crocodyli/threatactors-ttpsRepository created to share information about tactics, techniques and procedures used by threat actors. Initially with ransomware groups and evolving to other types of threats.
This repository was created with the aim of assisting companies and independent researchers in studying the Tactics, Techniques, and Procedures (TTPs), based on the MITRE ATT&CK framework, adopted by active or inactive Ransomware operators/groups and other Threat Actors.
This content includes TTP mapping, the history of activities, and the record of exploited CVEs (Common Vulnerabilities and Exposures). Furthermore, I am including data on commands, tools, and useful locations for researching artifacts in the DFIR/CTI field.
The primary focus is to offer a summary of each actor's trajectory, providing essential information that can be utilized by security organizations and individual researchers.
This project relies on contributions from various researchers in the community. The data collected here is also intended to serve as a resource for other security projects, such as RANSOMWARE.LIVE (accessible at: https://www.ransomware.live/), fostering a wider collaboration ecosystem.
| FOLDER | DESCRIPTION |
|---|---|
| Actor's Name | Detailed profile containing: , of the group, and a list of exploited (where applicable). |
The goal is to map all possible strategies adopted by Ransomware operators, and contributions are highly welcome!
| Commands | Repository designed to insert commands captured based on DFIR and CTI activities of Threat Actors, Ransomware groups, and affiliates. |
| Payload locations | Repository designed to inform locations commonly used for the execution of ransomware and other threats. |
