victims by keyword, country, or date. Ideal for third-party/supply-chain exposure checks (is a partner or domain listed as a victim?). Free and keyless — no authentication required. Stdlib-only, no extra Python dependencies."
|
|
changelog: "1.0.0 — Initial release: recent victims, groups, group profile, group victims, search victims (keyword/country/date), recent cyberattacks."
|
|
category: threat_intel
|
|
|
|
# Ransomware.live's v2 API is free and requires no authentication. The only
|
|
# configuration is an optional base URL override.
|
|
config_schema:
|
|
properties:
|
|
base_url:
|
|
type: string
|
|
description: "API base URL"
|
|
default: "https://api.ransomware.live/v2"
|
|
required: []
|
|
|
|
commands:
|
|
- id: recent_victims
|
|
name: ransomware-live-recent-victims
|
|
description: "Most recently disclosed ransomware victims across all groups."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
limit: { type: number, description: "Max victims to return (0 = all, default 0)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: list_groups
|
|
name: ransomware-live-list-groups
|
|
description: "List all tracked ransomware / extortion groups."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: get_group
|
|
name: ransomware-live-get-group
|
|
description: "Profile of a specific group (description, leak-site locations, profiles/TTP links)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
group: { type: string, description: "Group name/slug (e.g. lockbit3, akira, play)" }
|
|
required: [group]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: group_victims
|
|
name: ransomware-live-group-victims
|
|
description: "All victims claimed by a specific group."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
group: { type: string, description: "Group name/slug (e.g. lockbit3, akira, play)" }
|
|
limit: { type: number, description: "Max victims to return (0 = all, default 0)" }
|
|
required: [group]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: search_victims
|
|
name: ransomware-live-search-victims
|
|
description: "Search claimed victims by keyword (company name or domain) — supply-chain / brand exposure checks."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
keyword: { type: string, description: "Company name or domain to search (e.g. acme, acme.com)" }
|
|
limit: { type: number, description: "Max victims to return (0 = all, default 0)" }
|
|
required: [keyword]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: country_victims
|
|
name: ransomware-live-country-victims
|
|
description: "Victims located in a given country."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
country: { type: string, description: "ISO 3166-1 alpha-2 country code (e.g. FR, US, DE)" }
|
|
limit: { type: number, description: "Max victims to return (0 = all, default 0)" }
|
|
required: [country]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: victims_by_date
|
|
name: ransomware-live-victims-by-date
|
|
description: "Victims disclosed in a given year, optionally narrowed to a month."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
year: { type: number, description: "Year, e.g. 2025" }
|
|
month: { type: number, description: "Month 1-12 (optional)" }
|
|
limit: { type: number, description: "Max victims to return (0 = all, default 0)" }
|
|
required: [year]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: recent_cyberattacks
|
|
name: ransomware-live-recent-cyberattacks
|
|
description: "Recently reported cyberattacks (press / OSINT), beyond leak-site claims."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
limit: { type: number, description: "Max entries to return (0 = all, default 0)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: ransomware-live-test-connection
|
|
description: "Verify the ransomware.live API is reachable (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|