<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Performing Ransomware Negotiation Analysis — API Reference

## OFAC Sanctions Screening

```bash
# Check SDN list (Specially Designated Nationals)
# https://sanctionssearch.ofac.treas.gov/
# Must screen before ANY contact with threat actor

# Download consolidated list
curl -s "https://www.treasury.gov/ofac/downloads/sdn.csv" -o sdn.csv
grep -i "ransomware\|cyber" sdn.csv
```

## FBI IC3 Reporting

- URL: https://ic3.gov
- Report ransomware incidents for potential law enforcement action
- May have decryption keys from seized infrastructure

## Threat Intelligence Platforms

```bash
# Ransomwhere — ransomware payment tracking
curl -s "https://api.ransomwhe.re/group" | \
  jq '.result[] | select(.name | test("lockbit"; "i"))'

# Check known leak sites via threat intel feed
# Commercial: Recorded Future, DarkOwl, Flare, Searchlight
# Open: Ransomlook.io
```

## Communication Channel Types

| Channel | Tool | OPSEC Notes |
|---------|------|-------------|
| Tor .onion chat | Tor Browser | Use isolated VM |
| Tox messenger | qTox client | Disposable identity |
| ProtonMail | Web browser | Do not use corporate |
| Session messenger | Session app | No phone number needed |

## Leak Site Monitoring

```bash
# Monitor via Tor (use dedicated VM)
torsocks curl -s "http://[onion-address]/" --max-time 30

# Automated monitoring tools:
# - RansomLook: https://www.ransomlook.io
# - DarkFeed: https://darkfeed.io
# - Ransomware.live: https://ransomware.live
```

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `group_name` | Threat actor group | `LockBit`, `BlackCat` |
| `demand_amount` | Ransom demand | `$2,000,000 BTC` |
| `deadline` | Payment deadline | `2026-03-22T00:00:00Z` |
| `data_sensitivity` | Classification level | `critical`, `high` |
