Tools

neo23x0/raccine

A Simple Ransomware Vaccine

vxunderground/threatintelligencediscordbot

Gets updates from various clearnet domains and ransomware threat actor domains

rivitna/malware

Curated YARA rules and detection programs for identifying ransomware families, providing signature-based indicators for malware triage, threat…

ransomlook/ransomlook

Yet another Ransomware gang tracker

threatlabz/tools

Tools developed by the Zscaler ThreatLabz Threat Intelligence team

prodaft/malware-ioc

This repository contains indicators of compromise (IOCs) of our various investigations.

soufianetahiri/esxi_ransomware_bitcoinwallets

ESXi semi-automated ransomware attacks bitcoin wallets

fabrimagic72/malware-samples

A collection of malware samples caught by several honeypots i manage

bushidouk/ransomware-tool-matrix

A resource containing all the tools each ransomware gangs uses

cert-orangecyberdefense/ransomware_map

Map tracking ransomware, by OCD World Watch team

synacktiv/hexalocker-analysis

HexaLocker ransomware analysis

corelight/detect-ransomware-filenames

Zeek script that monitors SMB traffic and alerts on known ransomware filenames using the Anti-Ransomware File System Resource Manager list.

mthcht/awesome-lists

Curated repository of threat intelligence feeds, IoC lists, YARA rules, and DFIR tool references for SOC/CERT/CTI detection and incident response.

vignesh-hp/lockbit-ransomware-analysis

Threat intelligence and incident response case study on LockBit ransomware exploiting CVE-2023-4966 (Citrix Bleed).

stevenblack/hosts

🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories.

limo57640-crypto/cpanel-cve-41940-detector

Read-only cPanel CVE-2026-41940 IOC detector for .sorry ransomware, Mr_Rot13 Filemanager backdoors, C2 callbacks, cron, SSH, and logs.

justjeff211/conti-ransomware-writeup

Conducted a full SOC investigation into a Conti ransomware compromise of an Exchange server using Splunk 8.2.2. Analysed 28,145 events across Windows…