from asi16
Collect and analyze ransomware data-leak site (DLS) posts to extract victim, group, sector and geographic trends for threat intelligence and proactive defense.
This skill provides a reproducible workflow to safely collect, parse, and analyze ransomware data-leak site (DLS) postings from public tracking feeds. It shows how to ingest victim posts (e.g. Ransomwatch), extract structured fields (group, sector, country, discovery date), compute group activity trends, assess sector/geographic risk, and produce an intelligence report with recommendations for SOCs and defenders. The materials include Python examples and analysis patterns for monthly trend aggregation, new-group detection, and sector-level risk scoring.
Use this skill when investigating a security incident potentially tied to ransomware, when building detection rules informed by active actors, or when producing periodic threat intelligence reports for executive and operational stakeholders. It's intended for security analysts, threat intel teams, and SOC engineers working in isolated research environments.
This skill contains procedural Python examples and defensive analysis guidance; it is compatible with agents or tooling that can run Python notebooks or scripts (security research assistants, code-capable agents like Copilot/Code models) and with human analyst workflows.
This skill has not been reviewed by our automated audit pipeline yet.
