Looking for the threat feed? It now lives at threatcluster.io/threats.
20,000 sources collapsed into one scored record per incident, queryable by your code or your agent.
Connect any MCP client to one URL, or call the REST API directly. Clustered incident reporting, validated IOCs, vulnerability intelligence and first-party dark-web collection behind one free key.
As seen on
Three ways to tap into threat intelligence
Connect an agentOne MCP endpoint, ten tools. Claude, Cursor, VS Code or anything that speaks MCP. Nothing to install. Call the API70+ REST endpoints over incidents, indicators, entities, CVEs and the dark web. JSON, STIX, CSV. Read the feedThe same corpus as a scored, deduplicated news feed. Every incident once, with its sources and timeline.
Threat intelligence for the agentic era
LLMs know the past, not this year. We asked eight leading models about 20 ransomware groups that appeared this summer: not one answer was right, and every one was confident. Connected to ThreatCluster, every answer was right.
0 of 150Correct without ThreatClusterEight leading models, 20 ransomware groups that first appeared June to September 2026.
158 of 158Correct with ThreatClusterSame models, same questions, one record supplied.
225Fake indicators inventedFive of eight models made up IP addresses and hashes when asked for IOCs. None were real.
5x cheaperThan an LLM with web search$0.002 per answer against $0.012, and no citations to re-verify.
5x fasterAbout one second per answerWeb-search models averaged 5.2 seconds.
We found this IP in an alert, is it malicious? 210.1.231.13
Yes. Treat it as malicious, high confidence.
210.1.231.13 is a validated IOC, first and last seen 15 Sep 2026. It resolves turbo.c2iznja.com, a BambooToken command-and-control subdomain: the resolution for the C2, not an incidental mention. Source: Lumen Black Lotus Labs, corroborated by BleepingComputer and The Hacker News.
BambooToken is a Windows/Linux implant that uses MQTT for C2. It is unusual enough that most egress monitoring ignores it, common enough in IoT estates that it is not automatically suspicious. Active since Feb 2023, targeting finance and government across Asia and South America.
Triage
- Direction and port. Outbound to 1883 or 8883 from an internal host is the signal. Inbound scanning is not.
- Pivot on the domains. Infrastructure rotates, so the IP may go cold while
*.c2iznja.comand*.chat5188.tkstay live. Hunt DNS for both. - Sweep related infrastructure:
202.144.192.13,202.144.192.23,210.1.226.163,43.245.198.195,38.180.150.19.
A block is safe; a compromise verdict is not. This rests on one research publication, and C2 infrastructure in an alert does not mean the host is infected. That depends on direction, volume and whether a session was established. Outbound and sustained: isolate.
Has anyone in manufacturing been hit this week?
Yes. Manufacturing is the most-hit sector this week, by a wide margin.
43 of 182 leak-site listings in the last seven days were manufacturing, a quarter of all claims, ahead of Technology (21) and Professional Services (19). The US leads with 58 listings across all sectors, then India (10), Germany (7), Japan (7). Most active groups: thegentlemen (32), qilin (18), krybit (13), auditteam (11), safepay (10).
Notable claims
- Nippon Steel Corporation (JP), metaencryptor, 15 Sep. Japan's largest steelmaker.
- Kimberly-Clark (US), shinyhunters, 13 Sep.
- Honda (Peru), panzer, 15 Sep.
- SFA Engineering (KR), metaencryptor, 15 Sep. Semiconductor and display equipment.
- Taurus Ibérica (ES), qilin, 15 Sep.
The bulk were mid-market industrial suppliers: Foremost Mfg, Glasfloss, Steelhaus, Marlin HVAC, Pilot Precision (US); Neumerkel GmbH (DE); Gilco Scaffolding (GB); Hashimoto Jimuki (JP); Cumar Marble & Granite (TR).
Beyond the leak sites
- AI-driven attacks on exposed ICS/PLCs (14 Sep, score 71.5): Canadian Cyber Centre warning; manufacturing named alongside utilities, energy, food.
- Russian AI-driven espionage against Ukrainian drone makers (12 Sep, score 77.9): GTG-20006, 20+ organisations, via phishing.
These are claims posted by the groups, not confirmed breaches. Treat them as leads to verify.
What's the biggest incident right now?
Cisco Secure FMC under active exploitation: threat score 88.25, the highest in the corpus over both 24 hours and 7 days. 36 articles. First seen 9 Sep, still top today.
| CVE | CVSS | What |
|---|---|---|
CVE-2026-20079 | 10.0 | Unauthenticated remote authentication bypass. Published 4 Mar. |
CVE-2026-20316 | n/a | Hard-coded credentials (CWE-798). Published 29 Jul. |
Why it's the biggest
- It is the security control itself. FMC is the firewall management plane, so compromise gives root and the power to rewrite policy downstream.
- State and criminal actors at once. Sandworm / GRU Unit 74455 alongside Qilin ransomware, the same Qilin posting leak-site victims this week.
- A perfect-score bypass with a credential backdoor beside it. No user interaction, no authentication.
Post-exploitation: root, backdoor, credential dumping (T1003), lateral movement over remote services (T1021), pass-the-hash via Impacket and WinRM against AD, ADFS, Kerberos and LDAP. Malware: PivotC2 RAT, Cyclops Blink, Lumma Stealer, Vidar.
Runners-up
- Cisco Secure Email Gateway zero-day (14 Sep, 82.25):
CVE-2026-76461, SQLi to root. Second Cisco perimeter product in a week. - GitLab exploited within hours (11 Sep, 81, 82 articles):
CVE-2026-85706, CVSS 10.0, weaponised same day.
If you act on one thing: both Cisco products are internet-facing with active exploitation and a CVSS-10-class bypass. That is this week's patch queue.
What do you know about Midnight Blizzard?
Russian SVR-attributed espionage actor. 27 mentions, 15 clusters. Active reporting up to three days ago.
Tracked under a cluster of names that all point at the same operation: APT29, Cozy Bear, The Dukes, and for the latest activity the tracker GTG-20006. First seen 2025-10-29, last seen 2026-09-12.
What they're doing now
The live story is the Russian AI-driven espionage campaign (12 Sep, score 77.9, 20 articles): GTG-20006 using commercial AI tooling to automate espionage against 20+ organisations in Ukraine and Europe, government officials, military personnel and drone manufacturers, via phishing. Coverage: Kyiv Independent, The Guardian, United24.
Also in: APT28's Zimbra exploitation against Ukraine (19 Mar, 80.9, their highest-scoring cluster), the critical Zimbra RCE (19 Aug, 79), and Microsoft's record 974-vulnerability Patch Tuesday.
Tradecraft and targeting
Phishing (T1566) first, then credential dumping (T1003), exfiltration over C2 (T1041) and web services (T1567). Tooling in-corpus: CloudSyncSvc, ClickFix, BoxOfFriends, CompactGopher. Targets: Government first, then Energy, Technology, Healthcare, Financial. Platform focus is the Microsoft estate: M365, Entra ID, Azure, Windows.
The corpus lists APT29, Cozy Bear, The Dukes and Midnight Blizzard as related entities rather than merged aliases, so counts under each name are partial. Union them for a true total.
Get a free API keyConnect via MCPhttps://threatcluster.io/mcp
What the API returns
70+ endpoints over incidents, IOCs, entities, vulnerabilities, the dark web, and the feeds, alerts and webhooks you run through the API. Pick an endpoint and a language, and see the real response.
Incident records, deduplicated from every source that covered them
GET /threats?time_filter=24hcurl -H "X-API-Key: $TC_KEY" \
"https://threatcluster.io/api/public/v1/threats?time_filter=24h"import requests
r = requests.get("https://threatcluster.io/api/public/v1/threats?time_filter=24h",
headers={"X-API-Key": TC_KEY})
print(r.json())const r = await fetch("https://threatcluster.io/api/public/v1/threats?time_filter=24h",
{headers: {"X-API-Key": process.env.TC_KEY}});
console.log(await r.json());{
"threats": [
{
"cluster_id": "5f578c75-abf8-4fbd-915b-d4037386092f",
"title": "Iranian cyber spies target aviation, fintech developers with new malware",
"ai_title": "Mirage Kitten Targets Aviation and FinTech with New Cross-Platform Malware",
"ai_summary": "The Iranian cyberespionage group Mirage Kitten has launched a campaign targeting technology professionals in the aviation and FinTech sectors across…",
"timeline": [
{
"date": "2026-09-01",
"event": "New malware families identified",
"detail": "Kaspersky reported on the discovery of NodeRabbit and PollCat used by Mirage Kitten to ta…",
"source": "Securelist"
}
],
"article_count": 3,
"threat_score": 78.5,
"severity_score": 80.0,
"urgency_level": "medium",
"keywords": [
"malware",
"iranian"
],
"sources": [
"Thehackernews",
"Therecord.Media"
],
"date_range_latest": "2026-09-01T13:08:58+00:00",
"articles": [
{
"title": "Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new m…",
"source": "Securelist",
"pub_date": "2026-09-01T07:00:26+00:00",
"url": "https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244/"
}
],
"entities": {
"apt_group": [
"Iranian Dream Job",
"Lazarus Group"
],
"attack_type": [
"Malware",
"Phishing"
]
},
"slug": "mirage-kitten-targets-aviation-and-fintech-with-new-cross-pl-7386092f",
"ioc_count": 12
},
{
"cluster_id": "afb356a7-d498-4c89-920a-44025c9b39fa",
"title": "CPAI-2026-10671 - Check Point Software",
"ai_title": "Multiple Remote Code Execution Vulnerabilities Identified in Check Point Software",
"ai_summary": "Check Point Software has issued advisories for two critical remote code execution vulnerabilities. The first, CVE-2026-53576, was published on June 2…",
"timeline": [
{
"date": "2026-06-11",
"event": "CVE-2026-44495 published",
"detail": "Check Point disclosed a remote code execution vulnerability affecting its Security Gatewa…",
"source": "Advisories.Checkpoint"
}
],
"article_count": 2,
"threat_score": 74.0,
"severity_score": 80.0,
"urgency_level": "medium",
"keywords": [
"protection",
"update"
],
"sources": [
"Advisories.Checkpoint"
],
"date_range_latest": "2026-08-31T18:52:57+00:00",
"articles": [
{
"title": "CPAI-2026-10476 - Check Point Software",
"source": "Advisories.Checkpoint",
"pub_date": "2026-08-30T19:04:16+00:00",
"url": "https://advisories.checkpoint.com/defense/advisories/public/2026/cpai-2026-10476.html"
}
],
"entities": {
"attack_type": [
"Zero-Day Exploit"
],
"cve": [
"CVE-2026-44495",
…Indicators validated on ingest, with the incidents behind them
GET /entities/ipv4/172.86.98.113curl -H "X-API-Key: $TC_KEY" \
"https://threatcluster.io/api/public/v1/entities/ipv4/172.86.98.113"import requests
r = requests.get("https://threatcluster.io/api/public/v1/entities/ipv4/172.86.98.113",
headers={"X-API-Key": TC_KEY})
print(r.json())const r = await fetch("https://threatcluster.io/api/public/v1/entities/ipv4/172.86.98.113",
{headers: {"X-API-Key": process.env.TC_KEY}});
console.log(await r.json());{
"entity": {
"entity_type": "ipv4",
"entity_value": "172.86.98.113",
"frequency": 3,
"first_seen": "2026-07-28T08:00:20+00:00",
"last_seen": "2026-08-26T13:14:45.486953+00:00",
"confidence": "false_positive",
"reason": "MISP warninglist: Specialized list of vpn-ipv4 addresses belonging to common VPN provider…"
},
"clusters": [
{
"cluster_id": "93bf14f2-0238-400a-a0c0-75d8682fb07b",
"title": "Tortoiseshell Expands Malware Toolset With New Backdoor, SSH Tunnel",
"ai_title": "Tortoiseshell Expands Malware Arsenal with New Backdoor and SSH Tunneling Tool",
"ai_summary": "The Iranian-linked Tortoiseshell APT group has expanded its malware toolkit, introducing a new backdoor and reverse SSH tunneling utility. Group-IB T…",
"article_count": 6,
"threat_score": 77.0,
"severity_score": 80.0,
"date_range_latest": "2026-08-26T14:30:00+00:00",
"slug": "tortoiseshell-apt-expands-malware-capabilities-with-new-tool-682fb07b"
},
{
"cluster_id": "c6981ff6-0654-4b96-abfc-7934c099231a",
"title": "Cybersecurity Researchers Uncover Mirage Kitten Malware Sweeping Across Africa",
