Skip to content
Get packs

Ransomware Leak Site Intelligence

Summarises ransomware group victim postings and trends from public tracking feeds for threat reports

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

This skill teaches an AI agent how to collect public victim-posting data that ransomware gangs publish on their leak sites, from community tracking feeds such as Ransomwatch or ransomware.live rather than directly from the criminal sites. The agent can then turn that data into structured tables, track which groups and sectors are most active over time, and draft risk assessments for defenders. It is aimed at defensive threat intelligence work, not at accessing criminal infrastructure.

Great for

  • Threat intelligence analysts producing periodic ransomware trend reports
  • Security teams wanting sector or regional risk summaries to inform proactive defence
  • Students or researchers studying double-extortion ransomware activity

Skip it if

  • Anyone wanting to visit or browse ransomware Tor sites directly, since the skill itself warns against this and it carries malware and legal risk
  • Legal or compliance decisions about a specific victim, because the data comes from unverified criminal postings that may be inaccurate or incomplete
  • Real-time incident response, since feed data is delayed and may lag actual listings

Try asking

  • “Summarise the ransomware groups that posted the most victims in the last 30 days and show monthly trends”
  • “Build a table of victims in the financial sector in Europe from recent leak-site postings”
  • “Compare activity of LockBit, Akira and Play over the past six months”
  • “Draft a sector-specific ransomware risk assessment for a healthcare organisation”
Step-by-step guide: how to use Ransomware Leak Site IntelligenceInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-ransomware-leak-site-intelligence.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-ransomware-leak-site-intelligence.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-ransomware-leak-site-intelligence.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Use the community feeds (Ransomwatch, ransomware.live) rather than onion-site access, and review the bundled scripts before running them
  • Treat victim names and posted data as unverified claims; confirm before acting on them
  • Ask for outputs with dates and sample sizes so trends can be checked against the source feed

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.