Nico- one of the gold standards I've seen used is FireEye's M- Trend reports from Mandiant. It may not have the deep datasets that you are looking for, but will provide you with an overview of trends in fairly open layman terms. Here is a starting point for FireEye: https://content.fireeye.com/m-trends/rpt-m-trends-2020

Kapersky's Target cyberattacks logbook has some useful filters you can apply: https://apt.securelist.com/#

Finally, this APT database may be of use to you depending on your starting question: https://docs.google.com/spreadsheets/u/1/d/1H9_xaxQHpWaa4O_Son4Gx0YOIzlcBWMsdvePFX68EKU/pubhtml

EDIT: Based on my own course work, one of the reasons you may be having a hard time finding open databases on this topic is due to the 'kidnap effect' - no one wants to admit to having been successfully targeted by ransomware and having paid to unlock. Very few local governments have been willing to admit to having been hit by successful ransomware attacks - in the US the 2018 hack on Atlanta is probably the best known, but remains an outlier in that they openly admitted what had happened and did not pay. Similarly, NotPetya is well known because early on victims discovered that paying the ransom didn't unlock their files. I doubt Maersk would have admitted the attack or taken the financial damage if they had the cheaper option of paying the bounty.

Andrew King

Hi Andrew, thank you for the recommendations! Yes, it's very true that much of the data I'm looking for will be difficult to access. My lecturers have told me however that my project idea is good and I should work on it, but without being able to find data to create trends I am struggling quite a bit. Additionally, I've attempted to shift my search focus to cyberattacks on government bodies in general, so that I can create the 'link' between targetted attacks and councils/local governments and implement the JDL framework levels for a recommendation. Data is the biggest issue for me here.

Nico - I'd suggest reaching out to some of the research leaders. Dr. Christopher Whyte provided the APT database above to our class in Cybersecurity at VCU, which was more of an overview than the deep-dive it sounds like you are undertaking. He or others may be able to point you in the right direction: https://wilder.vcu.edu/people/faculty/christopher-whyte-.html

Andrew King Thanks will do. I am however in the UK so Im not sure if this will impact my assignments, but im sure using data from the UK and US will be beneficial

Dear Michael A. Cretacci,

Thank you for adding an answer to the question Where could I find open datasets on ransomware attacks that target councils and local governments, based in the UK and US?

Best Regards

Desalegn Abraha