These are tools discussed Learning Ransomware Response & Recovery by W. Curtis Preston and Dr. Mike Saylor. Browse the list of all tools or get the book.
Inclusion in this directory does not indicate endorsement.
If you see a missing tool, leave a comment!
Threat intelligence platforms provide real-time information about emerging threats, track ransomware groups, monitor the dark web for compromised data, and trace cryptocurrency payments.
Free Threat Intelligence
- Abuse.ch URLhaus – https://urlhaus.abuse.ch – Malware URL database
- AlienVault OTX – https://otx.alienvault.com – Community threat intelligence (Open Threat Exchange)
- CISA AIS – https://www.cisa.gov/topics/cyber-threats-and-advisories/information-sharing/automated-indicator-sharing-ais – U.S. government automated threat sharing
- FireEye Threat Intelligence – https://www.mandiant.com/resources/insights – Some free threat intelligence feeds
- @RansomWatch – https://x.com/RansomWatch– Ransomware monitoring (but haven’t posted in a while)
- @ThreatIntel – https://x.com/ThreatIntel – Threat intelligence updates
Commercial Threat Intelligence
- DarkOwl – https://www.darkowl.com – Dark web monitoring and intelligence
- Recorded Future – https://www.recordedfuture.com – Real-time threat intelligence platform
- Mandiant Threat Intelligence – https://www.mandiant.com – Paid threat intelligence feeds (FireEye)
- TRM Labs – https://www.trmlabs.com – Cryptocurrency tracing and sanctions compliance
- Chainalysis – https://www.chainalysis.com – Blockchain analysis and crypto tracking
- Flashpoint – https://flashpoint.io – Dark web and threat intelligence
- SearchLight – https://www.digitalrisks.co.uk – Digital risk protection
- Blackswan Cybersecurity – https://blackswan-cybersecurity.com/– Managed threat intelligence service