{"id":2959,"url":"https://github.com/bbbbbrie/awesome-ransomware","name":"awesome-ransomware","description":"Curated list of ransomware-related resources; awesome style.","projects_count":55,"last_synced_at":"2026-10-09T18:00:32.806Z","repository":{"id":85872227,"uuid":"241016818","full_name":"bbbbbrie/awesome-ransomware","owner":"bbbbbrie","description":"Curated list of ransomware-related resources; awesome style.","archived":false,"fork":false,"pushed_at":"2025-01-17T03:33:46.000Z","size":38,"stargazers_count":35,"open_issues_count":0,"forks_count":3,"subscribers_count":2,"default_branch":"main","last_synced_at":"2026-09-20T02:09:01.990Z","etag":null,"topics":["awesome","ransomware"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/bbbbbrie.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2020-02-17T04:09:48.000Z","updated_at":"2026-08-12T04:20:07.000Z","dependencies_parsed_at":"2026-06-20T04:04:41.611Z","dependency_job_id":null,"html_url":"https://github.com/bbbbbrie/awesome-ransomware","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/bbbbbrie/awesome-ransomware","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bbbbbrie%2Fawesome-ransomware","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bbbbbrie%2Fawesome-ransomware/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bbbbbrie%2Fawesome-ransomware/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bbbbbrie%2Fawesome-ransomware/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/bbbbbrie","download_url":"https://codeload.github.com/bbbbbrie/awesome-ransomware/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bbbbbrie%2Fawesome-ransomware/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":343680568,"owners_count":38148032,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-09T02:00:07.585Z","response_time":55,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"created_at":"2024-01-04T20:19:44.554Z","updated_at":"2026-10-09T18:00:32.806Z","primary_language":null,"list_of_lists":false,"displayable":true,"categories":["Related Awesome Lists","🔭  Observing Ransomware Groups and Attacks","Books","📚  Books","Decryption Tools","🛠️  Tools","🗺️  Guides and Playbooks","Guides and Playbooks","🖼️  Infographics","Lists of Ransomware Families","🏡  Lists of Ransomware Families","ℹ️  Resources","🗞️ Articles and Essays of Note","Miscellaneous","Videos","📝 Ransomware Notes","🎥 Videos and 🎤 Podcasts"],"sub_categories":["✨  Other","🔐  Decrypters"],"readme":"# Awesome Ransomware ![Awesome](https://cdn.rawgit.com/sindresorhus/awesome/d7305f38d29fed78fa85652e3a63e154dd8e8829/media/badge.svg)  ![GitHub last commit](https://img.shields.io/github/last-commit/bbbbbrie/awesome-ransomware)\n\n\u003e A curated list of ransomware-related resources with a primary focus on research (rather than remediation).\n\n## 📚  Books\n  - [Ransomware Revealed](https://www.apress.com/gp/book/9781484242544) \n  - [Ransomware: Defending Against Digital Extortion](https://www.oreilly.com/library/view/ransomware/9781491967874/) - The O'Reilly book on ransomware\n  - [The Ransomware Hunting Team](https://us.macmillan.com/books/9780374603304/theransomwarehuntingteam)\n\n## 🗞️ Articles and Essays of Note\n\n- [The Ransomware Superhero of Normal, Illinois](https://www.propublica.org/article/the-ransomware-superhero-of-normal-illinois) [ 💾 [archive](https://archive.ph/6sWU0) ]\n- [Ransomware: Past, Present and Future](https://blog.talosintelligence.com/2016/04/ransomware.html) - Cisco Talos blog post on ransomware, vintage 2016\n- [Do you want to play a game? Ransomware asks for high score instead of money](https://arstechnica.com/gaming/2017/04/do-you-want-to-play-a-game-ransomware-asks-for-high-score-instead-of-money/) -- about [Rensenware](https://en.wikipedia.org/wiki/Rensenware)\n\n## 🛠️  Tools \n\n### 🔐  Decrypters\n\n  - [Emsisoft Ransomware Decryption Tools](https://www.emsisoft.com/ransomware-decryption-tools/)\n  - [Free Ransomware Decrypters | Kaspersky](https://noransom.kaspersky.com/)\n  - [List of Decryption Tools | Heimdal Security](https://heimdalsecurity.com/blog/ransomware-decryption-tools/) - A long list of decryption tools\n  - [No More Ransom](https://www.nomoreransom.org)\n  - [Trend Micro Ransomware File Decryptor](https://success.trendmicro.com/solution/1114221-downloading-and-using-the-trend-micro-ransomware-file-decryptor)\n  - [The Windows Club](https://www.thewindowsclub.com/list-ransomware-decryptor-tools) - A list of decryption tools\n\n### ✨  Other\n\n- [CryptoSearch](https://www.bleepingcomputer.com/download/cryptosearch/)\n- [RansomNoteCleaner](https://www.bleepingcomputer.com/download/ransomnotecleaner/)\n- [RAASNet](https://github.com/leonv024/RAASNet)\n  - The version above is no more: see [CesarAyalaDev/RAASNet](https://github.com/CesarAyalaDev/RAASNet)\n\n## 📝 Ransomware Notes\n\n\u003e AKA demands.