Cleo the Cat

Catograph[.]Net


Ransomware Victimology Project

Cleo the Cat
Author: catograph.net
Updated: September 24th, 2025

The Ransomware Victimology Project (RVP) is an ongoing public effort to map ransomware attacks and its primary goal is to uncover trends. This project was started back in 2023 rather informally without much of a scope and coalesced into a capstone research project at grad school during summer 2025. Initially, the goal was to publish summer research findings in an academic journal. However, due to how rapidly the cyber landscape changes, and due to how some journals may limit the access of information, it felt more fitting to continue the project here in a public space and to add improvements.

Maps and Reports Coming Soon

Currently, Catograph.net is working on automating more steps for the project. Until it is published here, if you are interested in more details reach out over email or Discord:

  • Email: ransomware@catograph.net
  • Discord: @catograph.net

What is RVP's main contribution?

All of the maintained ransomware trackers out there add value in their own way. The main contribution to this space from RVP is the mapping of ransomware attack data to approximate victim location in ArcGIS which reveals spatial patterns. Without a set scope and timeframe this is not necessarily the most useful information. However, when narrowing down to specific threat actors or specific industries during a certain time, more useful insights may be drawn and investigated further.

Disclaimer and RVP Credits

RVP never directly accesses any sensitive content.

  • RVP is led by the researcher who owns Catograph.net.
  • It was inspired by the ransomwatch project by Josh Highet.
  • RVP presently uses and cleans data from a fork of ransomwatch, ransomware.live, which was created by Julien Mousqueton.
  • RVP does not use data sourced from the company Flare at this time, but their academy training offerings are excellent and cover the ransomware threat landscape which has been of great use.

Additional public datasets will be added or modified after the project is automated. Only publicly accessible datasets are used for RVP.