Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks
Ransomware.live is a free, independent, and continuously updated threat intelligence platform tracking ransomware groups and their victims worldwide. It passively monitors ransomware groups' Data Leak Sites (DLS), aggregates publicly disclosed victim data, and presents it in a structured, actionable format — no paywall, no ads, no corporate backing.
The platform serves cybersecurity professionals, journalists, researchers, and incident responders who need reliable, real-time situational awareness of the ransomware landscape. It does not host or distribute any leaked data, and does not engage in speculation or intrusion — only what is already publicly visible on the internet.
Ransomware gangs run their own websites, usually hidden on the dark web, where they publicly name the companies they claim to have attacked. Ransomware.live reads those public announcements for you, around the clock, in three steps.
Several times a day, the platform visits every known leak site and keeps a copy of the page, much like photographing a public noticeboard. Nothing is downloaded from the victims, and no stolen files are ever collected.
Every gang presents its announcements differently, so each one has its own small reader that extracts the facts: which company was named, by whom, when, and what the attackers claim. Nothing is guessed or added.
A bare company name says little, so each claim is completed with country and business sector, website details, a capture of the gang's post, and what is known about the group's habits and tools.
The result is a single, searchable timeline of who was attacked, by which group, and when, available on the website, through the API, or as a feed.
Ransomware.live enriches its data thanks to the work of these researchers and organizations:
Hosting, the domain, and AI enrichment all have a cost. If Ransomware.live has been useful to you, consider buying a coffee — it keeps the site independent and free for everyone.
If you need to reach us confidentially — to report sensitive information, raise a privacy concern, or share threat intelligence discreetly — please use our PGP-encrypted email.
-----BEGIN PGP PUBLIC KEY BLOCK----- mDMEaglsChYJKwYBBAHaRw8BAQdAKctkDptJn2f3RlhUfCKYf4M55rg1oELxvuci 1LBfrwi0K0p1bGllbiBNb3VzcXVldG9uIDxzdXBwb3J0QHJhbnNvbXdhcmUubGl2 ZT6ItQQTFgoAXRYhBO13cCktJkFA3XKWLeXBpZPqkZyRBQJqCWwKGxSAAAAAAAQA Dm1hbnUyLDIuNSsxLjEyLDAsMwIbIwUJA8JnAAULCQgHAgIiAgYVCgkICwIEFgID AQIeBwIXgAAKCRDlwaWT6pGckankAP972m77YldCGjJAs7jJIWLkj+UyAUwWyUXs k51GYpZdAgEAwTtL+2/j6G3XdNslV93Pvx6VL1qvGYe7rxabaioDlAG4OARqCWwK EgorBgEEAZdVAQUBAQdAyEC4zK4OsT4/Q05nsB+AUv/WpHknn87dMm1SSN0i0zID AQgHiJoEGBYKAEIWIQTtd3ApLSZBQN1yli3lwaWT6pGckQUCaglsChsUgAAAAAAE AA5tYW51MiwyLjUrMS4xMiwwLDMCGwwFCQPCZwAACgkQ5cGlk+qRnJFHHwD/Uzi8 UQfogQfdHEOQ6c+7vwyCVfitWnqBHFQxeu5EsgYA/2K9Hi9szWrHsw7KxUPgVYeC u9dBSD2LS3r80dd2aPkL =SWfd -----END PGP PUBLIC KEY BLOCK-----
Ransomware.live does not host or distribute any leaked data. All content is derived from:
The platform does not encourage or facilitate cybercrime. Its sole purpose is transparency and awareness.
For the full legal disclaimer, see ransomware.live/disclaimer.
If you believe a published item is incorrect or raises a privacy concern, contact supportransomware.live. Requests are evaluated in accordance with the project's ethical guidelines.