Ransomware Victims

The Ransomware Victims tab provides real-time visibility into organizations impacted by ransomware across the dark web. Attackers often publish stolen data on underground leak sites to pressure victims into paying ransoms. This section centralizes all discovered victims, allowing security teams to track incidents by time, group, and details for immediate response and analysis.

Victim Counters

At the top of the page, key counters summarize the scope of ransomware activity across different timeframes:

• All Victims

  Displays the total number of victims recorded in the system across all tracked years.

• Yearly Victims

  Shows the number of organizations victimized during the current year only, helping assess annual ransomware trends.

• Monthly Victims

  Indicates how many victims were added this month, highlighting recent activity spikes.

• Weekly Victims

  Provides the number of victims discovered in the last 7 days, useful for short-term monitoring.

• Daily Victims

  Captures the number of victims reported today, giving a near real-time update of ongoing attacks.

This multi-level breakdown ensures teams can quickly shift from long-term statistics to immediate threats.

---

Detailed Victim Cards

Beneath the counters, individual victims are listed as cards, each containing structured details collected from dark web leak sites:

• Victim Name

  Example: Professional Trust Company, Studio Legale Tisot Iuris, Key 4 Energy Srl.

• Published Date

  The date the ransomware group published the victim on its leak site.

• Description

  A short summary of the case or AI-generated summaries explain victim details with clear notes indicating they are AI Generated. This ensures consistent intelligence across the platform.

• Group Name

  Identifies the ransomware group responsible for the attack (e.g., everest).

• Discovered Date

  The timestamp when the system detected and ingested the victim’s record from the dark web.

• Website Link

  If available, provides a direct link to the organization’s public website. If not, it is marked as Unavailable.

• Post URL

  A direct link to the ransomware group’s leak site (hosted on the dark web via .onion domains). This is where attackers publish stolen data or proof of compromise.

• Country Flag (if available)

  Displays the victim’s country of origin, giving geographical context for tracking trends by region.

---

Why This Matters

The card-based format ensures that every ransomware incident is traceable, contextualized, and actionable. Security teams can:

• Verify exposure quickly by reviewing the dark web post.

• Understand attack patterns by analyzing which groups are most active.

• Prioritize response based on geography, industry, or frequency of attacks.

This approach turns raw dark web leaks into organized intelligence, ensuring no victim report goes unnoticed.