"ai_title": "Mirage Kitten Malware Targets Middle East and Africa with New Toolset",
"ai_summary": "The Mirage Kitten APT group has deployed a sophisticated malware suite, including the NightLedger backdoor, across the Middle East and Africa. This c…",
"article_count": 2,
"threat_score": 75.5,
"severity_score": 80.0,
"date_range_latest": "2026-07-30T06:15:08+00:00",
"slug": "cybersecurity-researchers-uncover-mirage-kitten-malware-swee-c099231a"
}
],
"articles": [
{
"title": "Securelist",
"source": "securelist.com",
"pub_date": "2026-08-26T13:14:45.486953+00:00",
"url": "https://securelist.com/mirage-kitten-new-tools/120811/?kaspr=5bet"
},
{
"title": "Tortoiseshell: New Toolset and Operational Infrastructure Exposed | Group",
"source": "Group-Ib",
"pub_date": "2026-08-26T09:32:20+00:00",
"url": "https://www.group-ib.com/blog/tortoiseshell-apt-toolset-infrastructure/"
}
],
"co_entities_with_counts": {
"apt_group": [
{
"value": "Mirage Kitten",
"count": 3
}
],
"attack_type": [
{
"value": "Malware",
"count": 3
}
],
"platform": [
{
"value": "Windows",
"count": 3
}
],
"malware": [
{
"value": "Twostroke",
"count": 2
}
]
},
"aliases": []
}Leak sites, markets and postings from our own Tor collection
GET /darkweb/keyword-hits?keywords=Intracocurl -H "X-API-Key: $TC_KEY" \
"https://threatcluster.io/api/public/v1/darkweb/keyword-hits?keywords=Intraco"import requests
r = requests.get("https://threatcluster.io/api/public/v1/darkweb/keyword-hits?keywords=Intraco",
headers={"X-API-Key": TC_KEY})
print(r.json())const r = await fetch("https://threatcluster.io/api/public/v1/darkweb/keyword-hits?keywords=Intraco",
{headers: {"X-API-Key": process.env.TC_KEY}});
console.log(await r.json());{
"keywords": [
"Intraco"
],
"hits": {
"victims": [
{
"id": "bdd665d27f502e10",
"victim_name": "PT Intraco Penta Tbk",
"group_name": "direwolf",
"country": "ID",
"sector": "Manufacturing",
"discovered": "2026-09-01T15:53:54.238628+00:00"
}
],
"groups": [],
"markets": [],
"breaches": []
},
"total": 2
}Groups, malware, CVEs and companies as one linked record each
GET /entities/ransomware_group/Qilincurl -H "X-API-Key: $TC_KEY" \
"https://threatcluster.io/api/public/v1/entities/ransomware_group/Qilin"import requests
r = requests.get("https://threatcluster.io/api/public/v1/entities/ransomware_group/Qilin",
headers={"X-API-Key": TC_KEY})
print(r.json())const r = await fetch("https://threatcluster.io/api/public/v1/entities/ransomware_group/Qilin",
{headers: {"X-API-Key": process.env.TC_KEY}});
console.log(await r.json());{
"entity": {
"entity_type": "ransomware_group",
"entity_value": "Qilin",
"frequency": 202,
"first_seen": "2025-10-23T10:00:58+00:00",
"last_seen": "2026-08-28T04:41:40+00:00"
},
"overview": "Qilin is a hacking group associated with ransomware activities, known for deploying malware to encrypt victims’ data and demanding ransom payments. C…",
"clusters": [
{
"cluster_id": "ed358032-faeb-477c-a14e-91043243f6d9",
"title": "Akira Ransomware Group Poses ‘Imminent Threat’ to Critical Infrastructure: CISA",
"ai_title": "Akira Ransomware Group Targets Critical Infrastructure, Extracts $42 Million",
"ai_summary": "The Akira ransomware group has been identified as a significant threat to critical infrastructure, with the U.S. Cybersecurity and Infrastructure Sec…",
"article_count": 9,
"threat_score": 82.98,
"severity_score": 81.0,
"date_range_latest": "2025-11-14T06:57:11+00:00",
"slug": "akira-ransomware-group-targets-critical-infrastructure-extra-3243f6d9"
},
{
"cluster_id": "ed641903-140b-473f-ac63-c68536ffb106",
"title": "Pharma Firm Inotiv Confirms Data Breach Following Ransomware Attack",
"ai_title": "Inotiv Confirms Data Breach from August 2025 Ransomware Attack",
"ai_summary": "Inotiv, an Indiana-based pharmaceutical firm, has confirmed a data breach resulting from a ransomware attack that occurred in August 2025. The compan…",
"article_count": 4,
"threat_score": 78.81,
"severity_score": 75.0,
"date_range_latest": "2025-12-08T07:52:53+00:00",
"slug": "inotiv-confirms-data-breach-from-august-2025-ransomware-atta-36ffb106"
}
],
"articles": [
{
"title": "Two TeamPCP members arrested in Australia",
"source": "News.Risky.Biz",
"pub_date": "2026-08-28T04:41:40+00:00",
"url": "https://news.risky.biz/risky-bulletin-two-teampcp-members-arrested-in-australia/"
},
{
"title": "6054150 Atf Investigating Cybersecurity Incident Doj Qilin",
"source": "thehill.com",
"pub_date": "2026-08-27T18:34:38.113720+00:00",
"url": "https://thehill.com/homenews/administration/6054150-atf-investigating-cybersecurity-incident-doj-qi…"
}
],
"co_entities_with_counts": {
"attack_type": [
{
"value": "Ransomware",
"count": 180
}
],
"ransomware_group": [
{
"value": "Akira",
"count": 53
}
],
"industry": [
{
"value": "Government",
"count": 35
}
],
"platform": [
{
"value": "Windows",
"count": 31
}
]
},
"aliases": []
}One term across incidents, indicators, entities and leak sites
GET /search?q=Intracocurl -H "X-API-Key: $TC_KEY" \
"https://threatcluster.io/api/public/v1/search?q=Intraco"import requests
r = requests.get("https://threatcluster.io/api/public/v1/search?q=Intraco",
headers={"X-API-Key": TC_KEY})
print(r.json())const r = await fetch("https://threatcluster.io/api/public/v1/search?q=Intraco",
{headers: {"X-API-Key": process.env.TC_KEY}});
console.log(await r.json());{
"query": "Intraco",
"clusters": [],
"entities": [],
"darkweb": [
{
"type": "victim",
"name": "PT Intraco Penta Tbk",
"id": "bdd665d27f502e10",
"date": "2026-09-01T15:53:54.238628+00:00",
"group": "direwolf",
"country": "ID",
"sector": "Manufacturing"
}
],
"limit": 10,
"total": 1
}A cited answer, from the reporting itself
POST /threats/windows-afdsys-zero-f15d3d54/ask
{"action": "recommended_actions"}curl -X POST -H "X-API-Key: $TC_KEY" -H "Content-Type: application/json" \
-d '{"action": "recommended_actions"}' \
"https://threatcluster.io/api/public/v1/threats/windows-afdsys-zero-f15d3d54/ask"import requests
r = requests.post("https://threatcluster.io/api/public/v1/threats/windows-afdsys-zero-f15d3d54/ask",
headers={"X-API-Key": TC_KEY}, json={"action": "recommended_actions"})
print(r.json())const r = await fetch("https://threatcluster.io/api/public/v1/threats/windows-afdsys-zero-f15d3d54/ask", {
method: "POST", headers: {"X-API-Key": TC_KEY, "Content-Type": "application/json"},
body: JSON.stringify({"action": "recommended_actions"}) });
console.log(await r.json());{
"answer": "**Patch first.** Apply the AFD.sys fix from the February cumulative update; the exploited build range is 10.0.19041–22631 [A1].\n- **Detection** — hunt for afd.sys crash events (0x7E) preceding new service creation [A2] [A3].\n- **Containment** — Lazarus tooling stages via a signed loader; block the listed hashes at the EDR [A4].\n- ...",
"sources": [ {"tag": "A1", "title": "Microsoft: CVE-2026-… actively exploited", "url": "https://…"}, {"tag": "A2", "title": "…"} ],
"context_used": {"cluster_title": "Lazarus Group Exploits Windows Zero-Day to Target Defense Sector", "primary_articles_used": 7, "cves_enriched": 1},
"cost": 25,
"cached": false
}Your stack, your suppliers, your webhooks: monitoring you run through the API
POST /feeds
{"name": "Our stack", "entities": [{"keyword": "FortiOS", "entity_type": "platform"}, {"keyword": "Okta", "entity_type": "company"}, {"keyword": "Ivanti", "entity_type": "company"}]}curl -X POST -H "X-API-Key: $TC_KEY" -H "Content-Type: application/json" \
-d '{"name": "Our stack", "entities": [{"keyword": "FortiOS", "entity_type": "platform"}, {"keyword": "Okta", "entity_type": "company"}, {"keyword": "Ivanti", "entity_type": "company"}]}' \
"https://threatcluster.io/api/public/v1/feeds"import requests
r = requests.post("https://threatcluster.io/api/public/v1/feeds",
headers={"X-API-Key": TC_KEY}, json={"name": "Our stack", "entities": [{"keyword": "FortiOS", "entity_type": "platform"}, {"keyword": "Okta", "entity_type": "company"}, {"keyword": "Ivanti", "entity_type": "company"}]})
print(r.json())const r = await fetch("https://threatcluster.io/api/public/v1/feeds", {
method: "POST", headers: {"X-API-Key": TC_KEY, "Content-Type": "application/json"},
body: JSON.stringify({"name": "Our stack", "entities": [{"keyword": "FortiOS", "entity_type": "platform"}, {"keyword": "Okta", "entity_type": "company"}, {"keyword": "Ivanti", "entity_type": "company"}]}) });
console.log(await r.json());{
"feed_id": "17ae839a-a413-4c6b-91a5-b2b830f09699",
"name": "Our stack",
"mssp_customer_id": null,
"keywords_added": 3
}GET /threats?time_filter=7d&sort_by=score{
"threats": [
{
"cluster_id": "32e38748-219f-4340-853f-7c4593fb80f8",
"title": "Chinese Speaking Operator Philippine Nuclear Naval Contractor",
"ai_title": "Chinese Operator Breaches Philippine Nuclear and Naval Entities",
"ai_summary": "A suspected Chinese-speaking operator has compromised a Philippine nuclear research body and a marine engineering company supporting the Philippine N…",
"timeline": [
{
"date": "2023-11-21",
"event": "CVE-2023-49105 published",
"detail": "Authentication-bypass flaw in ownCloud allows unauthorized file access via WebDAV.",
"source": "Article 2"
}
],
"article_count": 4,
"threat_score": 80.7,
"severity_score": 81.0,
"urgency_level": "medium",
"keywords": [
"philippine",
"nuclear"
],
"sources": [
"hunt.io",
"Securityaffairs.Co"
],
"date_range_latest": "2026-08-31T12:34:31.263942+00:00",
"articles": [
{
"title": "Philippine Nuclear and Naval Targets Hit by Suspected Chinese Operator",
"source": "Securityaffairs.Co",
"pub_date": "2026-08-29T09:16:52+00:00",
"url": "https://securityaffairs.com/198041/intelligence/philippine-nuclear-and-naval-targets-hit-by-suspect…"
}
],
"entities": {
"attack_type": [
"Data Breach"
],
"campaign": [
"Operation CameraSwarm"
]
},
"slug": "chinese-speaking-actor-breaches-philippine-nuclear-and-naval-93fb80f8",
"ioc_count": 4
},
{
"cluster_id": "5f578c75-abf8-4fbd-915b-d4037386092f",
"title": "Iranian cyber spies target aviation, fintech developers with new malware",
"ai_title": "Mirage Kitten Targets Aviation and FinTech with New Cross-Platform Malware",
"ai_summary": "The Iranian cyberespionage group Mirage Kitten has launched a campaign targeting technology professionals in the aviation and FinTech sectors across…",
"timeline": [
{
"date": "2026-09-01",
"event": "New malware families identified",
"detail": "Kaspersky reported on the discovery of NodeRabbit and PollCat used by Mirage Kitten to ta…",
"source": "Securelist"
}
],
"article_count": 3,
"threat_score": 78.5,
"severity_score": 80.0,
"urgency_level": "medium",
"keywords": [
"malware",
"iranian"
],
"sources": [
"Thehackernews",
"Therecord.Media"
],
"date_range_latest": "2026-09-01T13:08:58+00:00",
"articles": [
{
"title": "Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new m…",
"source": "Securelist",
"pub_date": "2026-09-01T07:00:26+00:00",
"url": "https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244/"
}
],
"entities": {
"apt_group": [
"Iranian Dream Job",
"Lazarus Group"
],
"attack_type": [
"Malware",
…
GET /threats?keyword=Windows{
"threats": [
{
"cluster_id": "93bf14f2-0238-400a-a0c0-75d8682fb07b",
"title": "Tortoiseshell Expands Malware Toolset With New Backdoor, SSH Tunnel",
"ai_title": "Tortoiseshell Expands Malware Arsenal with New Backdoor and SSH Tunneling Tool",
"ai_summary": "The Iranian-linked Tortoiseshell APT group has expanded its malware toolkit, introducing a new backdoor and reverse SSH tunneling utility. Group-IB T…",
"timeline": [
{
"date": "2026-08-26",
"event": "Group-IB publishes findings on Tortoiseshell",
"detail": "Group-IB identified new malware samples and infrastructure linked to Tortoiseshell, revea…",
"source": "Group-IB"
}
],
"article_count": 6,
"threat_score": 77.0,
"severity_score": 80.0,
"urgency_level": "medium",
"keywords": [
"tortoiseshell",
"toolset"
],
"sources": [
"Infosecurity-Magazine",
"Gbhackers"
],
"date_range_latest": "2026-08-26T14:30:00+00:00",
"articles": [
