f3nris
534748f16a
Ransomware.live API v2 — OSINT tracking of ransomware/extortion groups and their claimed victims. 9 read-only commands: recent victims, list groups, group profile, group victims, and search victims by keyword, country, or date, plus recent cyberattacks and a test-connection check. Useful for third-party / supply-chain exposure checks (is a partner or domain listed as a victim?). API key is optional (sent as X-API-KEY when configured; keyless otherwise). stdlib-only Python (urllib), no extra dependencies. category: threat_intel. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
116 lines
4.6 KiB
YAML
116 lines
4.6 KiB
YAML
id: ransomware_live
|
|
name: Ransomware.live
|
|
version: 1.0.0
|
|
description: "Ransomware.live (API v2) — OSINT tracking of ransomware & extortion groups and their claimed victims. Query recent victims, list and profile threat groups, pull a group's victims, and search victims by keyword, country, or date. Ideal for third-party/supply-chain exposure checks (is a partner or domain listed as a victim?). An API key is optional — set it if your ransomware.live plan requires one; it is sent as the X-API-KEY header. Stdlib-only, no extra Python dependencies."
|
|
changelog: "1.0.0 — Initial release: recent victims, groups, group profile, group victims, search victims (keyword/country/date), recent cyberattacks."
|
|
category: threat_intel
|
|
|
|
# Per-instance configuration. Ransomware.live's v2 API may require a free API key
|
|
# depending on your plan; leave it blank to call keyless endpoints. When set, it
|
|
# is sent as the X-API-KEY header.
|
|
config_schema:
|
|
properties:
|
|
api_key:
|
|
type: string
|
|
description: "Ransomware.live API key (optional — sent as X-API-KEY when set)"
|
|
x-soar-sensitive: true
|
|
base_url:
|
|
type: string
|
|
description: "API base URL"
|
|
default: "https://api.ransomware.live/v2"
|
|
required: []
|
|
|
|
commands:
|
|
- id: recent_victims
|
|
name: ransomware-live-recent-victims
|
|
description: "Most recently disclosed ransomware victims across all groups."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
limit: { type: number, description: "Max victims to return (0 = all, default 0)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: list_groups
|
|
name: ransomware-live-list-groups
|
|
description: "List all tracked ransomware / extortion groups."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: get_group
|
|
name: ransomware-live-get-group
|
|
description: "Profile of a specific group (description, leak-site locations, profiles/TTP links)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
group: { type: string, description: "Group name/slug (e.g. lockbit3, akira, play)" }
|
|
required: [group]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: group_victims
|
|
name: ransomware-live-group-victims
|
|
description: "All victims claimed by a specific group."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
group: { type: string, description: "Group name/slug (e.g. lockbit3, akira, play)" }
|
|
limit: { type: number, description: "Max victims to return (0 = all, default 0)" }
|
|
required: [group]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: search_victims
|
|
name: ransomware-live-search-victims
|
|
description: "Search claimed victims by keyword (company name or domain) — supply-chain / brand exposure checks."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
keyword: { type: string, description: "Company name or domain to search (e.g. acme, acme.com)" }
|
|
limit: { type: number, description: "Max victims to return (0 = all, default 0)" }
|
|
required: [keyword]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: country_victims
|
|
name: ransomware-live-country-victims
|
|
description: "Victims located in a given country."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
country: { type: string, description: "ISO 3166-1 alpha-2 country code (e.g. FR, US, DE)" }
|
|
limit: { type: number, description: "Max victims to return (0 = all, default 0)" }
|
|
required: [country]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: victims_by_date
|
|
name: ransomware-live-victims-by-date
|
|
description: "Victims disclosed in a given year, optionally narrowed to a month."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
year: { type: number, description: "Year, e.g. 2025" }
|
|
month: { type: number, description: "Month 1-12 (optional)" }
|
|
limit: { type: number, description: "Max victims to return (0 = all, default 0)" }
|
|
required: [year]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: recent_cyberattacks
|
|
name: ransomware-live-recent-cyberattacks
|
|
description: "Recently reported cyberattacks (press / OSINT), beyond leak-site claims."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
limit: { type: number, description: "Max entries to return (0 = all, default 0)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: ransomware-live-test-connection
|
|
description: "Verify the ransomware.live API is reachable (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|