Viyuh Security

The platform

Everything aimed at you, in one view.

Ransomware leak sites, dark web forums, Telegram channels and breach data, collected around the clock and turned into one live picture of the threat. Analyst‑verified. Hosted in India.

Request a demo Talk to an expert
Viyuh Global Threat Dashboard showing a global threat posture score of 69 out of 100, 33,625 tracked ransomware victims since 2013, victims this year and month, active groups and top targeted countries.
Global threat dashboard. Threat posture, victims, active groups and the most targeted countries, live.

Two views, one toggle

The whole threat picture, and exactly where you sit in it.

The global view is always there: the full dataset across every sector and region.

Your own view is set up once and becomes your landing page. It opens on a situation brief, the groups hitting organisations like yours ranked by how far above normal they are, and the top fix to make first. One toggle switches between the two.

Viyuh organisation view with a situation brief (trend, biggest threat, top fix, exposure), headline counts and a ranked table of ransomware groups targeting the sector, each marked above, within or below normal.
Your organisation. Situation brief and the groups targeting your sector, ranked against normal.

Visual intelligence

Live maps, forecasts and heatmaps built on our own collection. Read the global picture in seconds, then drill into what concerns you.

Live threat globe plotting ransomware victim density by country.
Live threat globe. Victim density by country.
Activity spiral showing ransomware activity for every month since 2013, newest month at the centre.
Activity spiral. Every month since 2013, newest at the centre.
Global attack map shading every country by the number of ransomware victims recorded there.
Global attack map. All recorded victims, by country.
Country by month heatmap of ransomware victims for the ten most targeted countries over the last 13 months, from October 2025 to October 2026.
Country × month. The last 13 months, country by country.
Predictive analytics chart forecasting the next three months of ransomware victims with a 95 percent confidence band.
Forecast. The next three months, with a 95% confidence band.
Threat score matrix plotting active ransomware groups by number of victims against growth.
Threat score matrix. Active groups by volume and growth.
Donut chart of ransomware victims by sector, led by professional services, manufacturing and technology.
Victims by sector. Where attacks land.
Monthly activity timeline for the six most active ransomware families.
Group activity. The six most active families, month by month.
Automatic insights panel listing plain-language findings such as sector and country shifts computed from the data.
Automatic insights. Shifts worth knowing, in plain language.
Table of the ten most active ransomware groups with victim counts, countries hit and 30-day trend.
Top groups. Volume, reach and 30-day trend.

Action plan

What to fix next, mapped to the frameworks you report against.

Defensive controls are ranked by how much of the threat to your industry they block, using every attack we have recorded on organisations like yours. The gaps line up against NIST SP 800-53, NIST CSF, ISO 27001, SOC 2 and the DPDP Act.

Viyuh action plan showing threat coverage, controls in place, remaining gaps by compliance framework (800-53, CSF, ISO, SOC 2, DPDP) and a ranked list of controls to implement next.
Action plan. Threat coverage, remaining gaps and how they map to each framework.

Adversary techniques

Every technique, mapped.

358 MITRE ATT&CK techniques mapped across 80 ransomware groups, alongside MITRE D3FEND countermeasures and sector playbooks.

MITRE ATT&CK matrix in Viyuh with techniques grouped by tactic from reconnaissance to privilege escalation, each tagged with the groups that use it.
ATT&CK matrix. Techniques by tactic, tagged with the groups that use them.

Threat groups

A dossier on the groups that matter.

Victims, recent activity, trend, countries and sectors hit, leak sites and a threat score for each group. Know who you are dealing with before they reach you.

Viyuh profile of the Play ransomware group with a written profile, first and last seen dates, a monthly activity chart and the countries it has hit most.
Group dossier. Profile, monthly activity and the countries hit.

Capabilities

What the platform watches for you.

  • Global view

    The full dataset across every sector and region, always available. Your own view is set up once and becomes your landing page. One toggle switches between the two.

  • Ransomware tracking

    542 families and 3,883 leak-site links, updated continuously. See who is hitting your sector. Groups are flagged when their activity against your sector is statistically above normal.

  • Dark web and Telegram

    Your domains, brands and IP ranges matched against every post. Alerted on every match.

  • Credential exposure

    7 TB+ proprietary breach corpus searched for your domains, staff and customers. Records masked at rest.

  • Exploited vulnerabilities

    Your software stack checked against actively exploited CVEs, ranked by exploit likelihood.

  • Supplier exposure

    Vendors checked against known breaches. Your supplier list never leaves your device.

  • CISO brief

    Plain-language summary with peer benchmarking and a three-month outlook.

  • AI advisor

    Ask questions about threats to your organisation in plain language. Every answer runs one read-only query and shows the query behind it.

  • Action plan

    Your defensive gaps ranked, with what to fix next. Mapped to compliance frameworks.

  • Secure access

    Password + authenticator, or passkey. Breach data masked at rest.

Coverage

Built on our own collection.

A live dataset. Ransomware victims in 188 countries, tracked since 2013. Our analysts watch dark web and deep web activity around the clock, so these numbers grow every week. Figures as of October 2026.

Ransomware victims since 2013
33,000+
Ransomware families
542
Dark web links tracked
5,700+
Forum and Telegram posts
52,000+
Breach data
7 TB+
Exploited CVEs scored
1,700+
MITRE ATT&CK techniques
358
Indian victims
560+

Integrations and security

Hosted in India. Plugs into your SOC.

Integrations

STIX/TAXII into your SIEM, SOAR or firewall. Real-time alerts on the dashboard and by email. Full API.

  • STIX/TAXII
  • SIEM
  • SOAR
  • Firewall
  • Email alerts
  • API

Security and privacy

  • Client data never leaves India
  • Breach data masked at rest
  • Supplier list never leaves your device
  • Password + authenticator, or passkey

Compliance mapping

Mapped to the DPDP Act, NIST CSF 2.0, NIST SP 800-53, ISO 27001 and SOC 2. DPDP enforcement starts May 2027.

  • DPDP Act
  • NIST CSF 2.0
  • NIST SP 800-53
  • ISO 27001
  • SOC 2

Request a demo

See your own threat picture, live.

Book a demo of the platform or talk to an expert about an engagement. Under attack? Call our 24/7 line.

Request a demo Talk to an expert WhatsApp us