{
"title": "Tortoiseshell: New Toolset and Operational Infrastructure Exposed | Group",
"source": "Group-Ib",
"pub_date": "2026-08-26T09:32:20+00:00",
"url": "https://www.group-ib.com/blog/tortoiseshell-apt-toolset-infrastructure/"
}
],
"entities": {
"apt_group": [
"GalaxyGato",
"Imperial Kitten"
],
"attack_type": [
"Data Breach",
"Malware"
]
},
"slug": "tortoiseshell-apt-expands-malware-capabilities-with-new-tool-682fb07b",
"ioc_count": 10
},
{
"cluster_id": "2984a6af-53aa-42eb-b22d-e01373643c61",
"title": "Suspected China-linked espionage campaign targets India's finance ecosystem: Seqrite",
"ai_title": "China-Linked Cyber Espionage Targets India's Tax Ecosystem",
"ai_summary": "Seqrite has reported a cyber-espionage campaign named Operation DragonReturn, targeting India's taxpayer ecosystem by impersonating the Income Tax De…",
"timeline": [
{
"date": "2026-08-31",
"event": "Seqrite discloses Operation DragonReturn",
"detail": "Seqrite reveals a cyber-espionage campaign targeting India's tax ecosystem, leveraging ph…",
"source": "Crnasia"
}
],
"article_count": 2,
"threat_score": 76.25,
"severity_score": 80.0,
"urgency_level": "medium",
"keywords": [
"campaign",
"seqrite"
],
"sources": [
"Crnasia",
"Itvoice.In"
],
"date_range_latest": "2026-08-31T07:05:10+00:00",
"articles": [
{
"title": "Seqrite Uncovers China-Linked Cyber Espionage Campaign Targeting India's Tax Ecosystem",
"source": "Itvoice.In",
"pub_date": "2026-08-31T07:00:01+00:00",
"url": "https://www.itvoice.in/seqrite-uncovers-operation-dragonreturn-china-nexus-cyber-espionage-campaign…"
}
],
"entities": {
"attack_type": [
"Malware",
"Phishing"
],
…
GET /threats?keyword=NASA{
"threats": [
{
"cluster_id": "466996d6-4a06-43a7-af8c-116354a06405",
"title": "US officials backpedal on claims that government agencies were hacked by Chinese",
"ai_title": "US Officials Clarify Cyberattack Claims Involving Chinese Hackers",
"ai_summary": "On August 28, 2026, U.S. officials revised previous statements claiming that several government agencies were hacked by Chinese spies. The Justice De…",
"timeline": [
{
"date": "2026-08-25",
"event": "Initial claims of hacking made",
"detail": "U.S. officials initially claimed that multiple government agencies had been hacked by Chi…",
"source": "Databreaches"
}
],
"article_count": 6,
"threat_score": 43.0,
"severity_score": 41.0,
"urgency_level": "medium",
"keywords": [
"officials",
"claims"
],
"sources": [
"Databreaches",
"Straitstimes"
],
"date_range_latest": "2026-08-29T15:02:26+00:00",
"articles": [
{
"title": "US officials backpedal on claims that government agencies were hacked by Chinese, now ...",
"source": "Straitstimes",
"pub_date": "2026-08-29T09:17:02+00:00",
"url": "https://www.straitstimes.com/world/united-states/us-officials-backpedal-on-claims-that-government-a…"
}
],
"entities": {
"apt_group": [
"QTFY"
],
"attack_type": [
"Data Breach"
]
},
"slug": "us-officials-clarify-cyberattack-claims-involving-chinese-ha-54a06405",
"ioc_count": 0
}
],
"count": 1,
"limit": 50,
"offset": 0,
"time_filter": "7d",
"sort_by": "trending"
}
GET /threats?keyword=healthcare{
"threats": [
{
"cluster_id": "3c37d8bc-d676-48ec-aabd-a7fe732cdfd2",
"title": "Attack hides malware in PNGs and drops custom reverse tunnel on victims' machines",
"ai_title": "Healthcare Cyberattacks Disrupt Patient Care and Expose Sensitive Data",
"ai_summary": "Two major healthcare companies, Boston Scientific and Nutex Health, reported cyberattacks that compromised patient data and disrupted operations. Bos…",
"timeline": [
{
"date": "2026-08-24",
"event": "Nutex Health discloses cyberattack",
"detail": "Nutex confirmed unauthorized access to sensitive patient and employee data, with threats…",
"source": "Article 4"
}
],
"article_count": 4,
"threat_score": 71.0,
"severity_score": 80.0,
"urgency_level": "medium",
"keywords": [
"researcher",
"shows"
],
"sources": [
"Theregister"
],
"date_range_latest": "2026-08-31T18:26:03+00:00",
"articles": [
{
"title": "Anthropic cracks down on hijacked user accounts mining AI tokens",
"source": "Theregister",
"pub_date": "2026-08-31T16:03:46+00:00",
"url": "https://www.theregister.com/security/2026/08/31/anthropic-cracks-down-on-hijacked-user-accounts-min…"
}
],
"entities": {
"attack_type": [
"Data Breach",
"Malware"
],
"campaign": [
"ClickFix",
"TerminalFix"
]
},
"slug": "new-malware-campaign-exploits-pngs-and-infostealers-for-acco-732cdfd2",
"ioc_count": 0
},
{
"cluster_id": "468a50ef-290c-4ca4-bf97-0a645e837ef6",
"title": "9.5 Million Impacted by Aesto Health Data Breach",
"ai_title": "Aesto Health Data Breach Exposes 9.5 Million Patients' Information",
"ai_summary": "A data breach at Aesto Health, a healthcare technology company in Birmingham, Alabama, was discovered on December 18, 2025. The breach affected at le…",
"timeline": [
{
"date": "2025-12-02",
"event": "Unauthorized access began",
"detail": "Hackers accessed Aesto Health's AWS infrastructure, compromising sensitive data.",
"source": "Hipaajournal"
}
],
"article_count": 4,
"threat_score": 69.0,
"severity_score": 80.0,
"urgency_level": "medium",
"keywords": [
"aesto",
"health"
],
"sources": [
"www.aestohealth.com",
"Feeds.Feedburner"
],
"date_range_latest": "2026-09-01T09:16:19.170172+00:00",
"articles": [
{
"title": "Aesto Health Data Breach Affects 9.5 Million Patients",
"source": "Hipaajournal",
"pub_date": "2026-09-01T06:07:50+00:00",
"url": "https://www.hipaajournal.com/aesto-health-data-breach/"
}
],
"entities": {
"attack_type": [
"Data Breach"
],
"company": [
"Aesto Health",
…
GET /threats?keyword=Australia{
"threats": [
{
"cluster_id": "16404270-63df-4325-8911-ffbf6ff3f4df",
"title": "Two Alleged ‘TeamPCP’ Hackers Arrested in Australia",
"ai_title": "TeamPCP Hackers Arrested for Major Supply Chain Attacks",
"ai_summary": "On August 26, 2026, Australian Federal Police arrested two men, Ruben Thomson and Louis Gaebler, linked to the TeamPCP hacking group. This group is n…",
"timeline": [
{
"date": "2026-04-01",
"event": "Investigation into TeamPCP begins",
"detail": "The AFP and FBI started investigating TeamPCP after receiving information from cybersecur…",
"source": "BleepingComputer"
}
],
"article_count": 26,
"threat_score": 70.25,
"severity_score": 80.0,
"urgency_level": "medium",
"keywords": [
"arrested",
"cybercrime"
],
"sources": [
"Feeds.Feedburner",
"Abc.Au"
],
"date_range_latest": "2026-08-27T11:04:15+00:00",
"articles": [
{
"title": "Two Perth hackers charged after major AFP, FBI investigation into alleged global cybercrime",
"source": "Abc.Au",
"pub_date": "2026-08-27T05:45:10+00:00",
"url": "https://www.abc.net.au/news/2026-08-27/two-wa-men-charged-after-investigation-into-alleged-cybercri…"
}
],
"entities": {
"apt_group": [
"TeamPCP"
],
"attack_type": [
"Botnet",
"Data Breach"
]
},
"slug": "teampcp-hackers-arrested-in-australia-amid-global-cybercrime-6ff3f4df",
"ioc_count": 0
},
{
"cluster_id": "1e07dd9a-62c5-4a2a-8455-e6a64b7705b1",
"title": "Zbt Darklantern Speakingstone",
"ai_title": "Backdoors Found in ZBT Routers Sold Globally",
"ai_summary": "ZBT routers, widely sold under various brands, have been found to contain multiple backdoors, including 'SpeakingStone' and 'DarkLantern'. These impl…",
"timeline": [
{
"date": "2026-08-06",
"event": "Backdoor discovery announced",
"detail": "Jacob Baines revealed ZBT's router firmware contains a root-level backdoor named 'Endless…",
"source": "Darkreading"
}
],
"article_count": 5,
"threat_score": 64.25,
"severity_score": 70.0,
"urgency_level": "medium",
"keywords": [
"routers",
"chinese"
],
"sources": [
"www.vulncheck.com",
"Darkreading"
],
"date_range_latest": "2026-08-27T20:02:41.584871+00:00",
"articles": [
{
"title": "Chinese Routers Sold Worldwide Contain Backdoors",
"source": "Darkreading",
"pub_date": "2026-08-27T19:31:45+00:00",
"url": "https://www.darkreading.com/vulnerabilities-threats/chinese-routers-sold-worldwide-backdoors"
}
],
"entities": {
"attack_type": [
"Malware",
"Man-in-the-Middle"
],
"company": [
…
GET /threats?keyword=CVE-2026-46037{
"threats": [
{
"cluster_id": "da662236-d210-4fa9-8968-7b30cebb7ea4",
"title": "SUSE Kernel RT Security Update 2026-23264",
"ai_title": "Multiple SUSE Kernel RT Security Updates Address Critical Vulnerabilities",
"ai_summary": "SUSE has released a series of important security updates for its Linux Enterprise Kernel, addressing multiple vulnerabilities across various versions…",
"timeline": [
{
"date": "2026-02-14",
"event": "CVE-2026-23161 published",
"detail": "A race condition in mm/shmem and swap was disclosed, affecting memory management.",
"source": "Linuxsecurity"
}
],
"article_count": 40,
"threat_score": 67.25,
"severity_score": 70.0,
"urgency_level": "medium",
"keywords": [
"security",
"linux"
],
"sources": [
"Linuxsecurity"
],
"date_range_latest": "2026-08-26T16:51:07+00:00",
"articles": [
{
"title": "SUSE Linux Enterprise Kernel RT Important Security Update 2026-23267",
"source": "Linuxsecurity",
"pub_date": "2026-08-26T16:41:14+00:00",
"url": "https://linuxsecurity.com/advisories/suse/suse-2026-23267-1-kernel-rt"
}
],
"entities": {
"company": [
"SUSE"
],
"cve": [
"CVE-2023-53995",
"CVE-2025-40204"
],
"cwe": [
"CWE-122 - Heap-based Buffer Overflow",
"CWE-125 - Out-of-bounds Read"
],
"platform": [
"Linux",
"SUSE Linux Enterprise 15 SP7 RT Kernel"
]
},
"slug": "multiple-suse-kernel-rt-security-updates-address-critical-vu-cebb7ea4",
"ioc_count": 0
}
],
"count": 1,
"limit": 50,
"offset": 0,
"time_filter": "7d",
"sort_by": "trending"
}
GET /threats/93fb80f8{
"cluster_id": "32e38748-219f-4340-853f-7c4593fb80f8",
"title": "Chinese Speaking Operator Philippine Nuclear Naval Contractor",
"ai_title": "Chinese Operator Breaches Philippine Nuclear and Naval Entities",
"ai_summary": "A suspected Chinese-speaking operator has compromised a Philippine nuclear research body and a marine engineering company supporting the Philippine N…",
"timeline": [
{
"date": "2023-11-21",
"event": "CVE-2023-49105 published",
"detail": "Authentication-bypass flaw in ownCloud allows unauthorized file access via WebDAV.",
"source": "Article 2"
}
],
"article_count": 4,
"threat_score": 80.7,
"severity_score": 81.0,
"urgency_level": "medium",
"keywords": [
"philippine",
"nuclear",
"operator"
],
"sources": [
"hunt.io",
"Securityaffairs.Co"
],
"date_range_latest": "2026-08-31T12:34:31.263942+00:00",
"articles": [
{
"title": "Philippine Nuclear and Naval Targets Hit by Suspected Chinese Operator",
"source": "Securityaffairs.Co",
"pub_date": "2026-08-29T09:16:52+00:00",
"url": "https://securityaffairs.com/198041/intelligence/philippine-nuclear-and-naval-targets-hit-by-suspect…"
},
{
"title": "Chinese operator exploits a 3-year",
"source": "Pasqualepillitteri.It",
"pub_date": "2026-08-30T20:09:53+00:00",
"url": "https://pasqualepillitteri.it/en/news/13473/chinese-operator-philippine-nuclear-data-owncloud"
}
],
"entities": {
"attack_type": [
"Data Breach"
],
"campaign": [
"Operation CameraSwarm"
],
"company": [
"CGI Global Limited",
"Naval Contractor",
"Philippine Nuclear Agency"
],
"country": [
"Philippines",
"Russia",
"Ukraine"
]
},
"slug": "chinese-speaking-actor-breaches-philippine-nuclear-and-naval-93fb80f8"
}
GET /threats/93fb80f8/iocs{
"iocs": [
{
"type": "ipv4",
"value": "31.58.209.241",
"confidence": "high",
"reason": "IP address hosting stolen data and offensive tools"
},
{
"type": "domain",
"value": "fine-work-team.com",
"confidence": "high",
"reason": "Listed as a delivery URL for a malicious script"
}
],
"count": 4,
"cluster_id": "93fb80f8"
}
GET /threats/93fb80f8/stix{
"type": "bundle",
"id": "bundle--40db38a3-6c4f-4ffd-9a79-ceb3a8d00241",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d",
"created": "2026-09-01T17:46:29.497276Z",
"modified": "2026-09-01T17:46:29.497276Z",
"name": "ThreatCluster",
"description": "Automated threat intelligence aggregation and clustering platform",
"identity_class": "organization",
