KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#dsh #dsh-plugin #ai-agents #developer-tools #ai-agent #claude-code #mcp #typescript #codex #cli #rust #deepseek-harness

ThreatActors-TTPs

★ 411 Open GitHub ↗

Repository created to share information about tactics, techniques and procedures used by threat actors. Initially with ransomware groups and evolving to other types of threats.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# THREAT ACTORS AND RANSOMWARES - TTPs

This repository was created with the aim of assisting **companies** and **independent researchers** in studying the **Tactics, Techniques, and Procedures (TTPs)**, based on the **MITRE ATT&CK** framework, adopted by active or inactive **Ransomware operators/groups** and other **Threat Actors**.

This content includes TTP mapping, the **history of activities**, and the record of exploited **CVEs (Common Vulnerabilities and Exposures)**. Furthermore, I am including data on **commands**, **tools**, and **useful locations for researching artifacts** in the DFIR/CTI field.

The primary focus is to offer a summary of each actor's **trajectory**, providing essential information that can be utilized by security organizations and individual researchers.

## COLLABORATION AND DATA SHARING

This project relies on contributions from various researchers in the community. The data collected here is also intended to serve as a resource for other security projects, such as **RANSOMWARE.LIVE** (accessible at: https://www.ransomware.live/), fostering a wider collaboration ecosystem.

---

## REPOSITORY STRUCTURE

| FOLDER | DESCRIPTION |
|---|---|
| **Actor's Name** | Detailed profile containing: **TTPs (MITRE ATT&CK)**, **History/Trajectory** of the group, and a list of exploited **CVEs** (where applicable). |
| Commands | Repository designed to insert commands captured based on DFIR and CTI activities of Threat Actors, Ransomware groups, and affiliates. |
| Payload locations | Repository designed to inform locations commonly used for the execution of ransomware and other threats. |

---

### Contact: https://twitter.com/crocodylii

**The goal is to map all possible strategies adopted by Ransomware operators, and contributions are highly welcome!**

ThreatActors-TTPs

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README