1. The "Pew Pew" Map — Watch Ransomware Happen, Live
A real-time attack map that plots ransomware victim claims as they're published on leak sites. Every dot on the map is a real claim, not a simulation.
Key features:
- Live feed — group, victim, sector, country, and timestamp as claims land
- Top groups & top countries — who's most active right now, not last quarter
- Replay mode — rewind 24h / 7d / 30d to see how an attack wave built up
It's powered by the same data pipeline behind ransomware.live, just visualized differently — great for SOC dashboards, conference or booth displays, or keeping an eye on activity trends during customer conversations.
2. A Real Query Language for the Database
Instead of basic keyword matching, ransomware.live now has a command-bar search with real operators:
+country:us→ only US victims-group:lockbit3→ exclude a group+sector:healthcare→ filter by sector+infostealer/-infostealer→ has/doesn't have infostealer databefore:2026-01-01/after:2025-01-01→ date range
Free text and operators combine with AND. Repeating a + on the same field turns it into OR (+country:us +country:ca = US or Canada).
Example query: hospital +country:us -group:lockbit3 +sector:healthcare before:2026-01-01
Built for the researchers, journalists, and law enforcement who use the platform daily.
3. KQL Hunting Queries
The third gift of the month — and this one wasn't the original idea of the platform's creator. It came from a long-time user who reached out with a simple request: "There's a Yara section — could we get a KQL section too?"
The answer: threat hunting queries for Microsoft Sentinel / Defender, based on each ransomware operation's known tooling and associated MITRE ATT&CK techniques. Each query is tagged by tactic and technique, with a direct link from the corresponding group's page.
⚠️ Important: these are starting points for hunting, not ready-made alert rules. Validate table and column names against your own workspace schema before turning any of them into a production alert — the goal is to save research time, not replace your own judgment.
The platform remains what it's always been: free. If a request makes sense for the community, it eventually ships. This is proof of that.
4. Time Machine — Travel Through Ransomware History
Shipped just days before July wrapped: Time Machine lets you scrub through time — from a single day back to November 2013 — and instantly see:
- Victims claimed in that window
- Which groups were active
- Sectors and countries hit
- New groups that surfaced for the first time
It turns over 10 years of data into something you can explore, not just query. Want to see how Q1 2026 compared to the same period last year? Curious which groups first appeared in the last 90 days? Time Machine answers that in a few clicks.
Four features, one month, all built to help defenders, researchers, journalists, and law enforcement make sense of the ransomware landscape faster. As always: if there's a gap, a request, or an idea for something the platform doesn't cover yet, get in touch.