<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-ransomware-payment-infrastructure
description: >-
  Analyze ransomware payment infrastructure including cryptocurrency
  wallets, blockchain tracing, mixer/tumbler detection, ransom payment
  tracking, and threat actor financial profiling. Supports intelligence
  gathering for law enforcement and sanctions compliance — NOT payment
  facilitation.
domain: cybersecurity
subdomain: ransomware-defense
tags:
  - cryptocurrency
  - blockchain-analysis
  - bitcoin
  - monero
  - ransomware-payments
  - ofac-sanctions
  - financial-intelligence
  - threat-intelligence
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1486"]
---

# Analyzing Ransomware Payment Infrastructure

## Overview

Ransomware payment infrastructure analysis provides intelligence on threat
actor operations, sanctions compliance verification, and law enforcement
support. Understanding the payment chain — from ransom note wallet through
mixers to cash-out — helps attribute attacks and track criminal revenues.

This skill is for INTELLIGENCE purposes. It does NOT facilitate ransom
payments. Always involve law enforcement (FBI IC3, CISA) before any
payment-related analysis.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| blockchain.info API | BTC transaction lookup | Public API |
| Chainalysis OSINT | Wallet clustering | Free tier |
| OXT.me | Bitcoin explorer | Public |
| Blockchair | Multi-chain explorer | Public API |
| OFAC SDN List | Sanctions screening | Treasury download |

## Key Concepts

### Ransomware Payment Flow

```
Victim receives ransom note
  ├── BTC/XMR wallet address provided
  ├── OFAC sanctions check REQUIRED before any action
  │
  └── Payment chain (if made):
      Victim wallet → Ransom wallet → Peel chain
        ├── Mixing service (ChipMixer, Tornado Cash)
        ├── Cross-chain swap (BTC → XMR)
        ├── Nested exchange (KYC bypass)
        └── Cash-out exchange (high-risk jurisdiction)
```

### Cryptocurrency Preferences by Group

| Group | Primary Currency | Secondary | Mixer Used |
|-------|-----------------|-----------|------------|
| LockBit | BTC | XMR (discount) | Chain-hopping |
| BlackCat/ALPHV | BTC | XMR | Cross-chain swap |
| Cl0p | BTC | — | Peel chains |
| Royal | BTC | — | Multiple wallets |
| Black Basta | BTC | XMR | Sinbad mixer |

### Blockchain Analysis Concepts

```
Key techniques:
├── Wallet clustering — group addresses owned by same entity
├── Peel chain analysis — track small amounts peeled off
├── Mixer detection — identify known mixer input/output patterns
├── Exchange attribution — map deposits to known exchanges
├── Cross-chain tracking — BTC → XMR → BTC swaps
└── Temporal analysis — timing patterns in transactions
```

## Workflow

### Step 1 — Extract Wallet Address from Ransom Note

```bash
# Extract BTC addresses from ransom note (P2PKH, P2SH, Bech32)
grep -oE '[13][a-km-zA-HJ-NP-Z1-9]{25,34}' /evidence/ransom_note.txt
grep -oE 'bc1[a-z0-9]{39,59}' /evidence/ransom_note.txt

# Extract XMR addresses
grep -oE '4[0-9AB][1-9A-HJ-NP-Za-km-z]{93}' /evidence/ransom_note.txt
```

### Step 2 — OFAC Sanctions Screening

```bash
# Download current SDN list
curl -s "https://www.treasury.gov/ofac/downloads/sdn.csv" -o /tmp/sdn.csv

# Search for wallet address
WALLET="bc1qexampleaddress123"
grep -i "$WALLET" /tmp/sdn.csv

# Check OFAC Specially Designated Nationals list online
# https://sanctionssearch.ofac.treas.gov/
# Search by cryptocurrency address

# CRITICAL: If wallet appears on SDN list, payment is ILLEGAL
# Under US law (IEEPA), penalties up to $20M or criminal prosecution
```

### Step 3 — Blockchain Transaction Analysis

```bash
# Query BTC address via blockchain.info
ADDR="bc1qexampleaddress123"
curl -s "https://blockchain.info/rawaddr/$ADDR" | \
  jq '{
    address: .address,
    total_received_btc: (.total_received / 100000000),
    total_sent_btc: (.total_sent / 100000000),
    n_tx: .n_tx,
    final_balance_btc: (.final_balance / 100000000)
  }'

# Get transaction history
curl -s "https://blockchain.info/rawaddr/$ADDR" | \
  jq '.txs[:10] | .[] | {
    hash: .hash,
    time: (.time | todate),
    total_output_btc: ([.out[].value] | add / 100000000)
  }'
```

### Step 4 — Blockchair Multi-Chain Analysis

```bash
# BTC address summary
curl -s "https://api.blockchair.com/bitcoin/dashboards/address/$ADDR" | \
  jq '.data[].address'

# Check for known entity attribution
curl -s "https://api.blockchair.com/bitcoin/dashboards/address/$ADDR" | \
  jq '.context'

# Transaction details
TX_HASH="abc123..."
curl -s "https://api.blockchair.com/bitcoin/dashboards/transaction/$TX_HASH" | \
  jq '.data[].inputs, .data[].outputs'
```

### Step 5 — Ransomware Payment Tracking

```bash
# Ransomwhere API — known ransomware payments database
curl -s "https://api.ransomwhe.re/transactions" | \
  jq '.result | sort_by(.amount) | reverse | .[:10] | .[] | {
    address: .address,
    amount_usd: .amount,
    blockchain: .blockchain,
    family: .family
  }'

# Query specific group
curl -s "https://api.ransomwhe.re/group" | \
  jq '.result[] | select(.name | test("lockbit"; "i")) | {
    name: .name,
    total_paid_usd: .totalPaidUSD,
    total_transactions: .transactions
  }'
```

## Detection

```yaml
title: Ransomware Payment Infrastructure Detection
id: bf7c7e2d-ffe5-47f1-8cc3-b9e9118fc1f3
status: experimental
description: Detects suspicious activity related to analyzing ransomware payment infrastructure techniques in ransomware defense context
logsource:
  category: file_change
  product: windows
detection:
  selection:
    TargetFilename: "*suspicious*"
  condition: selection
level: critical
tags:
  - attack.t1486
  - attack.impact
falsepositives:
  - Backup software performing scheduled file encryption operations
```

## Verification

- [ ] Wallet addresses extracted from ransom note
- [ ] OFAC sanctions screening completed for all addresses
- [ ] Blockchain analysis reveals transaction history
- [ ] Known entity attribution checked (exchanges, mixers)
- [ ] Law enforcement (FBI IC3) notified with wallet intelligence
- [ ] Payment analysis documented for legal/insurance
- [ ] NO payment facilitated without legal authorization

## References

- OFAC Ransomware Advisory: https://ofac.treasury.gov
- Ransomwhere Payment Tracker: https://ransomwhe.re
- Chainalysis Ransomware Reports
- MITRE ATT&CK T1486: Data Encrypted for Impact
- FinCEN Advisory on Ransomware (FIN-2020-A006)
