ransomwhere

Ransomwhere Una muestra de ransomware de prueba de concepto que cifra tus archivos para probar tus estrategias de detección y prevención de ransomware. Si no se proporcionan argumentos, ransomwhere ejecutará automáticamente el modo encrypt sin eliminar los archivos originales. No me hago...

melee

MELEE：用于检测 MySQL 实例中勒索软件感染的工具 攻击者正在滥用 MySQL 实例在互联网上实施恶意操作。网络犯罪分子瞄准暴露的 MySQL 实例，大规模触发感染以窃取数据、破坏数据并通过勒索索要钱财。例如，MySQL 部署面临的主要威胁之一是勒索软件。我们编写了一款名为 “MELEE” 的工具，用于检测 MySQL 实例中的潜在感染。该工具允许安全研究人员、渗透测试人员和威胁情报专家检测运行恶意代码的被攻陷和受感染的 MySQL 实例。该工具还使您能够针对以云数据库为目标的恶意软件进行高效研究。在此版本的工具中，支持以下模块： MySQL 实例信息收集与侦察 MySQL...

strafer

Strafer Elasticsearch 感染正呈指数级增长。攻击者利用开放和暴露的 Elasticsearch 接口在云和非云部署中触发感染。在此次演讲中，我们将发布一款名为 "STRAFER" 的工具，用于检测 Elasticsearch 实例中的潜在感染。该工具允许安全研究人员、渗透测试人员和威胁情报专家检测运行恶意代码的已受损和已感染 Elasticsearch 实例。该工具还使您能够针对以云数据库为目标的恶意软件进行高效研究。在此版本的工具中，支持以下模块： Elasticsearch 实例信息收集与侦察 Elasticsearch 实例在互联网上的暴露情况 检测...

ESXi-Ransomware-Scanner-mi

ESXiransomwarescanner 一个通过从 HTML 页面获取勒索信息并比较字符串来扫描 IP 地址以发现 ESXi 被入侵迹象的程序。 要求 python 3.x requests BeautifulSoup tqdm colorama 安装 使用 pip 包管理器安装所需包。 pip install requests pip install bs4 pip install tqdm pip install colorama 用法 使用 Python 3 运行程序： python ESXiEZScanner.py 菜单 程序将显示以下菜单： 扫描单个 IP 地址...

Malware

Reglas YARA, programas para familias de ransomware: Akira Babuk Beast BlackByte BlackCat ALPHV BlackMatter BlueLocker MemeCryptor Cerber Conti DarkBit DeadBolt Dharma Enmity GarrantyDecrypt GlobeImposter / NewBomani GoodMorning / SD HardBit Hive / Hunters International HsHarada / Rapture Hunters...

KilledProcessCanary

Windows Killed Process Canary Un servicio de Windows para detectar si ha sido detenido e hibernar si hay múltiples instancias. Publicado como código abierto por NCC Group Plc - http://www.nccgroup.com/ Desarrollado por Ollie Whitehouse, ollie dot whitehouse at nccgroup dot com...

detect-ransomware-filenames

Detectar nombres de archivo de ransomware Este paquete/script supervisa las transacciones SMB para buscar nombres de archivo maliciosos conocidos que el ransomware suele utilizar. Se basa en las listas de Anti-Ransomware File System Resource Manager mantenidas aquí. Cómo usar Se incluye un script...

TL-RL-FusionNet: An Adaptive and Efficient Reinforcement Learning-Driven Transfer Learning Framework for Detecting Evolving Ransomware Threats

Modern ransomware exhibits polymorphic and evasive behaviors by frequently modifying execution patterns to evade detection. This dynamic nature disrupts feature spaces and limits the effectiveness of static or predefined models. To address this challenge, we propose TL-RL-FusionNet, a reinforceme...

