ransomwhere

Ransomwhere 一个概念验证勒索软件样本，用于加密你的文件，以测试你的勒索软件检测与防御策略。 如果未提供任何参数，ransomwhere 将自动执行 encrypt 模式，且不会删除原始文件。 我对本软件造成的任何损害概不负责。 构建 root@kitploit: with make and Go installed % make build 用法 root@kitploit: % ransomwhere -h Usage of ransomwhere: -delete Delete files after encrypting. -log string The log lev...

strafer

Strafer...

melee

MELEE: MySQLインスタンスにおけるランサムウェア感染検出ツール...

ESXi-Ransomware-Scanner-mi

ESXiransomwarescanner IPアドレスをスキャンし、HTMLページから身代金要求メモを取得して文字列を比較することで、ESXiが侵害された兆候を検出するプログラムです。 必要条件 Python 3.x requests BeautifulSoup tqdm colorama インストール パッケージマネージャーpipを使用して必要なパッケージをインストールします。 root@kitploit: pip install requests pip install bs4 pip install tqdm pip install colorama 使い方 Python...

Malware

针对勒索软件家族的 YARA 规则与程序： Akira Babuk Beast BlackByte BlackCat ALPHV BlackMatter BlueLocker MemeCryptor Cerber Conti DarkBit DeadBolt Dharma Enmity GarrantyDecrypt GlobeImposter / NewBomani GoodMorning / SD HardBit Hive / Hunters International HsHarada / Rapture Hunters International INC / Lynx LockB...

KilledProcessCanary

Windows 被杀进程金丝雀 一个 Windows 服务，用于检测自身是否已被关闭；如果多个实例均已被关闭，则使主机休眠。 由 NCC Group Plc 以开源形式发布 - http://www.nccgroup.com/ 由 Ollie Whitehouse 开发，ollie dot whitehouse at nccgroup dot com https://github.com/nccgroup/KilledProcessCanary 根据 AGPL 发布，更多信息请参阅 LICENSE 假设...

detect-ransomware-filenames

检测勒索软件文件名 这个包/脚本监视 SMB 事务，查找勒索软件已知会使用的恶意文件名。它构建在此处维护的反勒索软件文件系统资源管理器列表（Anti-Ransomware File System Resource Manager Lists）之上。 使用方法 包含一个 Python 脚本（download-list.py），以便定期刷新列表。默认情况下，它会将新文件下载到 inputs/ 文件夹中。 安装 该包可通过 zkg 获取，但由于它包含两部分（脚本和输入文件），通常手动安装更好。 适用于 Zeek 对于 Zeek，请将...

TL-RL-FusionNet: An Adaptive and Efficient Reinforcement Learning-Driven Transfer Learning Framework for Detecting Evolving Ransomware Threats

Modern ransomware exhibits polymorphic and evasive behaviors by frequently modifying execution patterns to evade detection. This dynamic nature disrupts feature spaces and limits the effectiveness of static or predefined models. To address this challenge, we propose TL-RL-FusionNet, a reinforceme...

Explainable Attention-Based LSTM Framework for Early Detection of AI-Assisted Ransomware Via File System Behavioral Analysis

Ransomware continues to evolve as one of the most disruptive cyber threats, with recent variants increasingly leveraging automated and AI-assisted techniques to evade traditional signature-based defenses. Early detection of such attacks remains a significant challenge, particularly when malicious...

Privacy-Aware Machine Unlearning with SISA for Reinforcement Learning-Based Ransomware Detection

Ransomware detection systems increasingly rely on behavior-based machine learning to address evolving attack strategies. However, emerging privacy compliance, data governance, and responsible AI deployment demand not only accurate detection but also the ability to efficiently remove the influence...

RansomTrack: A Hybrid Behavioral Analysis Framework for Ransomware Detection

Ransomware poses a serious and fast-acting threat to critical systems, often encrypting files within seconds of execution. Research indicates that ransomware is the most reported cybercrime in terms of financial damage, highlighting the urgent need for early-stage detection before encryption is...

Automating Cloud Security and Forensics through a Secure-By-Design Generative AI Framework

As cloud environments become increasingly complex, cybersecurity and forensic investigations must evolve to meet emerging threats. Large Language Models LLMs have shown promise in automating log analysis and reasoning tasks, yet they remain vulnerable to prompt injection attacks and lack forensic...

An overview of ransomware threats in Japan in 2025 and early detection insights from Qilin cases

In 2025, a total of 134 ransomware incidents were reported in Japan, marking a 17.5% increase compared to 2024. Among these, 22 incidents were attributed to Qilin, representing 16.4% of the total. In 2025, Qilin ransomware was highly active. Looking ahead to 2026, unless there is significant...

Malware and Ransomware Detection in M365

Availability Requirement Threat Detection is available to Veeam Data Cloud for Microsoft 365 customers with Premium or Advanced plans. Customers must opt in to AI settings to enable this feature. Contact your Veeam account team or see your plan details to confirm availability. Supported Workloads...

BullWall Ransomware Containment and Server Intrusion Protection multiple vulnerabilities

RISK EVALUATION BullWall Ransomware Containment and Server Intrusion Protection are products used for ransomware containment. Multiple vulnerabilities were reported that when used individually or in conjunction could allow a remote attacker with valid credentials to log in to a system with...

Interpretable Ransomware Detection Using Hybrid Large Language Models: A Comparative Analysis of BERT, RoBERTa, and DeBERTa through LIME and SHAP

Ransomware continues to evolve in complexity, making early and explainable detection a critical requirement for modern cybersecurity systems. This study presents a comparative analysis of three Transformer-based Large Language Models LLMs BERT, RoBERTa, and DeBERTa for ransomware detection using...

Federated Cyber Defense: Privacy-Preserving Ransomware Detection across Distributed Systems

Detecting malware, especially ransomware, is essential to securing today's interconnected ecosystems, including cloud storage, enterprise file-sharing, and database services. Training high-performing artificial intelligence AI detectors requires diverse datasets, which are often distributed acros...

Cloud Investigation Automation Framework (CIAF): An AI-Driven Approach to Cloud Forensics

Large Language Models LLMs have gained prominence in domains including cloud security and forensics. Yet cloud forensic investigations still rely on manual analysis, making them time-consuming and error-prone. LLMs can mimic human reasoning, offering a pathway to automating cloud log analysis. To...

Qualys Achieves 100% Major Step Detection in the 2024 MITRE ATT&CK Evaluations, Enterprise

How Qualys Transformed from Risk Leader to EDR Powerhouse In today’s rapidly evolving threat landscape, ransomware continues to dominate as one of the most significant cybersecurity challenges. To help organizations evaluate their defenses against these sophisticated threats, the MITRE ATT&CK...

Stopping a targeted attack on a Managed Service Provider (MSP) with ThreatDown MDR

In late January 2024, the ThreatDown Managed Detection and Response MDR team found and stopped a three-month long malware campaign against a Managed Service Provider MSP based in Europe. In line with our observations of attackers increasingly relying on legitimate software in their attacks, the...