Lion Cipher Lab
Track ransomware groups from their leak sites — ethically, with public aggregated data
- Threat Intel Analyst
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Modern ransomware crews run on double extortion: they steal your data, encrypt it, and then post your name on a public 'leak site' with a countdown, threatening to publish the files unless you pay. Those postings are, perversely, one of the richest open sources in threat intelligence — they tell a defender WHICH groups are active right now, WHO they are hitting (by sector and country), and when a group is surging. The catch is that the raw source is a criminal-run site on Tor full of stolen data, and a defender must never go there. This lab teaches the professional move: consume the…
What you'll learn
- consuming aggregated, sanitized leak-site (Dedicated Leak Site) metadata safely
- querying a public CTI JSON API politely with Python requests (User-Agent, timeout, error handling)
- normalizing messy victim records into a stable reporting schema
- tallying activity with collections.Counter (by group, by sector, by country)
- spotting the most active ransomware crews in a period
- writing a short defensive intelligence note with an explicit confidence/limitation caveat
- reasoning about bias in self-reported adversary data
- mapping ransomware to MITRE ATT&CK (T1486, Data Encrypted for Impact)
- cross-referencing CISA #StopRansomware advisories for TTPs and mitigations
- the ethics of never touching .onion leak sites or leaked victim data
Steps in this lab
- What you are building — and the one line you never cross
- Why aggregate, and never raw: the ethics firewall and the data hygiene
- Set up: Python, one library, and a polite client
- Pull the public feed — politely, and without ever touching a leak site
- Normalize and tally: who is active, who they target
- Read the tallies with suspicion — the limits of leak-site data
- From counts to actions: MITRE ATT&CK T1486 and CISA #StopRansomware
- Wire it together and write the intel note
- Where this fits, where it stops, and how to do it better