First Commit

.gitignore

@@ -0,0 +1,3 @@
+.env
+database.db
+utils/__pycache__/

query.py

@@ -0,0 +1,49 @@
+import datetime
+import dotenv
+import json
+import requests
+import socket
+import utils.database
+import utils.teamsconnector
+
+def main():
+    utils.database.createdatabasefile()
+    current_date = datetime.date.today()
+    month = current_date.month
+    year = current_date.year
+    try:
+        response = requests.get(f'https://api.ransomware.live/v2/victims/{year}/{month}')
+    except Exception as e:
+        print(e)
+    json_parse = json.loads(response.content)
+    format_date_string = "%Y-%m-%d %H:%M:%S.%f"
+    for vic in json_parse:
+        date_object = datetime.datetime.strptime(vic['discovered'], format_date_string)
+        date = date_object.date()
+        if current_date == date:
+            sqlresult = utils.database.checkdatabase(vic['victim'], vic['discovered'])
+            if sqlresult is False:
+                vendor = vic['victim']
+                date_added = vic['discovered']
+                domain = vic['domain']
+                group = vic['group']
+                try:
+                    if domain != "" and " " not in domain:
+                       ip_address = socket.getaddrinfo(domain, 0, 0, 0, 0) 
+                       unique_ips = list(set([addr[-1][0] for addr in ip_address]))
+                    else:
+                        unique_ips = "Unknown"
+                except:
+                    unique_ips = "Unknown"
+                print("=== Victim Added ===")
+                print(f"""
+                Vendor: {vendor}
+                Date: {date_added}
+                Domain: {domain}
+                IP Addresses: {str(unique_ips).replace('[','').replace(']', '')}
+                Attack Group: {group}
+                      """)
+                utils.teamsconnector.teamswebhook(vic['victim'], vic['discovered'], vic['domain'], vic['group'], unique_ips, vic['description'])
+
+if __name__ == "__main__":
+    main()

requirements.txt

@@ -0,0 +1 @@
+dotenv

utils/database.py

@@ -0,0 +1,25 @@
+import pathlib
+import sqlite3
+
+conn = sqlite3.connect('database.db')
+cursor = conn.cursor()
+
+def createdatabasefile():
+    pathlib.Path("database.db").touch(exist_ok=True)
+    cursor.execute("SELECT * FROM sqlite_master WHERE type='table' AND name='active_attacks'")
+    result = cursor.fetchone()
+    if result is None:
+        cursor.execute('''CREATE TABLE active_attacks
+                       (vendor_name text, date_accessed datetime)
+                       ''')
+        conn.commit()
+
+def checkdatabase(victimname, date_discovered):
+    query = f"SELECT vendor_name FROM active_attacks WHERE vendor_name= ?"
+    cursor.execute(query, (victimname,))
+    result = cursor.fetchone()
+    if result is None:
+        query = f"INSERT INTO active_attacks VALUES ('{victimname}', '{date_discovered}')"
+        cursor.execute(query)
+        conn.commit()
+        return False

utils/teamsconnector.py

@@ -0,0 +1,145 @@
+import dotenv
+import os
+import requests
+dotenv.load_dotenv()
+
+def teamswebhook(victimname, date_discovered, domain, group, ip_address, description):
+    webhook_url = os.getenv('WEBHOOK_URL')
+
+    headers = {"Content-Type": "application/json"}
+
+    adaptive_card = {
+    "type": "AdaptiveCard",
+    "body": [
+        {
+            "type": "TextBlock",
+            "size": "Medium",
+            "weight": "Bolder",
+            "text": "Ransomware.live Alert!"
+        },
+        {
+            "type": "ColumnSet",
+            "columns": [
+                {
+                    "type": "Column",
+                    "items": [
+                        {
+                            "type": "TextBlock",
+                            "weight": "Bolder",
+                            "text": f"{victimname}",
+                            "wrap": "true"
+                        },
+                        {
+                            "type": "TextBlock",
+                            "spacing": "None",
+                            "text": f"{date_discovered}",
+                            "isSubtle": "true",
+                            "wrap": "true"
+                        }
+                    ],
+                    "width": "stretch"
+                }
+            ]
+        },
+        {
+            "type": "TextBlock",
+            "text": f"{description}",
+            "wrap": "true"
+        },
+        {
+            "type": "ColumnSet",
+            "separator": "true",
+            "columns": [
+                {
+                    "type": "Column",
+                    "width": "stretch",
+                    "items": [
+                        {
+                            "type": "TextBlock",
+                            "text": "Domain",
+                            "wrap": "true"
+                        }
+                    ]
+                },
+                {
+                    "type": "Column",
+                    "width": "stretch",
+                    "items": [
+                        {
+                            "type": "TextBlock",
+                            "text": f"{domain}",
+                            "wrap": "true"
+                        }
+                    ]
+                }
+            ]
+        },
+        {
+            "type": "ColumnSet",
+            "columns": [
+                {
+                    "type": "Column",
+                    "width": "stretch",
+                    "items": [
+                        {
+                            "type": "TextBlock",
+                            "text": "IP Addresses",
+                            "wrap": "true"
+                        }
+                    ]
+                },
+                {
+                    "type": "Column",
+                    "width": "stretch",
+                    "items": [
+                        {
+                            "type": "TextBlock",
+                            "text": f"{ip_address}",
+                            "wrap": "true"
+                        }
+                    ]
+                }
+            ]
+        },
+        {
+            "type": "ColumnSet",
+            "columns": [
+                {
+                    "type": "Column",
+                    "width": "stretch",
+                    "items": [
+                        {
+                            "type": "TextBlock",
+                            "text": "Ransomware Group",
+                            "wrap": "true"
+                        }
+                    ]
+                },
+                {
+                    "type": "Column",
+                    "width": "stretch",
+                    "items": [
+                        {
+                            "type": "TextBlock",
+                            "text": f"{group}",
+                            "wrap": "true"
+                        }
+                    ]
+                }
+            ]
+        }
+    ],
+    "$schema": "http://adaptivecards.io/schemas/adaptive-card.json",
+    "version": "1.6"
+}
+
+    payload = {
+        "card": adaptive_card
+    }
+
+    response = requests.post(webhook_url, headers=headers, json=payload)
+
+    if response.ok:
+        print("✅ Card sent to Teams successfully!")
+    else:
+        print(f"❌ Failed to send card: {response.status_code} - {response.text}")