\n\n- [Ransomware Notes](https://github.com/ThreatLabz/ransomware_notes)\n- Ransomware known file name ransom notes: [ransomware_notes_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/ransomware_notes_list.csv)\n- [Translated Conti Leaked Comms](https://gitlab.com/PX44b9RX9050/translated_conti_leaked_comms/-/tree/main?ref_type=heads)\n\n## 🗺️  Guides and Playbooks\n\n  - [Ransomware Playbook](https://www.rapid7.com/globalassets/_pdfs/whitepaperguide/rapid7-insightidr-ransomware-playbook.pdf) - Rapid7\n  - [Ransomware playbook (ITSM.00.099)](https://www.cyber.gc.ca/en/guidance/ransomware-playbook-itsm00099) - Canadian Centre for Cyber Security \n    - [PDF](https://www.cyber.gc.ca/sites/default/files/cyber/2021-12/itsm00099-ransomware-playbook-2021-final3-en.pdf)\n  - [Ransomware Template](https://github.com/counteractive/incident-response-plan-template/blob/master/playbooks/playbook-ransomware.md) from Counteractive\n  - [Microsoft DART ransomware approach and best practices](https://learn.microsoft.com/en-us/security/operations/incident-response-playbook-dart-ransomware-approach)\n\n## 🖼️  Infographics\n  - [Ransomware Families](https://heimdalsecurity.com/blog/wp-content/uploads/ransowmare-families-f-secure-1.jpg) - A diagram from F-Secure of ransomware families from 2012-2017.\n  - [A timeline of major ransomware events](https://kraftbusiness.com/wp-content/uploads/2019/01/history-evolution-of-ransomware.png)\n    - The link above is `404`: see [the timeline via the Wayback Machine](https://web.archive.org/web/20220121031312/https://kraftbusiness.com/wp-content/uploads/2019/01/history-evolution-of-ransomware.png).\n  - [Ransomware Attacks Map](https://statescoop.com/ransomware-map/) - An interactive map of known ransomware incidents in the US\n\n## 🏡  Lists of Ransomware Families\n  - [NJCCIC](https://www.cyber.nj.gov/threat-profiles/ransomware/) - From AutoLocky to Zepto\n  - [Ransomware Overview](https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/pubhtml) - A Google Sheets document shepherded by `@nyxbone` -- no longer actively updated\n\n## 🔭  Observing Ransomware Groups and Attacks\n\n  - [Ransomfeed](https://www.ransomfeed.it/)\n    - [nuke86/ransomFeed](https://github.com/nuke86/ransomFeed) on GitHub (a fork of `ransomwatch`)\n  - [Ransomlook](https://www.ransomlook.io/) - Notes and info on 150+ groups\n  - [Ransomware Live](https://www.ransomware.live/)\n  - [Ransomwatch](https://ransomwatch.telemetry.ltd/#/README) Observatory\n    - [✨ notable projects](https://ransomwatch.telemetry.ltd/#/sidecar-projects) list on `ransomwatch.telemetry.ltd`\n    - [joshhighet/ransomwatch](https://github.com/joshhighet/ransomwatch) on GitHub\n  - [Ransomware Tool Matrix](https://github.com/BushidoUK/Ransomware-Tool-Matrix) - [companoin blog post](https://blog.bushidotoken.net/2024/08/the-ransomware-tool-matrix.html)\n  - [Ransomware Vulnerability Matrix](https://github.com/BushidoUK/Ransomware-Vulnerability-Matrix/)\n  - [ransomware_gang.md](https://github.com/fastfire/deepdarkCTI/blob/main/ransomware_gang.md) in `fastfire/deepdarkCTI` on GitHub\n\n## ℹ️  Resources\n  - [Bleeping Computer's Ransomware Forum](https://www.bleepingcomputer.com/forums/f/239/ransomware-help-tech-support/)\n  - [ID Ransomware](https://id-ransomware.malwarehunterteam.com/)\n  - [Ransomware identification for the judicious analyst](https://www.gdatasoftware.com/blog/2019/06/31666-ransomware-identification-for-the-judicious-analyst)\n  - [Ransomware Reports](https://github.com/d4rk-d4nph3/Ransomware-Reports)\n  - [Yara rules for detecting ransomware](https://github.com/advanced-threat-research/Yara-Rules/tree/master/ransomware)\n  - [/r/ransomware](https://www.reddit.com/r/Ransomware/)\n  - [Ransomware Task Force](https://securityandtechnology.org/ransomwaretaskforce/)\n    - [RTF Report: Combating Ransomware](https://securityandtechnology.org/ransomwaretaskforce/report/) \n  -  Ransomware known file extensions: [ransomware_extensions_list.csv](https://github.com/mthcht/awesome-lists/blob/main/Lists/ransomware_extensions_list.csv)\n  - [EMPHASIS: Economical, Psychological and Societal Impact of Ransomware](https://www.emphasis.ac.uk/) -- no longer actively updated, still available for reference\n    \n## 🎥 Videos and 🎤 Podcasts\n\n  - [Darkode](https://www.wnycstudios.org/podcasts/radiolab/articles/darkode) - A well-produced Radiolab episode that follows a mother-daughter pair in the wake of a ransomware incident\n  - [SANS Ransomware Summit 2022](https://www.youtube.com/playlist?list=PLtgaAEEmVe6AGQj2LhA4UnN0XolmeYw9_)\n\n## Related Awesome Lists\n  - [awesome-incident-reponse](https://github.com/meirwah/awesome-incident-response)\n  - [awesome-malware-analysis](https://github.com/rshipp/awesome-malware-analysis)\n  - [Security lists for SOC/DFIR detections](https://github.com/mthcht/awesome-lists)","projects_url":"https://awesome.ecosyste.ms/api/v1/lists/bbbbbrie%2Fawesome-ransomware/projects"}