BushidoUK/Ransomware-Tool-Matrix resource

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

1434 stars · 156 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A curated knowledge base mapping the tools used by ransomware and extortion gangs, organized by category (RMM, exfiltration, credential theft, LOLBAS, etc.) and sourced from CISA advisories, The DFIR Report, and other OSINT. It is a reference resource for defenders doing threat hunting, detection engineering, and incident response.

Use cases

• find which tools a ransomware gang uses for threat hunting
• build detections for ransomware affiliate tooling
• checklist of attacker tools during incident response
• adversary emulation scenarios for purple team exercises
• identify behavioral patterns between ransomware groups
• block tools commonly abused by ransomware operators

When to choose

• you need an up-to-date, categorized reference of ransomware gang tooling
• you are a defender building threat hunts or detection rules
• you are planning threat-intel-led purple team engagements

When to avoid

• you need executable software rather than a reference document
• you need automated IOC feeds or API access
• you need offensive tooling itself

Facets

dataset · maturity active

security osint vulnerability-scanning security osint cross-platform ransomware threat-hunting detection-engineering cti incident-response purple-team adversary-emulation awesome-list threat-intelligence

Member repositories

For agents

markdown · JSON · MCP: product_card(name="BushidoUK/Ransomware-Tool-Matrix")