Live feed
Victim announcements with group, domain and time.
RANSOM Live victim posts from leak sites
Ransomware Telemetry
Announcements on ransomware groups' leak sites stream live; tracked groups, online status, 24-hour / 30-day / 90-day posts, mirrors and markets on one screen.
Screenshots are taken from a demo tenant; organisation names and data are entirely fictional.
Each record in the live feed arrives with a group tag, the victim's domain, a description and time of publication; the groups tab shows each group's activity separately. The most active groups of the last 7 days are ranked in the trending list. The "Ransomware — sector/country" playbook opens an early-warning case when a victim in your sector is announced.
What it does
Group status
Online groups, mirrors and markets are counted.
Sector alert
A playbook case opens when your sector or country appears.
What you get
- You are the first to hear when a supplier is named.
- A campaign wave in your sector is seen early.
- Management gets a concrete ransomware picture.
Scenarios featuring this module
A ransomware crew shifting target sectors
Leak site telemetry showed a clear sector and geography shift in the crew's victim distribution.
3 modules
Next step
What shows up on your own surface?
In a 30-minute session we run a live scan against your own domains.