Awesome

Ransomchats

Here you'll find real world ransomware negotiations normalised as JSON files. Ransomware negotiations are usually not shared widely, limiting the understanding of the process. This project aims at changing that, in a respectful manner for the victims of cyberattacks: chats are anonymized as long as the victim hasn't been publicly disclosed, either by the attackers or in the media.

You have copies of negotiations? You're more than welcome to contibute. You can find some parsers ready to use to help you with that. Or you can send me an e-mail: valery@proton.me

Thanks @thomfredev for the reading app that's running here : ransomch.at (thanks as well for the help getting it built properly)

Thanks @JMousqueton for including the chats in ransomware.live.

Thanks @g0njxa for the ransom chats involving Trinity.

Thanks as well Calvin So's for his stylometric analysis here and there and PCMag Middle East for theirs, and SEC4U for theirs.

Anastasia Sentsova, from Analyst1, also used LockBit's chats in her research "Negotiating with LockBit: Uncovering the Evolution of Operations and Newly Established Rules".

John Hammond, from Huntress Labs, made a full video on ransomware negotiations using the chats in this repository.

Mikko Hypponen, CEO of WithSecure, mentioned this project during his keynote at RSA Conference 2024.

You can also experience ransomware negotiation with a custom made ChatGPT, trained on this dataset by Ellis Stannard.