Dataset and attribution

Ransomchats source record

Casualtek/Ransomchats collects real-world ransomware negotiations for public research and documents its approach to victim anonymization in the upstream repository.

ThreatLabz ransomware-notes source record

The ransomware notes originate from ThreatLabz/ransomware_notes. ThreatLabz is the upstream collector. extortion.wiki did not create or originally collect these files; it independently generates a static archive view from the commit-pinned local snapshot.

Ransomware notes form a separate corpus from the negotiation dataset. Note families and note files are not added to threat-actor, negotiation, or message totals, and negotiation records are not added to note statistics.

Attribution boundary

extortion.wiki does not claim authorship of the transcripts, ransomware notes, upstream parsers, indexes, redactions, or source collection. Cite the applicable upstream repository alongside the stable internal archive URL. Cross-links between a note family and a negotiation actor exist only when the explicit alias mapping records that relationship.

Archive processing

Ransomchats JSON is parsed and normalized for transcript presentation. ThreatLabz files are copied byte-for-byte into a local source snapshot, decoded into a separate presentation field, hashed with SHA-256, and normalized separately for search. Original note content is never emitted as executable HTML; even HTML and HTA files appear as escaped source text.

The production build requires no runtime GitHub fetch. The methodology describes the static document and search boundaries.

Known limitations

Both upstream corpora vary in naming, dates, structure, and completeness. A source family label is not independent attribution. A cross-corpus alias is a navigation aid, not proof that similarly named operations share operators, infrastructure, or history.

Preserved Ransomchats license notice

MIT License

Copyright (c) 2023 Valéry Marchive

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

Preserved ThreatLabz license and copyright notice

The upstream license file is included in the versioned snapshot without alteration. Its copyright notice is Copyright (c) 2022 Zscaler ThreatLabz.

MIT License

Copyright (c) 2022 Zscaler ThreatLabz

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

Revision information

Negotiation routes and statistics are recalculated from the validated Ransomchats data during production builds. Ransomware-note routes and statistics are generated from the commit-pinned ThreatLabz snapshot by scripts/sync-ransomware-notes.mjs and verified offline before rendering.