Ransomware.Live

Ransomware.live is a cybersecurity monitoring platform created by security researcher Julien Mousqueton. It tracks ransomware groups, their activity, and victim disclosures by continuously monitoring and scraping criminal leak sites. The service helps users follow reported cyberattacks and understand the evolving ransomware landscape through regularly updated information on groups, victims, negotiations, ransom notes, and payment demands.

The website offers a range of research and analysis tools, including live victim listings, group profiles, activity statistics, country and attack maps, and sector breakdowns. Visitors can explore ransomware tactics and indicators through its TTPs Matrix, YARA rules, KQL queries, and IoCs, as well as review vulnerabilities and infostealer-related information. The platform also provides press coverage and disclosure tracking, with details such as estimated attack dates, stolen data claims, and whether a victim disputes a report when such information is available. Ransomware.live is designed as an information resource for people monitoring cybercrime, helping them examine recent incidents and patterns across countries, industries, and ransomware groups.