ransomware

Ransomware group profile

One threat actor, aggregated from the cached ransomware.live datasets: {name, description, firstSeen, lastSeen, victimCount, attacksThisYear, countries[], sectors[], tools, onionSites, recentVictims[], totalVictimsFetched, negotiations, yaraRules, pressEntries}. Nullable where a dataset has nothing on the group; 404 when neither TTPs nor victims are known. pressEntries is newest first: entries attributed to the group (or, for lockbit, to a numbered release), and unattributed ones whose title names it as a ransomware; an entry dated more than a day ahead is dropped. Costs one request of the monthly quota.

get/ransomware/group-profile

Query parameters

groupstring

Group name (required), as listed by /ransomware/groups.

Response

{name, description, firstSeen, lastSeen, victimCount, attacksThisYear, countries, sectors, tools, onionSites, recentVictims, totalVictimsFetched, negotiations, yaraRules, pressEntries}

object required

Changes