How it works
You draft threat actors, ransomware crews, countries, vendors and sectors, and score points from their activity during the season. Takedowns pay a jackpot. All times are Amsterdam time.
1 · Draft
The ChristmasCTI draft closed on 2026-10-26 08:59. Every player filled these slots:
- · Ransomware crew #1
- · Ransomware crew #2
- · Threat actor / APT #1
- · Threat actor / APT #2
- · Victim country
- · Attacker origin
- · Vendor
- · Target sector
- · Wildcard
The wildcard can be any type of entity, but it has to be tier C or D. At most 3 of your picks can be tier C or D, wildcard included. You can change your roster as often as you like until the admin starts the season.
Missed the draft? For 20 days after the season starts you can still join. Your picks only score events from the moment you join, your multipliers are fixed right away, and you can't pick anything that was already taken down. While you're picking you see only the base multipliers and nobody else's roster. To help you catch up, you get +10% on what your picks score in your first 2 days.
2 · Tiers
Every entity has a tier from S (busiest) to D (quiet or unknown). For crews, victim countries, vendors and sectors, the tier comes from the last 90 days of feed activity: the top 10% are S, the next 20% A, then 30% B and 25% C, and the rest D. Threat actors and attacker origins have no feed, so the admin sets their tiers. Tiers only change between seasons, never mid-draft.
3 · Multipliers
Base multiplier per tier:
Your multiplier is tier × owners−0.5, so it drops when more players own the same entity. It's fixed when the season starts.
| Tier | 1 owner | 2 owners | 4 owners | 8 owners |
|---|---|---|---|---|
| S | ×1.00 | ×0.71 | ×0.50 | ×0.35 |
| D | ×7.00 | ×4.95 | ×3.50 | ×2.47 |
4 · Scoring
Points come from:
- · ransomware.live: every leak-site victim claim scores for the crew, the victim's country and the sector.
- · CISA KEV: vulnerabilities being exploited in the wild score for the vendor.
- · NVD: CVEs rated critical score for the vendor.
- · The admin: takedowns, attributions and major reports, including ones players report or the news scanner spots, once the admin approves them.
Only events between 2026-10-26 and 2027-01-04 count. Pick points = volume × your multiplier + flat points.
| Entity | Event | Points | Multiplied? |
|---|---|---|---|
| Threat actor / APT | Takedown / arrest / indictment / exit | 500 | flat |
| Threat actor / APT | Attributed major incident | 100 | yes |
| Threat actor / APT | Named in a major report | 50 | yes |
| Attacker origin | Attributed major incident | 50 | yes |
| Attacker origin | Named in a major report | 20 | yes |
| Attacker origin | Ransomware victim claimed | 1 | yes |
| Ransomware crew | Takedown / arrest / indictment / exit | 500 | flat |
| Ransomware crew | Attributed major incident | 50 | yes |
| Ransomware crew | Named in a major report | 50 | yes |
| Ransomware crew | Ransomware victim claimed | 10 | yes |
| Target sector | Ransomware victim claimed | 2.5 | yes |
| Vendor | Added to CISA KEV | 50 | yes |
| Vendor | Critical CVE | 20 | yes |
| Victim country | Ransomware victim claimed | 2.5 | yes |
Threat actors and crews linked to an attacker origin pass their events on to that country, at the country's rate. Scores update on their own a few seconds after anything changes.
5 · Dead pool
When an entity is taken down, arrested, indicted or exit-scams, its owners bank the jackpot. The jackpot is flat, so no multiplier applies, and it pays once, however many sources report it. After that the entity is dead and scores nothing for the rest of the season.
6 · Props
Side questions with a 200-point pot, split evenly among everyone who answers correctly. If you're the only one who's right, you get the whole pot. Answers lock at each question's deadline.
7 · Teams
Your team is your department. Team score = total points ÷ players on the team, so team size doesn't matter. Teammates who didn't draft count as 0.
Departments can belong to a company. Companies are ranked the same way: total points ÷ players in the company. Each company also has its own leaderboard, where its players and departments are ranked against each other only. Companies only appear under a codename (a word plus an animal for the country, like APT names), so the site never shows which companies take part.
8 · Badges
- Called it: Banked a takedown jackpot
- Degenerate: A tier C/D long shot outscored every favourite
- Oracle: The only one to call a prop
- Lone wolf: Nobody else drafted their best pick
- Rocket: Climbed the most places today
- On fire: Scored the most points today
"Today" means since yesterday's final scores. Rocket and On fire are only given during a live season.
9 · Seasons and titles
The top of the leaderboard when a season ends wins it. Each finish also earns title points (25, 18, 15, 12, 10, 8, 6, 4, 2, 1 for 1st to 10th), and the most title points across a year's seasons makes you year champion. Ties go to season wins, then podiums. A season counts for the year it started. Past seasons live on the History page and on everyone's profile.
10 · Events, reports and suggestions
The Events page lists everything. Relevant shows only events that moved the leaderboard; All shows everything. If the feeds missed a takedown or put a claim on the wrong crew, click Report and the admin will review it. Missing actors, crews, vendors or sectors can be suggested one at a time or by CSV. You'll get an alert when the admin has reviewed it.