A 2026 walkthrough of the typical infostealer-log archive — what files it contains, what each one means, and how defenders parse them with Python and jq for downstream incident response.
Ransomnews Research Team
Ransomnews Research Team
The Ransomnews Research Team is the collective byline used for collaborative pieces, editorial briefings, and articles drawing on contributions from multiple researchers. Coverage spans ransomware operations, breach economics, threat actor profiling, OSINT methodology, and emerging risks across security, privacy, and AI.
A practitioner walkthrough of building a ransomware-specific incident response runbook in 2026 — combining NIST SP 800-61 r3, CISA’s #StopRansomware playbook, and the lessons from named incidents on the Ransomtracker leak feed.
A 2026 OSINT workflow for mapping the external attack surface of any organisation using only public data — internet-scan engines, certificate transparency, and authenticated vulnerability templates.
A field guide to the 2026 initial-access-broker market — how IABs source access, how they price it, who buys, and what the listings look like under the hood.
A step-by-step tutorial for building a real home SOC with Wazuh, Suricata, and an OPNsense router on hardware that costs under $400. Endpoint EDR, network IDS, and log correlation — the same stack used by mid-market enterprises.
A step-by-step setup of the four-layer 2026 privacy stack: a hardened browser, Global Privacy Control, ad-and-tracker blocking, and email aliasing. Free or near-free. Twenty minutes. Real privacy gain.
A 2026 tutorial for running OSINT investigations across paste sites, breach data, and forums using IntelX for breach search, Spiderfoot for automated correlation, and Maltego for graph analysis.
A 2026 tutorial for following ransomware and fraud proceeds across the blockchain using free tools — Chainabuse for tagged wallets, OXT for BTC clusters, Walletexplorer for entity heuristics, and Etherscan for ETH/USDT.
A practitioner’s tutorial for verifying — or refuting — a claimed ransom payment on the Bitcoin blockchain using free tools. Useful for journalists, IR teams, and victims dealing with secondary-extortion claims.
A 2026 tutorial for tracking individual ransomware affiliates across operator rebrands using VirusTotal Intelligence, abuse.ch’s MalwareBazaar, and YARA rules. Code reuse, builder fingerprints, and TTP continuity reveal the same crews under new names.