As ransomware attacks continue to proliferate and threat actors rapidly leak stolen data online, security and threat intelligence teams face a critical challenge: determining whether their proprietary data or sensitive files have been exposed. Finding compromised files in massive, unstructured leak dumps often requires manual discovery, wasting crucial time when every second counts. Ransomware Files in Ignite solves this challenge by giving organizations direct, instant visibility into leaked file paths and trees within Flashpoint Ignite, enabling teams to assess exposure, prioritize response, and mitigate risk before threat actors can further exploit the data.

What’s New

Ransomware Files is now available as a searchable data type in Ignite. You can now search file names across leaked file trees, set proactive alerts on file paths, and track exposure directly alongside your existing threat intelligence workflows.

Key capabilities include:

• Deep File-Level Search: Search across leaked file trees and refine results using filters like Ransomware Group, Victim Name, and File Type.
• Contextual Linking: Every file result directly links back to its associated ransomware victim post, providing full threat actor context.
• Victim Post Samples: View a sample of exposed files directly on ransomware victim posts, with a single click to run a full search for related files from that leak.
• Proactive Alerting: Set custom alerts on critical file paths and receive instant notifications in-platform, via email, or directly in Slack.
• MCP Integration: Access Ransomware Files programmatic intelligence via Flashpoint’s Model Context Protocol (MCP) server.

Why It Matters

When a ransomware group publishes a leak, speed and clarity are paramount. Ransomware Files streamlines your exposure triage by eliminating blind spots and manual searching. Instead of digging through raw leak dumps, security teams can instantly verify whether company, vendor, or customer files are included in a breach.

This release optimizes your team’s intelligence resources:

• Proactive Protection: Automated path alerting delivers instant notifications, eliminating repetitive manual queries.
• Smarter Analyst Hours: When a confirmed match is identified, users can immediately submit a Request for Intelligence (RFI) for deep-dive analyst support. This ensures your RFI hours are spent on high-priority, confirmed exposures rather than time-consuming initial discovery.

How It Works

• Search: Navigate to Ignite, select the Ransomware Files data type, and input a file name, path, or keyword. Filter by Ransomware Group, Victim Name, or File Type to refine your results.
• Set Alerts: Create automated alerts for sensitive file paths to receive real-time notifications in Ignite, via email, or in Slack.
• Review & Contextualize: Select a search result to view file metadata and navigate directly to the originating ransomware victim post. Alternatively, browse file samples on victim posts to explore leaks interactively.
• Escalate: Found a confirmed match? Click to submit an RFI directly to Flashpoint’s expert analyst team for advanced investigation and context.

Frequently Asked Questions (FAQs)

How does searching Ransomware Files differ from standard victim post searches in Ignite?
Standard victim posts notify you that a specific organization or entity was named in a ransomware leak. Ransomware Files allows you to query the actual file names and file trees within the leak data itself, allowing you to discover specific sensitive documents, proprietary file paths, or third-party vendor exposures even if your organization wasn’t explicitly named in the victim headline.

Can I integrate Ransomware Files data into my existing SIEM, SOAR, or internal tools?
Yes. Ransomware Files data is fully accessible via Flashpoint’s MCP server, allowing you to automate data ingestion into your existing security operations ecosystem.

Where can notifications be sent when a ransomware alert triggers?
You can configure alerts to deliver real-time notifications directly within the Ignite platform, sent via email, or pushed into designated Slack channels.

How do RFIs work with Ransomware Files?
If you discover a confirmed file match, you can submit a Request for Intelligence (RFI) directly through Ignite. Flashpoint’s threat intelligence analysts will then perform deep-dive research into the breach, helping you understand the scope and impact without wasting RFI hours on initial file hunting.