Ransomware resources
Family identification, free decryptors, group tracking and response frameworks. A short annotated selection, not an index of everything that exists.
If you are in the middle of an incident
This page is not your first step. Isolate affected systems without powering them off, preserve memory and logs before they rotate, leave the backups alone until you know whether they are compromised, and call. The window in which the evidence still exists is measured in hours.
Before you consider paying
A non-trivial share of cases is resolved here, with no transaction and no negotiation. This is always the first step.
No More Ransom
DecryptorsA Europol, Dutch police, Kaspersky and McAfee initiative. Its Crypto Sheriff identifies the family from the ransom note and an encrypted file, and hands over the decryptor if one exists. Free, and in several languages. Start here before anywhere else.
ID Ransomware
IdentificationFrom MalwareHunterTeam. Recognises over a thousand families from the note, the extension or a sample of the encrypted file. Faster than Crypto Sheriff for initial triage: it tells you what you are facing before you make expensive decisions.
Emsisoft decryptors
DecryptorsTheir own collection, including tools not listed on No More Ransom. Read each instruction PDF: several require a matched pair of encrypted and original file to derive the key.
Which group you are dealing with
None of these links leads to extortion infrastructure. They are research projects publishing profiles, statistics and historical series. INSIDEROPS does not publish .onion addresses of ransomware groups.
Ransomware.live
TrackingThe most consulted tracker in the field. Group profiles, published victims, an open API and feeds. It lets you answer within the hour the question every board ends up asking: what is this group's track record, and what do they do with the data once they are paid.
RansomLook
TrackingAggregator of leak sites, channels and profiles, with a per-group record and history. A useful cross-check when it and Ransomware.live disagree, which happens more often than you would expect.
ransomwatch
DataThe project that popularised automated leak-site monitoring. Its strength is that the data lives in Git: you can build your own time series without depending on a website still being up next year.
MyThreatIntel
DashboardA Spanish-language ransomware intelligence dashboard. Its advantage over the international aggregators is language and focus: for presenting the picture to a Spanish committee, a panel in their own language saves half a meeting of translation.
RansomFeed
StatisticsSeries by country and sector. Useful when you have to justify to a committee why your specific vertical warrants budget and the global average will not do.
Response frameworks
What you will be asked for in writing once the urgency passes.
CCN-CERT
SpainCCN-STIC guidance, advisories and tooling from Spain's National Cryptologic Centre. Mandatory reading where the Spanish public sector is involved, and worth reading even where it is not.
INCIBE-CERT
SpainBusiness-oriented guidance and a notification channel. Their 017 line serves organisations with no team of their own.
#StopRansomware Guide
PlaybookJoint guidance from CISA, FBI, NSA and MS-ISAC. Its response checklist is the most practical in circulation, and it is written to be executed on the day rather than read.
NIST IR 8374
GovernanceThe NIST framework profile for ransomware risk, with a revision aligned to CSF 2.0. This is the piece that translates a technical problem into the language of governance and the board.
The DFIR Report
Case studiesReal intrusions narrated with timelines, TTPs, artefacts and detection rules. If you read one source a year to understand how they actually get in, make it this one.
Last reviewed:
Start with the scope
A thirty-minute conversation is enough to determine whether the engagement makes sense, which type fits and what order of magnitude it carries. No cost, no commitment.