How to use the Ransomware Leak Site Intelligence agent skill

What the skill makes the agent do

Ransomware groups using double-extortion tactics encrypt victim data and also steal it. They publish victim names, sample data and countdown timers on data leak sites (DLS), which are hosted on Tor. This skill teaches the agent to gather that public posting data from tracking feeds such as Ransomwatch and ransomware.live, rather than from the criminal sites themselves.

Once collected, the agent can extract structured victim records, track which groups and sectors are most active over time, and draft sector- and geography-specific risk assessments for defenders.

• Collect victim posts from public community feeds
• Count victims per group and per month to show trends
• Produce sector and country risk summaries for proactive defence reporting

Install the skill from the ZIP

Download the skill ZIP from this page and unzip it. For a personal setup, place the unzipped folder in ~/.claude/skills/. To scope it to one project, place it in that project's .claude/skills/ folder.

In the Claude apps you can instead upload the ZIP under Settings → Capabilities → Skills.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Check the requirements before you start

The skill needs Python 3.9 or later with the requests, beautifulsoup4, pandas and matplotlib libraries. It also needs internet access to fetch public tracking feeds from GitHub raw content and the ransomware.live API.

• Python 3.9+
• Python libraries: requests, beautifulsoup4, pandas, matplotlib
• Internet access to GitHub raw content and the ransomware.live API
• Optional: a Tor SOCKS5 proxy, and commercial feeds such as KELA, Flashpoint or DarkFeed (these may need accounts or API keys)

Trigger the skill with natural requests

You do not need special syntax. Describe the analysis you want in plain language and the agent will use the skill when the request matches its purpose. Good requests name the outcome, the time window and, if relevant, a sector or country.

• Summarise ransomware group activity from public leak-site feeds for the last 30 days.
• Which ransomware groups posted the most victims this quarter, and how did that change month to month?
• Draft a risk summary for manufacturing organisations in Germany based on recent leak-site postings.
• Build a chart of monthly victim counts per group from the Ransomwatch data.

Example workflow

The skill's workflow has three stages. First the agent fetches posts and group profiles from Ransomwatch and loads recent victims for a chosen window. Next it groups posts by group and by month to find the most active groups and trends. Finally it assesses sector and geographic risk from the fields the feed provides. Not every post includes a sector, so the agent's sector figures depend on the data available.

• Fetch: Ransomwatch posts.json and groups.json from GitHub raw content
• Analyse: group totals and monthly counts
• Assess: sector and country breakdowns for defensive reporting

Safety notes: scripts and network access

This skill runs Python scripts and uses the network. The skill itself says never to access DLS sites directly in a production environment and to use purpose-built monitoring services, Tor-isolated research VMs or community datasets instead. Do not ask the agent to browse ransomware Tor sites, because of malware and legal risk.

Feed data comes from unverified criminal postings and may be inaccurate, incomplete or delayed. Do not use it for legal or compliance decisions about a specific victim, or for real-time incident response.

• Review the scripts/agent.py file before running it.
• Run analysis in an isolated environment with appropriate authorisation.
• Treat results as trend indicators, not confirmed facts about any victim.

Tips for better results

Name the feed you want, such as Ransomwatch or ransomware.live, so the agent uses a known source. Ask for a fixed time window so trend comparisons are consistent. Ask the agent to state data limits in its report, including missing sector or country fields.

• Specify the time window, for example the last 30 days.
• Ask for tables and charts when you need to share results.
• Use the references/api-reference.md file to check endpoint details.