domains / families / security / analyzing-ransomware-payment-wallets

analyzing-ransomware-payment-wallets

separate

'Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs, identifying wallet clusters and tracking fund movement through mixers and exchanges to support law enforcement attribution. Use when tracing ransomware bitcoin payments, performing cryptocurrency wallet forensics, or gathering blockchain threat intelligence on extortion payments.

When to use

• An organization has been hit by ransomware and the ransom note contains a Bitcoin or cryptocurrency wallet address that needs investigation
• Law enforcement or incident responders need to trace where ransom payments flowed after the victim paid
• Threat intelligence analysts are attributing ransomware campaigns by clustering payment infrastructure across incidents
• Investigators need to determine if a ransomware group is reusing wallet infrastructure across multiple victims
• Compliance or legal teams need evidence of fund flows for prosecution, sanctions enforcement, or insurance claims

When not to use

• live payment interception
• interacting directly with ransomware operators

Skill page

Source