from asi23
Collect and analyze ransomware data-leak site (DLS) posts to extract victim, group, sector and geographic trends for threat intelligence and proactive defense.
This skill provides a reproducible workflow to safely collect, parse, and analyze ransomware data-leak site (DLS) postings from public tracking feeds. It shows how to ingest victim posts (e.g. Ransomwatch), extract structured fields (group, sector, country, discovery date), compute group activity trends, assess sector/geographic risk, and produce an intelligence report with recommendations for SOCs and defenders. The materials include Python examples and analysis patterns for monthly trend aggregation, new-group detection, and sector-level risk scoring.
Use this skill when investigating a security incident potentially tied to ransomware, when building detection rules informed by active actors, or when producing periodic threat intelligence reports for executive and operational stakeholders. It's intended for security analysts, threat intel teams, and SOC engineers working in isolated research environments.
This skill contains procedural Python examples and defensive analysis guidance; it is compatible with agents or tooling that can run Python notebooks or scripts (security research assistants, code-capable agents like Copilot/Code models) and with human analyst workflows.
Ransomware leak site intelligence skill that fetches victim data from public GitHub feeds (ransomwatch), analyzes group activity trends, assesses sector/geographic risk, and generates threat intel reports. No bundled scripts — all code is inline in SKILL.md as Python examples. Well-written educational content but demo-style code rather than production tooling. Safe: uses public data sources, explicitly advises against direct DLS access.
Legitimate cybersecurity/threat-intelligence skill. Code fetches from well-known public GitHub repos (ransomwatch). No security concerns. Architecture is flat — all code embedded in SKILL.md with no scripts/ directory. Useful for SOC teams but niche audience.
