The Ransomware Tool Matrix is a comprehensive repository that catalogs the tools and techniques used by various ransomware gangs and extortionist groups. It serves multiple purposes: 1. Provides a list of tools for threat hunting in environments. 2. Offers leads for incident response engagements. 3. Helps identify patterns of behavior among ransomware affiliates. 4. Serves as a resource for threat intelligence-led purple team engagements. The matrix includes categories such as RMM Tools, Exfiltration Tools, Credential Theft Tools, Defense Evasion Tools, Networking Tools, Discovery Tools, Offensive Security Tools, and Living-off-the-Land Binaries and Scripts. It also contains threat intelligence sources, profiles of ransomware groups, and additional resources for understanding ransomware adversaries. While useful for cybersecurity professionals, the matrix comes with challenges, such as distinguishing between legitimate and malicious use of listed tools within an organization.
FEATURES
SIMILAR TOOLS
In-depth threat intelligence reports and services providing insights into real-world intrusions, malware analysis, and threat briefs.
A tracker that detects and logs SYN packets with a specific signature generated by the Mirai malware, providing real-time information on Mirai-based campaigns.
Malware Patrol offers a range of threat intelligence solutions, including enterprise data feeds, DNS firewall, phishing threat intelligence, and small business protection.
ZoomEye is an advanced cyberspace search engine that provides detailed information on cyberspace assets, including server software and version information, for cybersecurity experts, researchers, and enterprises.
ThreatMiner is a threat intelligence portal that aggregates data from various sources and provides contextual information related to indicators of compromise (IOCs).
VirusTotal API v3 is a threat intelligence platform for scanning files, URLs, and IP addresses, and retrieving reports on threat reputation and context.
A free software that calculates the security ranking of Internet Service Providers to detect malicious activities.
An all-in-one email outreach platform for finding and connecting with professionals, with features for lead discovery, email verification, and cold email campaigns.
A community-driven public malware repository providing access to malware samples, tools, and resources for the cybersecurity community.
PINNED

Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.

Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.

DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.