<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-ransomware-threat-intelligence
description: >-
  Collect, analyze, and operationalize ransomware threat intelligence from
  dark web forums, leak sites, OSINT feeds, and commercial CTI platforms.
  Track ransomware group TTPs, affiliate tooling evolution, negotiation
  patterns, and victim targeting criteria. Produce finished intelligence
  products for executive and SOC audiences.
domain: cybersecurity
subdomain: ransomware-defense
tags:
  - threat-intelligence
  - cti
  - ransomware-groups
  - dark-web-monitoring
  - ioc-collection
  - ttp-tracking
  - misp
  - stix-taxii
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1486"]
---

# Performing Ransomware Threat Intelligence

## Overview

Ransomware threat intelligence transforms raw data — IOCs, dark web
forum posts, leak site activity, and malware samples — into actionable
intelligence that drives defensive prioritization. Effective CTI answers:
which groups target our sector, what TTPs do they use, and what indicators
should our detection stack prioritize.

The ransomware ecosystem is an economy: initial access brokers sell
footholds, affiliates deploy payloads, and operators manage infrastructure.
Understanding this supply chain enables proactive defense.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| MISP | Threat intel sharing platform | Docker or package |
| OpenCTI | CTI knowledge management | Docker deploy |
| yara | Malware pattern matching | `pip install yara-python` |
| jq | JSON processing | `apt install jq` |
| curl | API interaction | Built-in |

## Key Concepts

### Ransomware Intelligence Requirements

```
IR-1: Which ransomware groups actively target our industry sector?
IR-2: What initial access vectors are these groups currently using?
IR-3: What is the typical dwell time and TTP progression?
IR-4: Are any of our assets listed on leak sites or IAB forums?
IR-5: What IOCs are associated with active campaigns?
IR-6: What decryptors or LE disruptions affect active groups?
```

### Ransomware Ecosystem Actors

| Actor Type | Role | Intelligence Value |
|-----------|------|-------------------|
| RaaS Operators | Build/maintain ransomware platform | TTP patterns, infra |
| Affiliates | Conduct intrusions, deploy payloads | IOCs, tooling |
| Initial Access Brokers | Sell network access | Early warning |
| Negotiators | Handle ransom payments | Pricing models |
| Data Brokers | Sell stolen data post-exfil | Exposure monitoring |

## Workflow

### Step 1 — Collect IOCs from Public CTI Feeds

```bash
# Fetch latest ransomware IOCs from abuse.ch
curl -s "https://bazaar.abuse.ch/export/json/recent/" | \
  jq '[.data[] | select(.tags[]? | contains("ransomware")) |
  {sha256: .sha256_hash, family: .signature, first_seen: .first_seen}]' | \
  head -100

# Fetch ransomware C2 indicators from ThreatFox
curl -s -X POST "https://threatfox-api.abuse.ch/api/v1/" \
  -d '{"query": "taginfo", "tag": "ransomware", "limit": 50}' | \
  jq '.data[:20]'
```

### Step 2 — Track Ransomware Group Activity via MISP

```bash
# Search MISP for ransomware events in our sector
curl -sk "https://<MISP_URL>/events/restSearch" \
  -H "Authorization: <MISP_API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{
    "tags": ["ransomware", "lockbit", "blackcat", "clop"],
    "published": true,
    "limit": 25,
    "order": "date desc"
  }' | jq '.response[].Event | {id, info, date}'

# Export IOCs in STIX format for ingestion
curl -sk "https://<MISP_URL>/events/restSearch" \
  -H "Authorization: <MISP_API_KEY>" \
  -d '{"tags": ["ransomware"], "returnFormat": "stix2"}' \
  -o ransomware_stix.json
```

### Step 3 — Monitor for Organization Exposure

```bash
# Check Shodan for exposed infrastructure
curl -s "https://api.shodan.io/shodan/host/search?key=<SHODAN_KEY>&query=org:<ORG>+port:3389" | \
  jq '.matches[] | {ip_str, port, product, org}'

# Check Have I Been Pwned for domain exposure
curl -s "https://haveibeenpwned.com/api/v3/breaches" \
  -H "hibp-api-key: <API_KEY>" | \
  jq '[.[] | select(.DataClasses[]? | contains("Passwords")) |
  {Name, BreachDate, PwnCount}]' | head -50
```

### Step 4 — Build TTP Coverage Map

```bash
# Query MITRE ATT&CK for ransomware group techniques
curl -s "https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json" | \
  jq '[.objects[] | select(.type == "intrusion-set" and
  (.aliases[]? | ascii_downcase | test("lockbit|blackcat|clop"))) |
  {name, aliases, description: .description[:200]}]'
```

## Detection

```yaml
title: Ransomware Threat Intelligence Detection
id: 00c469a5-114b-402a-98fd-968aac884097
status: experimental
description: Detects suspicious activity related to performing ransomware threat intelligence techniques in ransomware defense context
logsource:
  category: file_change
  product: windows
detection:
  selection:
    TargetFilename: "*suspicious*"
  condition: selection
level: critical
tags:
  - attack.t1486
  - attack.impact
falsepositives:
  - Backup software performing scheduled file encryption operations
```

## Verification

- [ ] CTI feeds automated and ingesting IOCs into SIEM within 15 minutes
- [ ] Ransomware group profiles maintained for top 5 sector-relevant groups
- [ ] Dark web monitoring active for organization name and key domains
- [ ] Weekly CTI briefing produced for SOC team with actionable indicators
- [ ] MISP instance sharing/receiving from sector ISACs
- [ ] Detection coverage mapped against tracked group TTPs

## References

- MITRE ATT&CK Groups: Ransomware Operator Profiles
- CISA StopRansomware.gov: Advisory Feed
- abuse.ch Bazaar / ThreatFox: IOC Feeds
- Mandiant Advantage: Threat Intelligence Platform
- FIRST TLP Protocol: Intelligence Sharing Classifications