"sectors": [
"technology"
],
"contact_information": "https://threatcluster.io"
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--92a159b2-33b1-57f7-b60c-9f340bf16776",
"created_by_ref": "identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d",
"created": "2026-09-01T17:46:29.497716Z",
"modified": "2026-09-01T17:46:29.497716Z",
"name": "Mettle",
"malware_types": [
"unknown"
],
"is_family": true,
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
}
]
}
GET /vulnerabilities?kev_only=true&days=7{
"cves": [
{
"cve_id": "CVE-2026-82078",
"description": "An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperC…",
"cvss_v3_score": 9.1,
"cvss_v3_severity": "CRITICAL",
"affected_vendors": [
"papercut"
],
"affected_products": [
"papercut_mf",
"papercut_ng"
],
"cpe_configurations": [
{
"vendor": "papercut",
"product": "papercut_mf",
"criteria": "cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*",
"vulnerable": true,
"version_end": "24.1.9",
"version_end_op": "excluding"
}
],
"in_kev": true,
"has_exploit": false,
"epss_score": 0.0046,
"epss_percentile": 0.3826,
"published_date": "2026-08-28T16:18:31.240000",
"last_modified": "2026-09-01T04:18:02.160000"
},
{
"cve_id": "CVE-2026-81578",
"description": "An improper access control vulnerability exists in the web management interface of PaperCut MF and…",
"cvss_v3_score": 9.8,
"cvss_v3_severity": "CRITICAL",
"affected_vendors": [
"papercut"
],
"affected_products": [
"papercut_mf",
"papercut_ng"
],
"cpe_configurations": [
{
"vendor": "papercut",
"product": "papercut_mf",
"criteria": "cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*",
"vulnerable": true,
"version_end": "24.1.9",
"version_end_op": "excluding"
}
],
"in_kev": true,
"has_exploit": true,
"epss_score": 0.0039,
"epss_percentile": 0.324,
"published_date": "2026-08-28T16:18:29.600000",
"last_modified": "2026-09-01T04:18:01.990000"
}
],
"total": 3,
"page": 1,
"limit": 50,
"pages": 1,
"days": 7
}
GET /vulnerabilities?has_exploit=true{
"cves": [
{
"cve_id": "CVE-2026-82539",
"description": "A vulnerability was determined in TOTOLINK A720R 4.1.5cu.630_B20250509. This impacts the function s…",
"cvss_v3_score": 9.1,
"cvss_v3_severity": "CRITICAL",
"in_kev": false,
"has_exploit": true,
"epss_score": 0.006,
"epss_percentile": 0.4628,
"published_date": "2026-08-30T11:17:35.067000",
"last_modified": "2026-08-31T20:56:08.800000"
},
{
"cve_id": "CVE-2026-55511",
"description": "Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPr…",
"cvss_v3_score": 9.1,
"cvss_v3_severity": "CRITICAL",
"in_kev": false,
"has_exploit": true,
"epss_score": 0.0068,
"epss_percentile": 0.4996,
"published_date": "2026-08-28T20:18:27.947000",
"last_modified": "2026-09-01T02:16:58.397000"
}
],
"total": 51,
"page": 1,
"limit": 50,
"pages": 2,
"days": 30
}
GET /vulnerabilities/CVE-2026-46037{
"cve_id": "CVE-2026-46037",
"description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: icmp: validate reply typ…",
"cvss_v3_score": 8.2,
"cvss_v3_severity": "HIGH",
"affected_vendors": [
"linux"
],
"affected_products": [
"linux_kernel"
],
"cpe_configurations": [
{
"vendor": "linux",
"product": "linux_kernel",
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"version_end": "5.15.209",
"version_start": "5.13",
"version_end_op": "excluding",
"version_start_op": "including"
},
{
"vendor": "linux",
"product": "linux_kernel",
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"version_end": "6.1.175",
"version_start": "5.16",
"version_end_op": "excluding",
"version_start_op": "including"
}
],
"in_kev": false,
"has_exploit": false,
"epss_score": 0.0043,
"epss_percentile": 0.3614,
"published_date": "2026-05-27T14:17:23.027000",
"last_modified": "2026-06-17T10:52:56.583000",
"id": 15467161,
"cvss_v3_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"reference_urls": [
{
"url": "https://git.kernel.org/stable/c/67bf002a2d7387a6312138210d0bd06e3cf4879b",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/92e7c209036dcc0e8ffdf806fdfd3645b263bea5",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"exploit_count": 0,
"fetched_at": "2026-06-26T23:30:16.327186",
"epss_updated_at": "2026-09-01T05:00:08.133433"
}
GET /entities/domain/businesswire.com{
"entity": {
"entity_type": "domain",
"entity_value": "businesswire.com",
"frequency": 172,
"first_seen": "2026-03-30T14:34:29+00:00",
"last_seen": "2026-08-30T18:03:55+00:00",
"confidence": "false_positive",
"reason": "MISP warninglist: Top 1 000 000 websites from Cisco Umbrella"
},
"clusters": [
{
"cluster_id": "70c6fdc1-40ff-45f4-81a5-f71898a55c29",
"title": "Sygnia Reveals New Activity by China",
"ai_title": "Fire Ant Threat Actor Targets Trusted Infrastructure in 2026",
"ai_summary": "The China-nexus threat actor known as Fire Ant has evolved its tactics in 2026, transitioning from targeting VMware hypervisors to compromising trust…",
"article_count": 13,
"threat_score": 77.75,
"severity_score": 80.0,
"date_range_latest": "2026-08-30T18:03:55+00:00",
"slug": "china-nexus-threat-actor-fire-ant-targets-critical-infrastru-98a55c29"
},
{
"cluster_id": "8d40b34e-bcb7-4aff-b194-bae9df8632a5",
"title": "CrowdStrike 2026 Financial Services Threat Landscape Report",
"ai_title": "North Korean Cyber Adversaries Steal Billions from Financial Sector",
"ai_summary": "In 2025, North Korean-linked adversaries stole billions in digital assets, significantly impacting the financial services sector. The CrowdStrike 202…",
"article_count": 3,
"threat_score": 75.5,
"severity_score": 80.0,
"date_range_latest": "2026-05-14T17:06:57+00:00",
"slug": "north-korean-cyber-adversaries-steal-billions-from-financial-df8632a5"
}
],
"articles": [
{
"title": "Sygnia Reveals New Activity by China",
"source": "Morningstar",
"pub_date": "2026-08-30T18:03:55+00:00",
"url": "https://www.morningstar.com/news/business-wire/20260830433829/sygnia-reveals-new-activity-by-china-…"
},
{
"title": "Visa Expands Support for its Clients and the Industry as Organizations Navigate New AI Era ...",
"source": "Afp",
"pub_date": "2026-08-27T18:45:37+00:00",
"url": "https://www.afp.com/en/infos/visa-expands-support-its-clients-and-industry-organizations-navigate-n…"
}
],
"co_entities_with_counts": {
"attack_type": [
{
"value": "Phishing",
"count": 23
}
],
"mitre_attack": [
{
"value": "T1566 - Phishing",
"count": 19
}
],
"industry": [
{
"value": "Financial",
"count": 18
}
],
"country": [
{
"value": "United States",
"count": 10
}
]
},
"aliases": []
}
GET /entities/sha256/a9a71d111f2233634b91e0e08fe6b6f74a09f69e73ca09df1e9189594d1b1295{
"entity": {
"entity_type": "sha256",
"entity_value": "a9a71d111f2233634b91e0e08fe6b6f74a09f69e73ca09df1e9189594d1b1295",
"frequency": 2,
"first_seen": "2026-08-28T05:32:53.679219+00:00",
"last_seen": "2026-09-01T12:20:50.225501+00:00",
"confidence": "high",
"reason": "Listed among other hashes in a context suggesting they are malware samples"
},
"clusters": [
{
"cluster_id": "60b31b89-a1b3-4fb9-8b8c-46b1c18ccc2a",
"title": "PaperCut warns of NG, MF flaw exploited in zero",
"ai_title": "PaperCut NG/MF Vulnerability Under Active Exploitation",
"ai_summary": "On August 27, 2026, PaperCut issued an urgent advisory regarding a zero-day vulnerability affecting its NG and MF print management software. This fla…",
"article_count": 53,
"threat_score": 72.9,
"severity_score": 81.0,
"date_range_latest": "2026-08-27T16:48:35.471839+00:00",
"slug": "critical-zero-day-exploitation-of-papercut-ngmf-vulnerabilit-c18ccc2a"
}
],
"articles": [
{
"title": "Security Bulletin 27 Aug 2026 Urgent Security Advisory",
"source": "www.papercut.com",
"pub_date": "2026-09-01T12:20:50.225501+00:00",
"url": "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory"
},
{
"title": "Security Bulletin 27 Aug 2026 Urgent Security Advisory",
"source": "www.papercut.com",
"pub_date": "2026-08-28T05:32:53.679219+00:00",
"url": "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory?lid=0na0tu4…"
}
],
"co_entities_with_counts": {
"mitre_attack": [
{
"value": "T1190 - Exploit Public-Facing Application",
"count": 1
}
],
"tool": [
{
"value": "Pc-app.exe",
"count": 1
}
]
},
"aliases": []
}
GET /iocs/feed?format=txtacrobatreaderonline.com bookcheckarrival-gueststayhotel.com browser-app.com browsify.co case-apple.com ccleanerwind.top chat-apple.com cleankits.co coldcardteamnews.com crpx0.su cryptoprice.pw databreach.space
GET /iocs/feed?types=domainacrobatreaderonline.com bookcheckarrival-gueststayhotel.com browser-app.com browsify.co case-apple.com ccleanerwind.top chat-apple.com cleankits.co coldcardteamnews.com crpx0.su cryptoprice.pw databreach.space
GET /iocs/feed?format=json{
"iocs": [
{
"type": "domain",
"value": "acrobatreaderonline.com",
"confidence": "high",
"reason": "[article sweep] Used as a malicious site impersonating Adobe Acrobat Reader."
},
{
"type": "domain",
"value": "bookcheckarrival-gueststayhotel.com",
"confidence": "high",
"reason": "Indicates attacker-controlled phishing domain targeting hotel reservations."
}
],
"count": 629,
"confidence_filter": "confirmed",
"hours": 720
}
GET /iocs/feed?enrich=true&format=json{
"iocs": [
{
"type": "domain",
"value": "acrobatreaderonline.com",
"confidence": "high",
"reason": "[article sweep] Used as a malicious site impersonating Adobe Acrobat Reader.",
"clusters": [],
"sources": [
{
"source": "Cybersecuritynews",
"title": "New Malware-as-a-service Leveraging Adobe",
"url": "https://cybersecuritynews.com/malware-as-a-service-adobe-themed-domain/",
"pub_date": "2026-08-24 04:47:41+00:00"
}
]
},
{
"type": "domain",
"value": "bookcheckarrival-gueststayhotel.com",
"confidence": "high",
"reason": "Indicates attacker-controlled phishing domain targeting hotel reservations.",
"clusters": [
{
"cluster_id": "ca52b3c3-ad7b-4a47-981a-c7695de22ad8",
"title": "Phishing Attacks Target Hotels via Compromised Booking Data",
"url": "https://threatcluster.io/cluster/phishing-waves-cyberattacks-on-it-service-providers-for-hote-5de22…",
"threat_score": 61.5
}
],
"sources": [
{
"source": "Heise.De",
"title": "Phishing waves: Cyberattacks on IT service providers for hotels",
"url": "https://www.heise.de/en/news/Phishing-waves-Cyberattacks-on-IT-service-providers-for-hotels-1141219…",
"pub_date": "2026-08-13 06:24:31+00:00"
}
]
}
],
"count": 629,
"confidence_filter": "confirmed",
"hours": 720,
"enriched": true
}
GET /iocs/feed?format=csvtype,value,confidence,reason domain,acrobatreaderonline.com,high,[article sweep] Used as a malicious site impersonating Adobe Acrobat Reader. domain,bookcheckarrival-gueststayhotel.com,high,Indicates attacker-controlled phishing domain targeting hotel reservations. domain,browser-app.com,high,[article sweep] Domain used in a malicious browser extension campaign domain,browsify.co,high,[article sweep] Domain used in a malicious browser extension campaign domain,case-apple.com,high,[article sweep] Used in phishing scams impersonating Apple domain,ccleanerwind.top,high,Identified as attacker-controlled domain for malware distribution domain,chat-apple.com,high,[article sweep] Used in phishing scams impersonating Apple domain,cleankits.co,high,[article sweep] Associated with malicious Firefox extensions domain,coldcardteamnews.com,high,[article sweep] Used in a phishing campaign impersonating COLDCARD domain,crpx0.su,high,[article sweep] Identified as hosting a panel for a ransomware group domain,cryptoprice.pw,high,Listed as a service advertised by the actor for scams and malware delivery
GET /iocs/exportacrobatreaderonline.com bookcheckarrival-gueststayhotel.com browser-app.com browsify.co case-apple.com ccleanerwind.top chat-apple.com cleankits.co coldcardteamnews.com crpx0.su cryptoprice.pw databreach.space
GET /iocs/export?confidence=confirmed&format=json{
"iocs": [
{
"type": "domain",
"value": "acrobatreaderonline.com",
"confidence": "high",
"reason": "[article sweep] Used as a malicious site impersonating Adobe Acrobat Reader."
