Ransomware News Bot

The Ransomware News Bot is a lightweight Go application that monitors ransomware activity and delivers real-time alerts to Discord and Slack channels. It uses the ransomware.live API to track new ransomware victims and multiple RSS feeds for broader cybersecurity news.

Why did I build this?

The original ThreatIntelligenceDiscordBot by vx-underground no longer works. Since I relied on it for threat intelligence monitoring, I decided to build a new one from scratch - with added Slack support, Docker compatibility, and configurable RSS feeds.

Disclaimer: This bot is 100% vibe-coded - no guarantee for 100% security.

• Multi-platform support - Discord and Slack with independent webhook configuration
• Ransomware.live API integration - Real-time victim alerts with configurable polling intervals
• RSS feed aggregation - Customizable feeds for general cybersecurity, government advisories, and ransomware-specific news
• Customizable message formatting - Configurable field order and layout for both platforms
• Quiet hours - Mute webhooks on a schedule, configurable per webhook with timezone support
• Webhook filters - Per-webhook filtering by country, group, or keyword (literal/regex) with include/exclude lists
• Retry system - Automatic retries with persisted payloads for reliable delivery
• Hot-reload - Configuration changes applied automatically without restart
• Dry-run mode - Preview messages without sending
• Docker ready - Lightweight Alpine-based image with healthcheck

Both Discord and Slack are fully supported with the same ransomware data:

Discord

Supports emoji in messages including country flags. Three separate webhook channels available for ransomware alerts, RSS feeds, and government advisories.

Slack

Uses Block Kit formatting. Same data and webhook separation as Discord, with independently configurable field ordering.

Prerequisites

• Ransomware.live free API key (API Pro allows 3,000 calls/day) - Request here
• Discord and/or Slack webhook URLs
• Docker (recommended) or Go 1.20+

Docker (Recommended)

git clone https://github.com/8linkz/Ransomware-Bot.git
cd Ransomware-Bot
docker-compose up -d --build

Required Volume Mounts

• /app/config - Configuration files
• /app/logs - Application logs with rotation
• /app/data - Status tracking and deduplication (critical for persistence)

Important: Without the /app/data volume, all processed items tracking will be lost on container restart, causing duplicate messages.

Manual Build

git clone https://github.com/8linkz/Ransomware-Bot.git
cd Ransomware-Bot
go build -o ransomware-bot .
./ransomware-bot

General Configuration (configs/config_general.json)

Main settings including API key, polling intervals, and webhook URLs:

RSS Feeds (configs/config_feeds.json)

Three feed categories routed to different webhooks:

• ransomware_feeds - Ransomware-specific RSS feeds
• government_feeds - CISA, NCSC, CIS advisories
• general_feeds - Krebs on Security, Bleeping Computer, Schneier, etc.

Message Formatting (configs/config_format.json)

Customize field order and display options per platform. Available fields include: victim, group, country, activity, attackdate, discovered, post_url, website, description, and screenshot. Slack and Discord can have different field orders.

• SOC Teams - Real-time ransomware monitoring in existing Discord/Slack workflows
• Threat Intelligence - Automated tracking of ransomware group activity and new victims
• Security Research - Aggregated cybersecurity news from trusted RSS sources
• Incident Response - Early warning system for supply chain or industry targeting

The Ransomware News Bot fills the gap left by the original vx-underground ThreatIntelligenceDiscordBot while adding Slack support, Docker deployment, and configurable RSS feeds. It's designed to be lightweight, easy to deploy, and reliable for day-to-day threat monitoring.

The tool is open source and available on GitHub.