Olivier Ferrand
Olivier Ferrand is a malware analyst and reverse engineer at the CERT of Crédit Agricole Group. He has been working in information security since the early 2000s. He is the creator and maintainer of RansomLook, an open-source platform tracking ransomware and data-extortion leak sites, and maintains several other trackers. He is a long-time contributor to CIRCL's open-source projects.
Session
Ransomware leak sites are a noisy, hostile and short-lived source of intelligence: onion services that go down without warning, layouts that change overnight, and increasingly, anti-bot challenges designed to keep collectors out. RansomLook is an open-source platform that has been tracking these sites for 4 years, turning scattered extortion pages into structured, searchable and pivotable data used by CERTs, researchers and threat intel teams.
This hands-on workshop takes you from the outside in. We start with a tour of the platform and the kind of pivoting it enables, then move to the collection layer: how a scraper is configured, what breaks in practice, how to write an init script that gets you past a CAPTCHA-protected leak site, and how to write a parser that turns a raw page into victim records the platform can ingest.