Explainable Attention-Based LSTM Framework for Early Detection of AI-Assisted Ransomware Via File System Behavioral Analysis

Ransomware continues to evolve as one of the most disruptive cyber threats, with recent variants increasingly leveraging automated and AI-assisted techniques to evade traditional signature-based defenses. Early detection of such attacks remains a significant challenge, particularly when malicious...

Privacy-Aware Machine Unlearning with SISA for Reinforcement Learning-Based Ransomware Detection

Ransomware detection systems increasingly rely on behavior-based machine learning to address evolving attack strategies. However, emerging privacy compliance, data governance, and responsible AI deployment demand not only accurate detection but also the ability to efficiently remove the influence...

RansomTrack: A Hybrid Behavioral Analysis Framework for Ransomware Detection

Ransomware poses a serious and fast-acting threat to critical systems, often encrypting files within seconds of execution. Research indicates that ransomware is the most reported cybercrime in terms of financial damage, highlighting the urgent need for early-stage detection before encryption is...

Automating Cloud Security and Forensics through a Secure-By-Design Generative AI Framework

As cloud environments become increasingly complex, cybersecurity and forensic investigations must evolve to meet emerging threats. Large Language Models LLMs have shown promise in automating log analysis and reasoning tasks, yet they remain vulnerable to prompt injection attacks and lack forensic...

An overview of ransomware threats in Japan in 2025 and early detection insights from Qilin cases

In 2025, a total of 134 ransomware incidents were reported in Japan, marking a 17.5% increase compared to 2024. Among these, 22 incidents were attributed to Qilin, representing 16.4% of the total. In 2025, Qilin ransomware was highly active. Looking ahead to 2026, unless there is significant...

Malware and Ransomware Detection in M365

Availability Requirement Threat Detection is available to Veeam Data Cloud for Microsoft 365 customers with Premium or Advanced plans. Customers must opt in to AI settings to enable this feature. Contact your Veeam account team or see your plan details to confirm availability. Supported Workloads...

CVE-2025-62000: Incomplete Comparison with Missing Factors

BullWall Ransomware Containment may not always detect an encrypted file. This issue affects a specific file inspection method that evaluates file content based on header bytes. An authenticated attacker could encrypt files, preserving the first four bytes and preventing this particular method fro...

BullWall Ransomware Containment and Server Intrusion Protection multiple vulnerabilities

RISK EVALUATION BullWall Ransomware Containment and Server Intrusion Protection are products used for ransomware containment. Multiple vulnerabilities were reported that when used individually or in conjunction could allow a remote attacker with valid credentials to log in to a system with...

Interpretable Ransomware Detection Using Hybrid Large Language Models: A Comparative Analysis of BERT, RoBERTa, and DeBERTa through LIME and SHAP

Ransomware continues to evolve in complexity, making early and explainable detection a critical requirement for modern cybersecurity systems. This study presents a comparative analysis of three Transformer-based Large Language Models LLMs BERT, RoBERTa, and DeBERTa for ransomware detection using...

Federated Cyber Defense: Privacy-Preserving Ransomware Detection across Distributed Systems

Detecting malware, especially ransomware, is essential to securing today's interconnected ecosystems, including cloud storage, enterprise file-sharing, and database services. Training high-performing artificial intelligence AI detectors requires diverse datasets, which are often distributed acros...

Cloud Investigation Automation Framework (CIAF): An AI-Driven Approach to Cloud Forensics

Large Language Models LLMs have gained prominence in domains including cloud security and forensics. Yet cloud forensic investigations still rely on manual analysis, making them time-consuming and error-prone. LLMs can mimic human reasoning, offering a pathway to automating cloud log analysis. To...

Qualys Achieves 100% Major Step Detection in the 2024 MITRE ATT&CK Evaluations, Enterprise

How Qualys Transformed from Risk Leader to EDR Powerhouse In today’s rapidly evolving threat landscape, ransomware continues to dominate as one of the most significant cybersecurity challenges. To help organizations evaluate their defenses against these sophisticated threats, the MITRE ATT&CK...