Ransomware IOC Feed

PrecisionSec is actively tracking several ransomware families including Conti Ransomware, Maze, Ryuk, BitPaymer, DoppelPaymer and others. Ransomware is the most prolific and dangerous threat in today’s landscape and it is essential for every organization to have an accurate, up-to-date feed of ransomware IOC’s. We also maintain ransomware IOC feeds for previously active families that are no longer in operation including GandCrab and Locky.

In many cases, a ransomware incident is preceded by a precursor malware infection, such as Emotet or Trickbot. The initial foothold is made using the loader malware. The attackers then move laterally through the organization using tools such as Cobalt Strike, and subsequently deploy a devastating ransomware attack once the organization’s domain controller has been compromised.

Below you will find the most recent ransomware IOC’s from our feed. Please note the data below is intentionally delayed by 48 hours. For live threat intelligence data including IOC’s from currently active ransomware families, please sign up for a free trial.