Check that the configured RANSOMWARE_LIVE_API_KEY is valid and active.

Returns the client identifier tied to the key. Run this first when any other tool reports an authentication failure.

Get platform-wide totals: victim count, tracked group count, press entry count, and the timestamp of the most recently discovered victim.

Useful as a cheap freshness check before running larger queries.

List all tracked ransomware groups alphabetically with victim counts.

Each entry has group (the lowercase name used by every other tool), altname, and victims. Call this to resolve a group name before using get_group, get_group_iocs, get_yara_rules and similar.

Get a full intelligence profile for one ransomware group.

Includes background description, first/last seen dates, victim count, known leak-site URLs (Tor and clearweb), MITRE ATT&CK TTPs, exploited CVEs with CVSS scores, tools and malware used, and flags for whether negotiation chats and ransom notes are on file.

Args: group_name: Group name, case-insensitive (e.g. "lockbit3", "blackcat", "clop").

List every victim sector/industry value with a victim count per sector.

The sector values returned here are the valid inputs for the sector filter on search_victims and filter_victims.

Get the 100 most recent active ransomware victims.

Args: order: "discovered" (when ransomware.live first saw the leak-site listing) or "attacked" (estimated attack date). limit: Max records to return (1-200). offset: Skip this many records; use next_offset from a prior call. full: Return every enrichment field (screenshot URL, infostealer data, press link, permalink) instead of the slimmed core fields.

Free-text search across victim organisation names and website domains.

q is matched case-insensitively as a substring of both the victim name and the website. The other filters narrow further with AND logic.

Args: q: Keyword, e.g. "hospital", "university", "acme". group: Exact group name, case-insensitive (see list_groups). sector: Exact sector name (see list_sectors). country: ISO 3166-1 alpha-2 country code, e.g. "US", "FR", "DE". order: Sort by "discovered" or "attacked". limit: Max records to return (1-200). offset: Skip this many records; use next_offset from a prior call. full: Include all enrichment fields.

Filter the full victim database by group, sector, country and date.

At least one filter is required, and all filters combine with AND logic. year cannot be used alone: the API rejects it unless month is also set. Use this rather than search_victims when you want an exact-match slice (e.g. every LockBit victim, or all US healthcare victims in June 2024).

Args: group: Exact group name, case-insensitive (see list_groups). sector: Exact sector name (see list_sectors). country: ISO 3166-1 alpha-2 country code, e.g. "US". year: 4-digit year, e.g. "2024". Must be paired with month. month: 2-digit month, e.g. "06". Requires year. date: Which date field to filter on, "discovered" or "attacked". limit: Max records to return (1-200). offset: Skip this many records; use next_offset from a prior call. full: Include all enrichment fields.

Get the full enriched record for one victim by its Base64 ID.

The ID is Base64 of "victim_name@group_name" and appears as the id field in every victim listing. If you only have the names, use build_victim_id first. Returns 404 if the listing was taken down.

Args: victim_id: Base64-encoded victim ID from a listing's id field.

Construct the Base64 victim ID for get_victim from the two names.

Offline helper; makes no API call. The names must match the API's values exactly, so prefer reusing an id from a listing when you have one.

Args: victim_name: Victim organisation name as listed (the victim field). group_name: Ransomware group name (the group field).

Decode a Base64 victim ID back into its victim and group names.

Offline helper; makes no API call.

Args: victim_id: Base64-encoded victim ID.

List ransomware groups that have IOCs on file, with per-type counts.

Common IOC types: md5, sha256, ip, domain, email, btc, url.

Args: ioc_type: Only return groups holding this IOC type, e.g. "ip".

Get indicators of compromise for one ransomware group, grouped by type.

Args: group: Group name, e.g. "lockbit3". ioc_type: Return only this type (md5, sha256, ip, domain, email, btc, url) to keep the response small.

List ransomware groups that have YARA detection rules, with rule counts.

Get every YARA rule for a group, each with filename and full rule text.

The returned content is ready to feed to a YARA scanner.

Args: group: Group name, e.g. "lockbit3", "blackcat".

List ransomware groups that have ransom notes on file, with note counts.

List the ransom note identifiers available for one group.

Pass a returned name to get_ransomnote to read its content.

Args: group: Group name, e.g. "lockbit3", "clop".

Get the full text of one ransom note.

Args: group: Group name, e.g. "lockbit3". note_name: Note identifier from list_group_ransomnotes, without file extension.

List ransomware groups with leaked negotiation chat logs, and chat counts.

List negotiation chats for a group with ransom and outcome metadata.

Each entry carries id (pass to get_negotiation), message_count, initialransom, negotiatedransom, and paid.

Args: group: Group name, e.g. "lockbit3".

Get the full message thread and ransom metadata for one negotiation chat.

These threads can be long. Prefer list_group_negotiations first to read ransom amounts and outcomes without pulling every message.

Args: group: Group name, e.g. "lockbit3". chat_id: Chat ID from list_group_negotiations, e.g. "20240517".

Get the 100 most recent tracked cyberattack press entries.

Entries are enriched with infostealer data and linked to a ransomware victim record where the domain matches.

Args: country: ISO 3166-1 alpha-2 country code to narrow before taking the top 100. limit: Max records to return (1-200). offset: Skip this many records; use next_offset from a prior call. full: Include all enrichment fields.

Search all tracked cyberattack press entries by year, month and country.

Results are sorted newest first.

Args: year: 4-digit year, e.g. "2024". month: 2-digit month, e.g. "03". Requires year. country: ISO 3166-1 alpha-2 country code, e.g. "FR". limit: Max records to return (1-200). offset: Skip this many records; use next_offset from a prior call. full: Include all enrichment fields.

Get SEC Form 8-K filings disclosing cybersecurity incidents.

Covers Item 1.05 (Material Cybersecurity Incidents, mandatory since Dec 2023) and Item 8.01 (Other Events, used for such disclosures before that).

Args: ticker: Stock ticker, uppercase, e.g. "MSFT". cik: SEC CIK code, e.g. "0001234567". year: 4-digit filing year, e.g. "2025". month: 2-digit filing month, e.g. "06". Requires year. include_item_105: Include Item 1.05 filings. include_item_801: Include Item 8.01 filings. limit: Max records to return (1-200). offset: Skip this many records; use next_offset from a prior call.

Get national CSIRT/CERT incident-response contacts for a country.

Sourced from ENISA (EU) and FIRST (global). Use this to find who to notify when triaging a confirmed incident.

Args: country: ISO 3166-1 country code, alpha-2 ("FR") or alpha-3 ("FRA").