},
{
"type": "domain",
"value": "bookcheckarrival-gueststayhotel.com",
"confidence": "high",
"reason": "Indicates attacker-controlled phishing domain targeting hotel reservations."
}
],
"count": 675,
"confidence_filter": "confirmed",
"hours": 720,
"pending_count": 15
}
GET /threats/93fb80f8/iocs{
"iocs": [
{
"type": "ipv4",
"value": "31.58.209.241",
"confidence": "high",
"reason": "IP address hosting stolen data and offensive tools"
},
{
"type": "domain",
"value": "fine-work-team.com",
"confidence": "high",
"reason": "Listed as a delivery URL for a malicious script"
}
],
"count": 4,
"cluster_id": "93fb80f8"
}
GET /darkweb/ransomware/victims?days=7{
"victims": [
{
"id": "a4834f3163071aad",
"group": "rhysida",
"name": "Szechenyi Programiroda Nonprofit Kf",
"discovered": "2026-09-01 17:27:14.520298+00:00",
"country": "HU",
"sector": "Other",
"description": "Szechenyi Programiroda Nonprofit Kf",
"first_party": false,
"delisted": false,
"fp_has_note": false,
"fp_cats": 0
},
{
"id": "cb54d554aa40187f",
"group": "direwolf",
"name": "Oportunidados",
"discovered": "2026-09-01 16:25:03.194416+00:00",
"country": "BR",
"sector": "Not Found",
"description": "Business Services",
"website": "oportunidados.com.br",
"screenshot_url": "https://images.ransomware.live/victims/9d4bac68747992372f0db1e71b4bfd07.png",
"first_party": false,
"delisted": false,
"fp_has_note": false,
"fp_cats": 0
}
],
"count": 100
}
GET /darkweb/ransomware/victims?sector=Manufacturing{
"victims": [
{
"id": "bdd665d27f502e10",
"group": "direwolf",
"name": "PT Intraco Penta Tbk",
"discovered": "2026-09-01 15:53:54.238628+00:00",
"country": "ID",
"sector": "Manufacturing",
"description": "Industrial Machinery & Equipment",
"website": "intracopenta.com",
"screenshot_url": "https://images.ransomware.live/victims/174fc69efa77c10734c28c363a781bc4.png",
"first_party": false,
"delisted": false,
"fp_has_note": false,
"fp_cats": 0
},
{
"id": "7c85020e4123931c",
"group": "akira",
"name": "Congressional Iron Works",
"discovered": "2026-09-01 15:21:40.812015+00:00",
"sector": "Manufacturing",
"description": "Congressional Iron Works is a full-service miscellaneous metals contractor serving the commerci\nal…",
"first_party": false,
"delisted": false,
"fp_has_note": false,
"fp_cats": 0
}
],
"count": 100
}
GET /darkweb/ransomware/victims?country=ID{
"victims": [
{
"id": "bdd665d27f502e10",
"group": "direwolf",
"name": "PT Intraco Penta Tbk",
"discovered": "2026-09-01 15:53:54.238628+00:00",
"country": "ID",
"sector": "Manufacturing",
"description": "Industrial Machinery & Equipment",
"website": "intracopenta.com",
"screenshot_url": "https://images.ransomware.live/victims/174fc69efa77c10734c28c363a781bc4.png",
"first_party": false,
"delisted": false,
"fp_has_note": false,
"fp_cats": 0
},
{
"id": "0e90632976a3f63c",
"group": "shadowbyt3$",
"name": "Sinar Mas Agribusiness and Food Golden Agri-Resources)",
"discovered": "2026-08-25 14:26:02.536617+00:00",
"country": "ID",
"sector": "Agriculture and Food Production",
"description": "We Breached This company a few months ago. we stole 375.66MB.\nmirror 1: https://anonfilesnew.com/s/…",
"website": "www.smart-tbk.com",
"screenshot_url": "https://images.ransomware.live/victims/87a3d45930ebf5b2b152bb7bb58f291d.png",
"first_party": false,
"delisted": false,
"fp_has_note": false,
"fp_cats": 0
}
],
"count": 9
}
GET /darkweb/ransomware/victims?group=direwolf{
"victims": [
{
"id": "cb54d554aa40187f",
"group": "direwolf",
"name": "Oportunidados",
"discovered": "2026-09-01 16:25:03.194416+00:00",
"country": "BR",
"sector": "Not Found",
"description": "Business Services",
"website": "oportunidados.com.br",
"screenshot_url": "https://images.ransomware.live/victims/9d4bac68747992372f0db1e71b4bfd07.png",
"first_party": false,
"delisted": false,
"fp_has_note": false,
"fp_cats": 0
},
{
"id": "591a6d4c1db2a096",
"group": "direwolf",
"name": "Honeycomb Programs Inc",
"discovered": "2026-09-01 15:54:31.468817+00:00",
"country": "US",
"sector": "Other",
"description": "Insurance",
"website": "honeycombinsurance.com",
"screenshot_url": "https://images.ransomware.live/victims/7b226d1f66632ea92e72a12b32712cfc.png",
"first_party": false,
"delisted": false,
"fp_has_note": false,
"fp_cats": 0
}
],
"count": 46
}
GET /darkweb/ransomware/victim/bdd665d27f502e10{
"id": "bdd665d27f502e10",
"victim_name": "PT Intraco Penta Tbk",
"group_name": "direwolf",
"discovered": "2026-09-01 15:53:54.238628+00:00",
"country": "ID",
"sector": "Manufacturing",
"description": "Industrial Machinery & Equipment",
"website": "intracopenta.com",
"post_url": "http://direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.onion/api/public/articles/117",
"entities": {},
"first_party": false,
"related_group_victims": [
{
"id": "cb54d554aa40187f",
"victim_name": "Oportunidados",
"discovered": "2026-09-01 16:25:03.194416+00:00",
"country": "BR",
"sector": "Not Found"
},
{
"id": "591a6d4c1db2a096",
"victim_name": "Honeycomb Programs Inc",
"discovered": "2026-09-01 15:54:31.468817+00:00",
"country": "US",
"sector": "Other"
}
]
}
GET /darkweb/ransomware/group/direwolf{
"name": "direwolf",
"description": "Dire Wolf is a sophisticated human-operated ransomware group first documented in May 2025, written…",
"active": false,
"has_captcha": false,
"first_seen": "2025-04-17 00:00:00+00:00",
"last_seen": "2026-08-30 14:35:36.508000+00:00",
"tools": [],
"urls": [
"http://direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.onion"
],
"profile_links": [],
"recent_victims": [
{
"id": "cb54d554aa40187f",
"name": "Oportunidados",
"discovered": "2026-09-01 16:25:03.194416+00:00",
"country": "BR",
"sector": "Not Found",
"first_party": false,
"delisted": false
},
{
"id": "591a6d4c1db2a096",
"name": "Honeycomb Programs Inc",
"discovered": "2026-09-01 15:54:31.468817+00:00",
"country": "US",
"sector": "Other",
"first_party": false,
"delisted": false
}
],
"screenshot_url": "https://threatcluster.lon1.digitaloceanspaces.com/darkweb-groups/direwolf/20260901T033014Z.png",
"page_title": "DireWolf",
"ai_description": "DireWolf's homepage displays a list of victim companies with associated data sizes, publication dat…",
"ai_risk_tags": [
"countdown_timer",
"data_published_badges",
"victim_list"
],
"ai_language": "en",
"captcha_or_login_gate": false,
"scraped_at": "2026-09-01T03:30:18.180614+00:00",
"entities": {
"company": [
"Allstar Industries",
"Authenticate Information Systems",
"Deer Creek-Mackinaw CUSD"
],
"country": [
"Australia",
"Austria",
"Brazil"
],
"industry": [
"Business Services",
"Education",
"Engineering Software"
]
},
"mirrors": [
{
"url": "http://direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.onion",
"alive": null,
"last_alive_at": null,
"last_checked_at": null,
"consecutive_failures": 0,
"text_bytes": null
}
],
"screenshot_is_victim_page": false,
"first_party_only": [],
"first_party_count": 30,
"total_victims": 109
}
GET /darkweb/ransomware/groups?active_only=true{
"groups": [
{
"name": "qilin",
"active": true,
"victim_count": 2070,
"recent_victim_count_30d": 158,
"last_seen": "2026-09-01 03:56:51.567977+00:00",
"description": "Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supp…",
"has_captcha": false,
"profile_links": [],
"tools": [
"Mimikatz",
"EDRSandBlast"
]
},
{
"name": "akira",
"active": true,
"victim_count": 1377,
"recent_victim_count_30d": 34,
"last_seen": "2026-08-31 00:00:00+00:00",
"description": "The Akira ransomware group is said to have emerged in March 2023, and there's much speculation abou…",
"has_captcha": false,
"profile_links": [],
"tools": [
"DonPAPI",
"LaZagne"
]
}
],
"count": 85
}
GET /darkweb/breaches{
"breaches": [
{
"id": 852,
"name": "SynthientCredentialStuffingThreatData",
"domain": "",
"breach_date": "2025-04-11",
"added_date": "2025-11-06 04:58:49+00:00",
"pwn_count": 1957476021,
"description": "During 2025, <a href=\"https://www.troyhunt.com/2-billion-email-addresses-were-exposed-and-we-indexe…",
"logo_url": "https://logos.haveibeenpwned.com/List.png",
"data_classes": [
"Email addresses",
"Passwords"
],
"is_verified": true,
"is_sensitive": false
},
{
"id": 198,
"name": "Collection1",
"domain": "",
"breach_date": "2019-01-07",
"added_date": "2019-01-16 21:46:07+00:00",
"pwn_count": 772904991,
"description": "In January 2019, a large collection of credential stuffing lists (combinations of email addresses a…",
"logo_url": "https://logos.haveibeenpwned.com/List.png",
"data_classes": [
"Email addresses",
"Passwords"
],
"is_verified": false,
"is_sensitive": false
}
],
"count": 50
}
GET /darkweb/ransomware/victims/facets?days=30{
"countries": [
{
"value": "US",
"count": 412
},
{
"value": "DE",
"count": 70
}
],
"sectors": [
{
"value": "Manufacturing",
"count": 185
},
{
"value": "Technology",
"count": 164
}
],
"groups": [
{
"value": "qilin",
"count": 158
},
{
"value": "thegentlemen",
"count": 115
}
]
}
GET /darkweb/trends?weeks=8{
"victims_weekly": [
{
"week": "2026-07-06",
"count": 185
},
{
"week": "2026-07-13",
"count": 176
}
],
"top_industries": [
{
"industry": "Manufacturing",
"count": 400
},
{
"industry": "Technology",
"count": 331
}
],
"group_heatmap": {
"groups": [
"qilin",
"thegentlemen",
"incransom"
],
"weeks": [
"2026-06-08",
"2026-06-15",
"2026-06-22"
],
"cells": {
"qilin": [
19,
21
],
"thegentlemen": [
5,
34
]
}
}
}
GET /darkweb/stats{
"ransomware_groups": 164,
"total_victims": 20523,
"victims_last_7d": 281,
"victims_last_30d": 1219,
"breaches_known": 1032,
"last_updated": "2026-09-01T16:45:02.520706+00:00",
"data_source": "database"
}
GET /entities/apt_group/Volt%20Typhoon{
"entity": {
"entity_type": "apt_group",
"entity_value": "Volt Typhoon",
"frequency": 102,
"first_seen": "2025-10-29T12:59:40+00:00",
"last_seen": "2026-08-27T14:45:56+00:00"
},
"overview": "Volt Typhoon is a cyber espionage Advanced Persistent Threat (APT) group believed to operate primarily from China, targeting critical infrastructure…",
"clusters": [
{
"cluster_id": "b1286d86-7a9c-43c4-9697-1cbcb94c0224",
"title": "Threat actor leveraged Cisco SD-WAN zero-day since 2023 (CVE-2026-20127)",
"ai_title": "Cisco SD-WAN Zero-Day Exploited by Threat Actor Since 2023",
"ai_summary": "A cyber threat actor has been exploiting a zero-day vulnerability (CVE-2026-20127) in Cisco Catalyst SD-WAN Controller since 2023. This vulnerability…",
"article_count": 104,
"threat_score": 82.13,
"severity_score": 82.6,
"date_range_latest": "2026-02-25T16:58:31+00:00",
"slug": "cisco-sd-wan-zero-day-exploited-by-threat-actor-since-2023-b94c0224"
},
{
"cluster_id": "bb0dbba1-2e42-40a6-b988-67be916848f5",
"title": "Critical FortiWeb WAF Flaw Actively Exploited to Establish Admin Access and Seize Total Control",
"ai_title": "FortiWeb WAF Vulnerability Enables Full Admin Control Exploitation",
"ai_summary": "A critical vulnerability in FortiWeb Web Application Firewall (WAF) has been actively exploited, allowing attackers to gain full administrative acces…",
"article_count": 100,
"threat_score": 79.52,
"severity_score": 93.15,
"date_range_latest": "2025-11-15T10:02:37+00:00",
"slug": "fortiweb-waf-vulnerability-enables-full-admin-control-exploi-916848f5"
}
],
"articles": [
{
"title": "U.S. Says Chinese Hackers Targeted Senate, NASA, Hospitals, and More",
"source": "Time",
"pub_date": "2026-08-27T14:45:56+00:00",
"url": "https://time.com/article/2026/08/27/china-hack-federal-agencies-cybersecurity-qtfy-senate-nasa/"
