IOCs by window
5
IOCs tagged #ransomware
17
IOCs tagged #ransomware
102
IOCs tagged #ransomware
692
IOCs tagged #ransomware
Counts as of 2026-10-28. Regenerated daily.
About #ransomware
- Definition: Malware that encrypts data and demands payment for decryption.
- Double extortion: Often adds data theft and leak threats.
- Families: LockBit, BlackCat (ALPHV), Akira, Play, Royal, Hive, Conti (legacy), Clop, BianLian.
- Covers: Intrusion C2, data-leak sites, ESXi-targeting components.
- Detection: EDR rules, immutable backups, blocklists for C2 and staging URLs and IPs.
- ATT&CK: T1486, Data Encrypted for Impact.
- References: MITRE ATT&CK T1486 · CISA #StopRansomware · No More Ransom (decryptors).
Recent IOCs tagged #ransomware
Latest 10 IOCs from the past 30 days. Live JSON: api.tweetfeed.live/v1/month/ransomware.
| Date | Type | Value | Source |
|---|---|---|---|
| md5 | |||
| domain | |||
| url | |||
| domain | |||
| url | |||
| url | |||
| domain | |||
| url | |||
| ip | |||
| domain |
Related tags
Frequently asked questions
What is ransomware?
Malware that encrypts a victim's data and demands payment for the key. Modern operators also steal data and threaten to leak it.
Which ransomware operators produce the most IOCs in this feed?
Volume follows researcher coverage, so high-profile crews (LockBit while active, BlackCat/ALPHV, Akira, Play) tend to lead. Affiliate-driven RaaS produces more varied infrastructure.
How is this list updated?
The feed and the API update every 15 minutes from researcher posts on X. This page refreshes once a day.
What is the license? Can I use this commercially?
Yes. All IOC data, including this Ransomware subset, is CC0 1.0 Universal. No attribution needed. No warranty. The website code and branding are not CC0.
License
Ransomware IOC data: CC0 1.0 Public Domain. No attribution required, no warranty.