Behavioral CTI profiles of ransomware negotiation chats — how each threat actor talks, pressures, and closes deals.
Perfis CTI do "dialeto" de negociação de 25 grupos ransomware — tom, táticas e playbook por ator.
Derived from Ransomchats (241 chats) + cross-references to ThreatLabz (notes), RTM (tools) and ThreatActors-TTPs (MITRE kill chain).
T-7d → T-1h T+0 T+N
RTM + crocodyli → ThreatLabz → RansomDialect (Ransomchats)
(intrusion/hunt) (ransom note) (negotiation chat)
| Idioma | Entrada |
|---|---|
| Português | pt/00-VISAO-GERAL.md → pt/ |
| English | en/00-OVERVIEW.md → en/ |
- 25 threat actor profiles — negotiation tone, pricing, pressure tactics, proof-of-decryption patterns
- Ransom note mapping — early attribution (T+0) via ThreatLabz/ransomware_notes
- Operational mapping — pre-extortion hunt/IR via Ransomware-Tool-Matrix + MITRE kill chain via ThreatActors-TTPs
- Comparative overview — taxonomy, cross-group insights, quick identification tables (ops + note + chat)
- Bilingual — full PT and EN versions
| Source | Role | Link |
|---|---|---|
| Ransomchats | Negotiation chats (T+N) — primary dataset | Casualtek/Ransomchats (MIT) |
| ThreatLabz | Ransom notes (T+0) — external mapping | ThreatLabz/ransomware_notes |
| RTM | Tools in intrusions (T-7d → T-1h) — hunt/IR | BushidoUK/Ransomware-Tool-Matrix |
| crocodyli | MITRE TTPs + CVEs — kill chain | crocodyli/ThreatActors-TTPs |
| Document | Description |
|---|---|
FONTES.md |
Origem dos dados + mapeamento de cada ator (PT) |
SOURCES.md |
Data origin + actor mapping (EN) |
notes_mapping.json |
Índice ator → ThreatLabz (21 mapeados, 4 sem entrada) |
operational_mapping.json |
Índice ator → RTM + crocodyli (20 RTM, 6 crocodyli) |
ransomwarelive_index.json |
Índice ator → URLs de perfil (integração ransomware.live) |
Also available: ransomch.at · ransomware.live
| Project | Relationship |
|---|---|
| Casualtek/Ransomchats | Primary data — negotiation chats |
| ThreatLabz/ransomware_notes | Ransom notes (T+0) — referenced, not vendored |
| BushidoUK/Ransomware-Tool-Matrix | Tools in intrusions — hunt/IR |
| crocodyli/ThreatActors-TTPs | MITRE TTPs — referenced, not vendored |
| ransomware.live | Live tracker + negotiations UI |
| Actor | Chats | PT | EN |
|---|---|---|---|
| Akira | 60 | pt/Akira.md | en/Akira.md |
| lockbit3.0 | 42 | pt/lockbit3.0.md | en/lockbit3.0.md |
| Conti | 32 | pt/Conti.md | en/Conti.md |
| REvil | 20 | pt/REvil.md | en/REvil.md |
Se estiver atualizando o repositório manualmente no GitHub, siga a ordem em UPLOAD.md.
MIT — see LICENSE.
Chat data © Casualtek/Ransomchats. Ransom notes © Zscaler ThreatLabz. Tool matrix © BushidoUK/RTM. TTP data © crocodyli. Profiles and analysis © RansomDialect contributors.
For research, defense, and threat intelligence only.