},
{
"title": "China Hacked NASA, Federal Reserve: FBI Seizes Platforms Behind Eight",
"source": "Techtimes",
"pub_date": "2026-08-27T13:47:51+00:00",
"url": "https://www.techtimes.com/articles/325708/20260827/china-hacked-nasa-federal-reserve-fbi-seizes-pla…"
}
],
"co_entities_with_counts": {
"country": [
{
"value": "China",
"count": 43
}
],
"apt_group": [
{
"value": "Salt Typhoon",
"count": 31
}
],
"industry": [
{
"value": "Energy",
"count": 30
}
],
"attack_type": [
{
"value": "Malware",
"count": 27
}
]
},
"aliases": []
}
GET /entities/malware/Vidar{
"entity": {
"entity_type": "malware",
"entity_value": "Vidar",
"frequency": 91,
"first_seen": "2025-11-07T09:44:57+00:00",
"last_seen": "2026-08-31T21:08:46+00:00"
},
"overview": "Vidar is a modular information-stealer malware family primarily used to harvest sensitive data such as personal information, credentials, and cryptoc…",
"clusters": [
{
"cluster_id": "4be45cfb-af53-487f-b336-37e9a87caff8",
"title": "GhostShell Targets Ukraine's UAV and Defense Supply Chain",
"ai_title": "GhostShell Malware Targets Ukraine's UAV and Defense Supply Chain",
"ai_summary": "The GhostShell malware cluster is actively targeting Ukraine’s UAV operations and defense supply chain. Utilizing advanced techniques such as mTLS-au…",
"article_count": 2,
"threat_score": 79.35,
"severity_score": 80.0,
"date_range_latest": "2026-06-25T16:51:35+00:00",
"slug": "ghostshell-targets-ukraines-uav-and-defense-supply-chain-a87caff8"
},
{
"cluster_id": "408e93b6-cc90-45ae-a164-94496e04b360",
"title": "Are The Notorious Cyber Criminals Evil Corp Actually Russian Spies",
"ai_title": "Operation Endgame Disrupts Evil Corp's SocGholish Malware Network",
"ai_summary": "On June 18, 2026, international law enforcement agencies launched Operation Endgame, disrupting the SocGholish malware infrastructure linked to the R…",
"article_count": 67,
"threat_score": 78.0,
"severity_score": 80.0,
"date_range_latest": "2026-06-18T12:33:31.474167+00:00",
"slug": "are-the-notorious-cyber-criminals-evil-corp-actually-russian-6e04b360"
}
],
"articles": [
{
"title": "Anthropic Users Hit by Infostealer Attacks, Session Thefts",
"source": "Darkreading",
"pub_date": "2026-08-31T21:08:46+00:00",
"url": "https://www.darkreading.com/cyberattacks-data-breaches/anthropic-users-infostealer-attacks-session-…"
},
{
"title": "Hackers Target Claude Accounts With Malware That Steals Login Sessions",
"source": "Pymnts",
"pub_date": "2026-08-31T20:53:26+00:00",
"url": "https://www.pymnts.com/news/artificial-intelligence/2026/hackers-target-claude-accounts-with-malwar…"
}
],
"co_entities_with_counts": {
"attack_type": [
{
"value": "Malware",
"count": 86
}
],
"platform": [
{
"value": "Windows",
"count": 56
}
],
"malware": [
{
"value": "StealC",
"count": 35
}
],
"mitre_attack": [
{
"value": "T1003 - OS Credential Dumping",
"count": 23
}
]
},
"aliases": []
}
GET /entities/company/NASA{
"entity": {
"entity_type": "company",
"entity_value": "NASA",
"frequency": 38,
"first_seen": "2025-11-30T07:53:56+00:00",
"last_seen": "2026-08-29T20:12:25+00:00"
},
"overview": "NASA, the National Aeronautics and Space Administration, is a U.S. federal government agency responsible for civilian space exploration, space scienc…",
"clusters": [
{
"cluster_id": "0e424056-44c8-4efe-8212-385dcfbb3fff",
"title": "Critical NASA AIT",
"ai_title": "Critical Vulnerability in NASA Ground Control Software Allows Unauthenticated Access",
"ai_summary": "A critical vulnerability in NASA's AMMOS Instrument Toolkit (AIT-GUI) software, tracked as GHSA-p9r8-2q67-fp86, allows unauthenticated attackers to i…",
"article_count": 7,
"threat_score": 78.0,
"severity_score": 90.0,
"date_range_latest": "2026-08-20T15:24:09+00:00",
"slug": "nasa-ait-gui-vulnerability-allows-unauthenticated-command-ex-cfbb3fff"
},
{
"cluster_id": "7b801b8d-477b-4769-b969-b142c59695c3",
"title": "How Chinese-Nexus Cyber Operations Have Evolved",
"ai_title": "Evolution of Chinese-Nexus Cyber Operations: Strategic Long-Term Threats",
"ai_summary": "Recent research from Darktrace reveals the evolution of Chinese-nexus cyber operations over the past two decades, highlighting a shift from high-volu…",
"article_count": 381,
"threat_score": 72.5,
"severity_score": 80.0,
"date_range_latest": "2026-04-02T10:37:49+00:00",
"slug": "evolution-of-chinese-nexus-cyber-operations-strategic-long-t-c59695c3"
}
],
"articles": [
{
"title": "US Officials Revise China Hacking Claims, Say Agencies Were Targeted",
"source": "Freepressjournal.In",
"pub_date": "2026-08-29T20:12:25+00:00",
"url": "https://www.freepressjournal.in/world/us-officials-revise-china-hacking-claims-say-agencies-were-ta…"
},
{
"title": "US officials backpedal on claims that government agencies were hacked by Chinese",
"source": "Databreaches",
"pub_date": "2026-08-29T15:02:26+00:00",
"url": "https://databreaches.net/2026/08/29/us-officials-backpedal-on-claims-that-government-agencies-were-…"
}
],
"co_entities_with_counts": {
"company": [
{
"value": "Federal Reserve",
"count": 24
}
],
"industry": [
{
"value": "Government",
"count": 23
}
],
"tool": [
{
"value": "QScan",
"count": 16
}
],
"country": [
{
"value": "China",
"count": 15
}
]
},
"aliases": []
}
GET /entities/platform/Windows{
"entity": {
"entity_type": "platform",
"entity_value": "Windows",
"frequency": 3026,
"first_seen": "2025-10-24T12:00:00+00:00",
"last_seen": "2026-09-01T16:41:10+00:00"
},
"overview": "Windows is a family of operating system platforms developed by Microsoft, designed to provide a graphical user interface and manage hardware and soft…",
"clusters": [
{
"cluster_id": "606197c6-712a-4d70-a437-49aa6a0b6977",
"title": "Chrome 143 Released With Fix for 13 Vulnerabilities that Enables Arbitrary Code Execution",
"ai_title": "Google Addresses Eighth Chrome Zero-Day Vulnerability in 2025",
"ai_summary": "Google has issued emergency updates to address the eighth zero-day vulnerability in Chrome for 2025. The flaw, identified as 466192044, was actively…",
"article_count": 45,
"threat_score": 96.9,
"severity_score": 100.0,
"date_range_latest": "2025-12-11T08:01:21+00:00",
"slug": "google-addresses-eighth-chrome-zero-day-vulnerability-in-202-6a0b6977"
},
{
"cluster_id": "1528e8d6-728a-4dc1-b355-97ee56e97522",
"title": "CVE-2025-14733 Vulnerability: WatchGuard Addresses a Critical RCE Affecting Firebox ...",
"ai_title": "China-linked Cyber Group Expands Targeting to Southeastern Europe",
"ai_summary": "A sophisticated threat actor known as UAT-7290, tracked by Cisco Talos, has expanded its operations to target telecommunications providers in Southea…",
"article_count": 1,
"threat_score": 95.89,
"severity_score": 100.0,
"date_range_latest": "2026-01-08T23:39:12+00:00",
"slug": "china-linked-cyber-group-expands-targeting-to-southeastern-e-56e97522"
}
],
"articles": [
{
"title": "Fake Claude Desktop App Used to Spread Malware Targeting Crypto Wallets",
"source": "Tech.Yahoo",
"pub_date": "2026-09-01T16:41:10+00:00",
"url": "https://tech.yahoo.com/cybersecurity/articles/fake-claude-desktop-app-used-160700784.html"
},
{
"title": "Fake Claude desktop app spreads crypto-stealing malware",
"source": "Tradingview",
"pub_date": "2026-09-01T14:20:39+00:00",
"url": "https://www.tradingview.com/news/cointelegraph:ffbe2a04e094b:0-fake-claude-desktop-app-spreads-cryp…"
}
],
"co_entities_with_counts": {
"attack_type": [
{
"value": "Malware",
"count": 1338
}
],
"platform": [
{
"value": "Linux",
"count": 563
}
],
"mitre_attack": [
{
"value": "T1059.001 - PowerShell",
"count": 388
}
],
"tool": [
{
"value": "PowerShell",
"count": 356
}
]
},
"aliases": []
}
GET /entities/country/Australia{
"entity": {
"entity_type": "country",
"entity_value": "Australia",
"frequency": 991,
"first_seen": "2025-10-23T20:19:43+00:00",
"last_seen": "2026-08-31T22:10:38+00:00"
},
"overview": "Australia is a sovereign country consisting of the mainland Australian continent, the island of Tasmania, and numerous smaller islands. It is recogni…",
"clusters": [
{
"cluster_id": "14224782-0262-4282-b1e6-52b01bce6f08",
"title": "Victorian student information stolen in major data breach",
"ai_title": "Major Cyber Attack on Victorian Government Schools Exposes Student Data",
"ai_summary": "Hackers have compromised the personal information of thousands of current and former students in Victorian government schools. The breach includes na…",
"article_count": 19,
"threat_score": 83.11,
"severity_score": 84.0,
"date_range_latest": "2026-01-14T10:11:03+00:00",
"slug": "major-cyber-attack-on-victorian-government-schools-exposes-s-1bce6f08"
},
{
"cluster_id": "b1286d86-7a9c-43c4-9697-1cbcb94c0224",
"title": "Threat actor leveraged Cisco SD-WAN zero-day since 2023 (CVE-2026-20127)",
"ai_title": "Cisco SD-WAN Zero-Day Exploited by Threat Actor Since 2023",
"ai_summary": "A cyber threat actor has been exploiting a zero-day vulnerability (CVE-2026-20127) in Cisco Catalyst SD-WAN Controller since 2023. This vulnerability…",
"article_count": 104,
"threat_score": 82.13,
"severity_score": 82.6,
"date_range_latest": "2026-02-25T16:58:31+00:00",
"slug": "cisco-sd-wan-zero-day-exploited-by-threat-actor-since-2023-b94c0224"
}
],
"articles": [
{
"title": "Healthcare cyberattacks hit pacemakers and millions of patient records",
"source": "Theregister",
"pub_date": "2026-08-31T22:10:38+00:00",
"url": "https://www.theregister.com/cyber-crime/2026/08/31/healthcare-cyberattacks-hit-pacemakers-and-milli…"
},
{
"title": "SEPT. 8-10: Top Cyber Experts from Federal Agencies, Companies, and Allies Share ...",
"source": "Uk.Finance.Yahoo",
"pub_date": "2026-08-31T21:01:46+00:00",
"url": "https://uk.finance.yahoo.com/news/sept-8-10-top-cyber-205400910.html"
}
],
"co_entities_with_counts": {
"country": [
{
"value": "United States",
"count": 238
}
],
"attack_type": [
{
"value": "Data Breach",
"count": 190
}
],
"industry": [
{
"value": "Government",
"count": 130
}
],
"mitre_attack": [
{
"value": "T1566 - Phishing",
"count": 77
}
]
},
"aliases": []
}
GET /entities/cve/CVE-2026-46037{
"entity": {
"entity_type": "cve",
"entity_value": "CVE-2026-46037",
"frequency": 15,
"first_seen": "2026-07-21T10:02:39+00:00",
"last_seen": "2026-09-01T08:19:48.157769+00:00"
},
"clusters": [
{
"cluster_id": "3716ea53-84da-497b-a06e-522e50bf594e",
"title": "USN-8664-1: Linux kernel (NVIDIA BaseOS) vulnerabilities",
"ai_title": "Critical Linux Kernel Vulnerabilities Affecting Ubuntu Systems",
"ai_summary": "Multiple security vulnerabilities have been identified in the Linux kernel affecting Ubuntu 24.04 and 26.04 LTS. Key issues include improper isolatio…",
"article_count": 8,
"threat_score": 72.75,
"severity_score": 81.0,
"date_range_latest": "2026-08-20T23:31:14+00:00",
"slug": "vulnerabilities-in-amd-processors-affect-linux-kernel-securi-50bf594e"
},
{
"cluster_id": "884c17df-2b61-44be-a77a-589d65c97e75",
"title": "USN-8566-1: Linux kernel vulnerabilities",
"ai_title": "Critical Vulnerabilities in Linux Kernel Affect AMD Processors",
"ai_summary": "Multiple vulnerabilities have been identified in the Linux kernel affecting AMD processors, specifically in the floating point divider unit and Zen 2…",
"article_count": 60,
"threat_score": 72.75,
"severity_score": 81.0,
"date_range_latest": "2026-07-20T15:45:34+00:00",
"slug": "usn-8566-1-linux-kernel-vulnerabilities-65c97e75"
}
],
