Recent reporting sample
Aggregate reporting context—not a measure of prevalence or confirmed attacks.
Ransomware decision support
Turn evidence into the next defensive action.
Prioritize, compare, validate coverage, triage evidence and build reviewable response packs.
Loading cached intelligence…
Unusual evidence change
Compared with the previous local observation window. Baseline needs time to mature.
Groups in recent reports
Sector and country radar
Explainable review queue
Group-reported IOCs begin as research candidates, not confirmed detections or a blocklist. Completed local reviews leave the default queue; they never change the published feed.
Open an exported evidence case
Case files stay in this browser. Reopening compares the saved provider snapshot with the current one; it does not restore or change local decisions.
Group DNA comparison
Similarity means shared reporting only. It does not establish shared operators, tooling or attribution.
Defensive coverage matrix
Select telemetry you actually retain. Settings stay in this browser. Broad telemetry matches are only a starting point; review the linked MITRE detection strategies and their exact log requirements, then test a detection locally.
Incident triage
Enter one exact IOC, CVE, ATT&CK ID or group. SwiftIOC will not guess partial identities.
Private exposure check
Paste CVE IDs or exact indicators from your asset and security inventories. The text is processed in your browser and is never uploaded or saved.
Private exposure watchlist
Track exact groups, evidence, countries and sectors. Values stay in local browser storage and are never sent to SwiftIOC or ransomware.live.