Ransomware intelligence / ransomware.live
Follow the evidence.
Connect a group to its reported indicators, vulnerabilities and techniques.
Select a suggestion to focus the evidence.
Groups with reported evidence
CVEs to investigate
SwiftIOC matches first. Confirm affected software in the CVE view.
What changed?
Newly observed by SwiftIOC—not necessarily newly exploited. Missing associations do not mean safe or inactive.
Hunt this group
Download IOC searches, a CVE review checklist, technique references and evidence receipts in one JSON pack. Nothing is executed automatically.
All-index searches can be expensive. Prefer indexes containing the relevant telemetry and verify your field mappings. A feed match is not independent corroboration.
| Evidence | Coverage | Reported groups | Investigate |
|---|
Bounded evidence network
Trace a reported connection
Explore direct group-to-record links. Select an evidence node to inspect its source, or a group to pivot. Proximity and layout do not imply attribution or collaboration.
Read the displayed connections as a list
How to read this evidence
These are associations reported by ransomware.live. They do not establish current use, local exposure, a shared campaign, or collaboration between groups. Group techniques describe the group’s reported behavior; they are not automatically attributed to each IOC.
“In SwiftIOC” means an exact record match in the retained feed. Research candidates do not automatically enter scores or blocklists. An empty result does not prove a group has no such activity.
Source data refreshes daily; SwiftIOC matches are checked each collection. Source: ransomware.live. Download derived evidence JSON.