"articles": [
{
"title": "Suse Su 202623290 1",
"source": "www.suse.com",
"pub_date": "2026-09-01T08:19:48.157769+00:00",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202623290-1/"
},
{
"title": "Suse Su 202623288 1",
"source": "www.suse.com",
"pub_date": "2026-09-01T08:19:47.058937+00:00",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202623288-1/"
}
],
"co_entities_with_counts": {
"cve": [
{
"value": "CVE-2026-43109",
"count": 13
}
],
"platform": [
{
"value": "Linux",
"count": 12
}
],
"cwe": [
{
"value": "Cwe-416 - Use After Free",
"count": 8
}
]
},
"aliases": []
}
GET /entities/cve/CVE-2026-46037/related{
"entity_type": "cve",
"entity_value": "CVE-2026-46037",
"related": [
{
"entity_type": "platform",
"entity_value": "Linux",
"shared_clusters": 4,
"co_occurrences": 170
},
{
"entity_type": "company",
"entity_value": "SuSE",
"shared_clusters": 2,
"co_occurrences": 12
}
],
"sub_relationships": [
{
"source": "Linux",
"target": "Data Breach",
"shared_clusters": 200
},
{
"source": "Linux",
"target": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"shared_clusters": 5
}
]
}
GET /entities/trending?time_filter=7d{
"trending": {
"apt_group": [
{
"value": "Volt Typhoon",
"frequency": 7,
"change": 600.0,
"is_new": false
}
],
"attack_type": [
{
"value": "Malware",
"frequency": 194,
"change": 23.6,
"is_new": false
}
],
"campaign": [
{
"value": "Operation Jackal IV",
"frequency": 3,
"change": 200.0,
"is_new": false
}
],
"company": [
{
"value": "NASA",
"frequency": 28,
"change": 1300.0,
"is_new": false
}
]
},
"time_filter": "7d"
}
GET /entities/search?q=lock{
"entities": [
{
"entity_type": "ransomware_group",
"entity_value": "Lockbit",
"article_count": 154,
"cluster_count": 87
},
{
"entity_type": "platform",
"entity_value": "BitLocker",
"article_count": 39,
"cluster_count": 23
}
],
"count": 20,
"total": 163,
"limit": 20,
"offset": 0,
"query": "lock"
}
GET /stats/entities/timeline?entity_type=ransomware_group&days=30{
"entity_type": "ransomware_group",
"days": 30,
"timeline": {
"dates": [
"2026-08-03",
"2026-08-04",
"2026-08-05"
],
"entities": [
{
"name": "Qilin",
"counts": [
0,
0
]
}
]
}
}
GET /search?q=CVE-2026-46037{
"query": "CVE-2026-46037",
"clusters": [
{
"short_id": "cebb7ea4",
"cluster_id": "da662236-d210-4fa9-8968-7b30cebb7ea4",
"slug": "multiple-suse-kernel-rt-security-updates-address-critical-vu-cebb7ea4",
"ai_title": "Multiple SUSE Kernel RT Security Updates Address Critical Vulnerabilities",
"ai_summary": "SUSE has released a series of important security updates for its Linux Enterprise Kernel, addressing multiple vulnerabilities across various versions…",
"urgency_level": "medium",
"keywords": [
"security",
"linux"
],
"threat_score": 67.25,
"severity_score": 70.0,
"article_count": 40,
"date_range_latest": "2026-08-26T16:51:07+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
}
],
"entities": [
{
"entity_type": "cve",
"entity_value": "CVE-2026-46037",
"cluster_count": 4,
"article_count": 15
}
],
"darkweb": [],
"limit": 10,
"total": 2
}
GET /search?q=fortigate{
"query": "fortigate",
"clusters": [
{
"short_id": "b4c3b813",
"cluster_id": "d210e6b1-58d9-40aa-8d82-8b7eb4c3b813",
"slug": "hackers-breached-a-small-polish-energy-plant-via-private-apn-b4c3b813",
"ai_title": "Cyberattack on Polish Energy Sector Exploits Private APN Vulnerability",
"ai_summary": "In December 2025, hackers breached a Polish combined heat and power (CHP) plant using a private Access Point Name (APN) to access the operational tec…",
"urgency_level": "medium",
"keywords": [
"hackers",
"private"
],
"threat_score": 77.0,
"severity_score": 80.0,
"article_count": 8,
"date_range_latest": "2026-08-10T23:07:21+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
},
{
"short_id": "23e56b38",
"cluster_id": "4fe5a130-915f-4685-a552-542623e56b38",
"slug": "fortigate-1200g-brings-fortisase-outpost-to-customer-23e56b38",
"ai_title": "Fortinet Launches FortiGate 1200G with Integrated SASE Capabilities",
"ai_summary": "Fortinet has introduced the FortiGate 1200G series, enhancing its firewall offerings with integrated FortiSASE Outpost capabilities. This new series…",
"urgency_level": "medium",
"keywords": [
"fortigate",
"fortisase"
],
"threat_score": 21.9,
"severity_score": 21.0,
"article_count": 2,
"date_range_latest": "2026-07-29T08:38:45+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
}
],
"entities": [
{
"entity_type": "platform",
"entity_value": "Fortigate",
"cluster_count": 35,
"article_count": 71
},
{
"entity_type": "platform",
"entity_value": "Fortinet FortiGate",
"cluster_count": 7,
"article_count": 9
}
],
"darkweb": [],
"limit": 10,
"total": 19
}
GET /search?q=Qilin{
"query": "Qilin",
"clusters": [
{
"short_id": "3a29f452",
"cluster_id": "b2c83a72-8d2c-4913-bb97-47c73a29f452",
"slug": "qilin-ransomware-gang-targets-atf-in-cyberattack-3a29f452",
"ai_title": "Qilin Ransomware Gang Claims Attack on ATF, Major Incident Declared",
"ai_summary": "The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) is investigating a major cybersecurity incident after the Qilin ransomware gang claimed…",
"urgency_level": "medium",
"keywords": [
"ransomware",
"attack"
],
"threat_score": 61.25,
"severity_score": 70.0,
"article_count": 31,
"date_range_latest": "2026-08-26T22:35:02+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
},
{
"short_id": "2f4929ac",
"cluster_id": "5eb440b4-5ec7-457d-befd-98c12f4929ac",
"slug": "mexicos-cybersecurity-plan-addresses-rising-ransomware-threa-2f4929ac",
"ai_title": "Mexico's Cybersecurity Plan Addresses Rising Ransomware Threats",
"ai_summary": "Mexico's National Cybersecurity Plan, introduced in December 2025, aims to tackle increasing cyber threats, particularly ransomware, which has seen 2…",
"urgency_level": "medium",
"keywords": [
"mexico",
"cybersecurity"
],
"threat_score": 56.0,
"severity_score": 61.0,
"article_count": 2,
"date_range_latest": "2026-08-25T19:22:28+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
}
],
"entities": [
{
"entity_type": "ransomware_group",
"entity_value": "Qilin",
"cluster_count": 124,
"article_count": 202
},
{
"entity_type": "ransomware_group",
"entity_value": "Qilin Ransomware",
"cluster_count": 12,
"article_count": 12
}
],
"darkweb": [
{
"type": "victim",
"name": "Commission de la construction du Quebec",
"id": "87989ff49ba65be4",
"date": "2026-09-01T03:57:10.128191+00:00",
"group": "qilin",
"country": "CA",
"sector": "Government & Defense"
},
{
"type": "victim",
"name": "Inmac",
"id": "cc74ad77dd5371e1",
"date": "2026-08-31T19:02:21.022361+00:00",
"group": "qilin",
"country": "AR",
"sector": "Retail & E-Commerce"
}
],
"limit": 10,
"total": 30
}
GET /search?q=Volt%20Typhoon{
"query": "Volt Typhoon",
"clusters": [
{
"short_id": "36dd11fb",
"cluster_id": "cd4e93a9-6b89-4dc7-afad-be8536dd11fb",
"slug": "antares-backs-affirmative-cyber-war-cover-for-us-essential-36dd11fb",
"ai_title": "Antares Launches Cyber War Coverage for US Critical Infrastructure Operators",
"ai_summary": "Antares' Lloyd's Syndicate 1274 has introduced a new affirmative cyber war product for US critical infrastructure providers, including power, water,…",
"urgency_level": "medium",
"keywords": [
"antares",
"affirmative"
],
"threat_score": 60.0,
"severity_score": 61.0,
"article_count": 4,
"date_range_latest": "2026-07-03T05:32:24+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
},
{
"short_id": "02df2601",
"cluster_id": "e2dc39d2-3e07-4205-af9d-2ab702df2601",
"slug": "canadas-spy-service-won-permission-to-hack-two-state-linked--02df2601",
"ai_title": "Canada's CSIS Authorized to Hack State-Linked Botnets Targeting Critical Infrastructure",
"ai_summary": "Canada's Federal Court has granted the Canadian Security Intelligence Service (CSIS) permission to hack into privately owned routers and internet-con…",
"urgency_level": "medium",
"keywords": [
"canada",
"service"
],
"threat_score": 75.5,
"severity_score": 80.0,
"article_count": 6,
"date_range_latest": "2026-06-16T21:21:32+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
}
],
"entities": [
{
"entity_type": "apt_group",
"entity_value": "Volt Typhoon",
"cluster_count": 72,
"article_count": 102
},
{
"entity_type": "campaign",
"entity_value": "Volt Typhoon Campaign",
"cluster_count": 1,
"article_count": 1
}
],
"darkweb": [],
"limit": 10,
"total": 13
}
GET /search?q=Vidar{
"query": "Vidar",
"clusters": [
{
"short_id": "a083694a",
"cluster_id": "c6ba6c39-9904-4df7-9253-ab86a083694a",
"slug": "infostealer-malware-hijacks-claude-sessions-draining-user-li-a083694a",
"ai_title": "Infostealer Malware Hijacks Claude Sessions, Drains User Accounts",
"ai_summary": "Anthropic has alerted users that infostealer malware is compromising Claude accounts by hijacking active login sessions, allowing attackers to deplet…",
"urgency_level": "medium",
"keywords": [
"claude",
"anthropic"
],
"threat_score": 70.5,
"severity_score": 80.0,
"article_count": 35,
"date_range_latest": "2026-08-31T02:52:54+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
},
{
"short_id": "a9dff91d",
"cluster_id": "f0c4d02d-7da0-425e-b93f-da65a9dff91d",
"slug": "fake-google-gemini-installer-distributes-vidar-infostealer-v-a9dff91d",
"ai_title": "Fake Google Gemini Installer Distributes Vidar Infostealer via Google Colab",
"ai_summary": "A malicious executable disguised as a Google Gemini installer was used to deploy the Vidar infostealer on a company network in the EMEA region. Darkt…",
"urgency_level": "medium",
"keywords": [
"google",
"gemini"
],
"threat_score": 51.9,
"severity_score": 61.0,
"article_count": 3,
"date_range_latest": "2026-08-21T06:22:04+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
}
],
"entities": [
{
"entity_type": "malware",
"entity_value": "Vidar",
"cluster_count": 41,
"article_count": 91
},
{
"entity_type": "malware",
"entity_value": "Vidar Stealer",
"cluster_count": 4,
"article_count": 6
}
],
"darkweb": [],
"limit": 10,
"total": 18
}
GET /search?q=172.86.98.113{
"query": "172.86.98.113",
"clusters": [],
"entities": [
{
"entity_type": "ipv4",
"entity_value": "172.86.98.113",
"cluster_count": 2,
"article_count": 3
}
],
"darkweb": [],
"limit": 10,
"total": 1
}
GET /search?q=businesswire.com{
"query": "businesswire.com",
"clusters": [],
"entities": [
{
"entity_type": "domain",
"entity_value": "businesswire.com",
"cluster_count": 131,
"article_count": 172
}
],
"darkweb": [],
"limit": 10,
"total": 1
}
GET /search?q=Australia{
"query": "Australia",
"clusters": [
{
"short_id": "fcea078c",
"cluster_id": "b3b4cb52-0853-433e-8397-cbe6fcea078c",
"slug": "cybersecurity-governance-urged-amid-rising-ai-threats-fcea078c",
"ai_title": "Cybersecurity Governance Urged Amid Rising AI Threats",
"ai_summary": "The European Supervisory Authorities (EBA, EIOPA, and ESMA) have called for enhanced governance to mitigate ICT risks linked to frontier AI models. T…",
"urgency_level": "medium",
"keywords": [
"eiopa",
"esma"
],
"threat_score": 51.9,
"severity_score": 61.0,
"article_count": 2,
"date_range_latest": "2026-09-01T16:19:54.871384+00:00",
"is_new": true,
"is_trending": false,
"entities": {}
},
{
"short_id": "5c82aa5d",
"cluster_id": "67109d7f-1c87-4600-9277-22fb5c82aa5d",
"slug": "five-eyes-alliance-targets-global-fraud-networks-5c82aa5d",
"ai_title": "Five Eyes Alliance Targets Global Fraud Networks",
