Censys recently uncovered a Russian ransomware group within its internet search data by identifying suspicious hosts and leveraging historical analysis and technical pivots. The journey began with open source hacking tools and ended with ransomware packages, a removed IOC, and two Bitcoin hosts for payment. Read the report to see why investigators don’t have to wait for enemies to be knocking on the door to find them in the wild.