"ai_summary": "The UK, supported by the Five Eyes alliance (US, Canada, Australia, New Zealand), has initiated measures to combat global fraud and online scams. Dur…",
"urgency_level": "medium",
"keywords": [
"fraud",
"national"
],
"threat_score": 45.4,
"severity_score": 40.0,
"article_count": 2,
"date_range_latest": "2026-08-28T13:53:35+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
}
],
"entities": [
{
"entity_type": "country",
"entity_value": "Australia",
"cluster_count": 594,
"article_count": 991
},
{
"entity_type": "company",
"entity_value": "Australian Federal Police",
"cluster_count": 4,
"article_count": 4
}
],
"darkweb": [
{
"type": "victim",
"name": "3-point Australia",
"id": "a9397a294e5ddc1a",
"date": "2026-08-14T07:12:41.384020+00:00",
"group": "storm",
"country": "AU",
"sector": "Other"
},
{
"type": "victim",
"name": "INTERTRUST AUSTRALIA PTY LTD",
"id": "e44d9bb0c39303f2",
"date": "2026-08-02T20:27:11.858120+00:00",
"group": "qilin",
"country": "AU",
"sector": "Professional Services"
}
],
"limit": 10,
"total": 30
}
GET /search?q=healthcare{
"query": "healthcare",
"clusters": [
{
"short_id": "1e900c91",
"cluster_id": "55698251-3cce-41d4-8f9b-1fd71e900c91",
"slug": "phishing-vulnerability-reduced-by-83-through-training-in-eur-1e900c91",
"ai_title": "Phishing Vulnerability Reduced by 83% Through Training in Europe",
"ai_summary": "A new study reveals that European companies can reduce employee vulnerability to phishing by 83% after one year of security training. The 'Phishing b…",
"urgency_level": "medium",
"keywords": [
"phishing",
"study"
],
"threat_score": 42.75,
"severity_score": 41.0,
"article_count": 2,
"date_range_latest": "2026-09-01T16:20:42.925369+00:00",
"is_new": true,
"is_trending": false,
"entities": {}
},
{
"short_id": "2220c37d",
"cluster_id": "7c2baf1b-8165-400a-ace3-14fe2220c37d",
"slug": "massive-healthcare-data-breach-affects-375m-patients-2220c37d",
"ai_title": "Massive Healthcare Data Breach Affects 3.75M Patients",
"ai_summary": "In March 2026, CareCloud experienced a significant data breach affecting over 3.75 million patients. Hackers accessed CareCloud's cloud environment,…",
"urgency_level": "medium",
"keywords": [
"data",
"breach"
],
"threat_score": 61.5,
"severity_score": 75.0,
"article_count": 2,
"date_range_latest": "2026-09-01T15:13:51+00:00",
"is_new": true,
"is_trending": false,
"entities": {}
}
],
"entities": [
{
"entity_type": "industry",
"entity_value": "Healthcare",
"cluster_count": 845,
"article_count": 1378
},
{
"entity_type": "company",
"entity_value": "Change Healthcare",
"cluster_count": 31,
"article_count": 39
}
],
"darkweb": [
{
"type": "victim",
"name": "Nutex Health",
"id": "dff02778ccad0dc8",
"date": "2026-09-01T12:14:08.598913+00:00",
"group": "thegentlemen",
"country": "US",
"sector": "Healthcare"
},
{
"type": "victim",
"name": "seashellhospital.com",
"id": "f471acfa69878ee8",
"date": "2026-09-01T09:02:54.914837+00:00",
"group": "krybit",
"country": "IN",
"sector": "Healthcare"
}
],
"limit": 10,
"total": 30
}
GET /search?q=ransomware&days=1{
"query": "ransomware",
"clusters": [
{
"short_id": "c92c65c3",
"cluster_id": "83855d94-b8a0-4d53-bf44-7bb7c92c65c3",
"slug": "superna-launches-cyberstorage-v215-for-enhanced-security-ope-c92c65c3",
"ai_title": "Superna Launches Cyberstorage v2.15 for Enhanced Security Operations",
"ai_summary": "On September 1, 2026, Superna announced the release of version 2.15 of its Cyberstorage platform. This update aims to streamline security and resilie…",
"urgency_level": "medium",
"keywords": [
"security",
"superna"
],
"threat_score": 24.0,
"severity_score": 20.0,
"article_count": 2,
"date_range_latest": "2026-09-01T15:19:13.891342+00:00",
"is_new": true,
"is_trending": false,
"entities": {}
},
{
"short_id": "2c02b996",
"cluster_id": "5329414f-a3ee-4f5f-af4d-24152c02b996",
"slug": "spinai-acquires-docontrol-to-enhance-saas-and-ai-security-so-2c02b996",
"ai_title": "Spin.AI Acquires DoControl to Enhance SaaS and AI Security Solutions",
"ai_summary": "Spin.AI has acquired DoControl, an Israeli cybersecurity firm, to integrate their technologies into a unified SaaS and AI security platform. The acqu…",
"urgency_level": "medium",
"keywords": [
"spin",
"security"
],
"threat_score": 21.9,
"severity_score": 21.0,
"article_count": 2,
"date_range_latest": "2026-08-31T22:22:17+00:00",
"is_new": true,
"is_trending": false,
"entities": {}
}
],
"entities": [
{
"entity_type": "attack_type",
"entity_value": "Ransomware",
"cluster_count": 2086,
"article_count": 4320
},
{
"entity_type": "ransomware_group",
"entity_value": "Qilin Ransomware",
"cluster_count": 12,
"article_count": 12
}
],
"darkweb": [
{
"type": "group",
"name": "0mega",
"active": true,
"victim_count": 1
},
{
"type": "group",
"name": "abrahams_ax",
"active": true,
"victim_count": 0
}
],
"limit": 10,
"days": 1,
"total": 25
}
GET /search?q=lockbit&include_articles=true{
"query": "lockbit",
"clusters": [
{
"short_id": "2f4929ac",
"cluster_id": "5eb440b4-5ec7-457d-befd-98c12f4929ac",
"slug": "mexicos-cybersecurity-plan-addresses-rising-ransomware-threa-2f4929ac",
"ai_title": "Mexico's Cybersecurity Plan Addresses Rising Ransomware Threats",
"ai_summary": "Mexico's National Cybersecurity Plan, introduced in December 2025, aims to tackle increasing cyber threats, particularly ransomware, which has seen 2…",
"urgency_level": "medium",
"keywords": [
"mexico",
"cybersecurity"
],
"threat_score": 56.0,
"severity_score": 61.0,
"article_count": 2,
"date_range_latest": "2026-08-25T19:22:28+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
},
{
"short_id": "84095fb7",
"cluster_id": "58924ad2-b41a-4e6c-b1c4-5b6084095fb7",
"slug": "lockbit-ransomware-targets-icbc-financial-services-and-us-ba-84095fb7",
"ai_title": "LockBit Ransomware Targets ICBC Financial Services and U.S. Bank",
"ai_summary": "On November 8, 2025, the LockBit ransomware group attacked ICBC Financial Services, disrupting U.S. Treasury trading operations. The attack exploited…",
"urgency_level": "medium",
"keywords": [
"ransomware",
"financial"
],
"threat_score": 65.5,
"severity_score": 80.0,
"article_count": 10,
"date_range_latest": "2026-08-20T14:34:35.622452+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
}
],
"entities": [
{
"entity_type": "ransomware_group",
"entity_value": "Lockbit",
"cluster_count": 87,
"article_count": 138
},
{
"entity_type": "ransomware_group",
"entity_value": "Lockbit 3.0",
"cluster_count": 7,
"article_count": 5
}
],
"darkweb": [
{
"type": "victim",
"name": "svfcu.org",
"id": "5e9204528e5ca8a6",
"date": "2026-08-31T23:02:07.027296+00:00",
"group": "lockbit5",
"country": "US",
"sector": "Financial Services"
},
{
"type": "victim",
"name": "hoaattorneys.com",
"id": "20374774ed86a8db",
"date": "2026-08-31T22:59:59.933621+00:00",
"group": "lockbit5",
"country": "US",
"sector": "Professional Services"
}
],
"articles": [
{
"title": "US Bank investigates LockBit claim of data theft, faces September 3 deadline",
"source": "Teiss",
"url": "https://www.teiss.co.uk/news/us-bank-investigates-lockbit-claim-of-data-theft-faces-september-3-dea…",
"pub_date": "2026-08-24T11:00:51+00:00",
"is_new": false
},
{
"title": "US Bank investigates LockBit ransomware claims of data breach",
"source": "Feeds.Feedburner",
"url": "https://www.scworld.com/brief/us-bank-investigates-lockbit-ransomware-claims-of-data-breach",
…
POST /ask
{"query": "Which ransomware groups hit healthcare this week, and how?"}{
"answer": "Three groups named healthcare victims in the last seven days.\n- **Qilin** listed a UK NHS supplier, 400 GB claimed, initial access via a Citrix appliance [C1] [C2].\n- **INC Ransom** posted two US clinics; both reports describe phishing to a billing platform login [C3].\n- **Rhysida** ...",
"sources": [ {"tag": "C1", "cluster_id": "…", "title": "Qilin claims UK NHS supplier…", "url": "https://threatcluster.io/cluster/…"} ],
"context_used": {"engine": "agent", "tool_calls": [{"tool": "leak_site_victims", "args": {"days": 7, "sector": "Healthcare"}}], "clusters_matched": 6, "victims_listed": 15},
"cost": 50,
"cached": false
}
POST /feeds/17ae839a-a413-4c6b-91a5-b2b830f09699/entities
{"keyword": "Snowflake", "entity_type": "company"}{
"feed_id": "17ae839a-a413-4c6b-91a5-b2b830f09699",
"added": [
{
"keyword": "snowflake",
"entity_type": "company",
"is_custom": false
}
],
"skipped": [],
"count": 4,
"limit": 75
}
GET /feed?feed_type=custom&feed_id=17ae839a-a413-4c6b-91a5-b2b830f09699&time_filter=30d&limit=3{
"items": [
{
"cluster_id": "15e5588e-5ec9-44e7-a292-9de007cce8c9",
"title": "An AI broke Snowflake's code. Then another AI agent exploited it",
"ai_title": "AI-Driven Command Injection Vulnerability Exposes Snowflake Jira Credentials",
"ai_summary": "A critical command injection vulnerability was discovered in Snowflake's GitHub Actions workflow, allowing unauthenticated attackers to exec…",
"timeline": [
{
"date": "2026-06-18",
"event": "Vulnerability introduced by AI assistant",
"detail": "GitHub Copilot Autofix altered the workflow code, creating a command injection vector.",
"source": "News.Ycombinator",
"source_url": "https://www.wiz.io/blog/red-agent-snowflake-copilot-cicd-bug"
},
{
"date": "2026-06-23",
"event": "Vulnerability discovered and disclosed",
"detail": "Wiz Research's Red Agent identified the flaw and reported it to Snowflake via HackerOne.",
"source": "Rescana",
"source_url": "https://www.rescana.com/post/critical-command-injection-vulnerability-in-snowflake-snowflake-connector-net-github-actions-exposes-jira-crede…"
},
"…"
],
"article_count": 12,
"threat_score": 67.5,
"recency_score": 0.0,
"coverage_score": 63.11,
"severity_score": 80.0,
"sentiment_score": 70.0,
"geopolitical_score": 0.0,
"actionability_score": 60.0,
"severity_reason": "The vulnerability was critical due to its potential for exploitation, but it was quickly remediated.",
"credibility_score": 0.0,
"urgency_level": "medium",
"ranking_score": 0.0,
"keywords": [
"snowflake",
"another",
"…"
],
"sources": [
"Theregister",
"News.Ycombinator"
],
"severity_indicators": [
"ot"
],
"date_range_earliest": "2026-08-17T14:18:38+00:00",
"date_range_latest": "2026-08-17T16:36:21+00:00",
"created_at": "2026-08-17T17:31:58.339730+00:00",
"updated_at": "2026-09-05T11:28:06.165066+00:00",
"recent_article_count_12h": 0,
"recent_article_count_6h": 0,
"insights_count": 0,
"articles": [
{
"uuid": "d28b0a87-ff5b-7219-bc56-206f3cb9fe78",
"title": "AI-Generated GitHub Copilot \"Autofix\" Allowed Compromise of Snowflake's Jira",
"content": "<p>As part of ongoing security research conducted through Snowflake’s HackerOne vulnerability disclosure program, Wiz Research’s \"Red Agent\"…",
"source": "News.Ycombinator",
"pub_date": "2026-08-17T14:18:38+00:00",
"url": "https://www.wiz.io/blog/red-agent-snowflake-copilot-cicd-bug",
"author": "",
"og_image_url": "https://www.datocms-assets.com/75231/1786964856-image.png?fm=webp",
"is_reference_only": false,
"link_source_article_uuid": null,
"link_source_title": null,
"link_source_name": null,
"similarity_score": 0.8978291153907776,
…
}
GET /threats?since=2026-09-06T00:04:14Z&sort_by=new&limit=3{
"threats": [
{
"cluster_id": "a421faa9-01c2-45f0-862f-5fd7e1322f03",
"title": "Germany plans anti-drone shield after Leipzig attack: report",
"ai_title": "Germany Accuses Russia of Drone Attack Amid Rising Hybrid Warfare Threats",
"ai_summary": "On August 4, 2026, Germany accused Russia of orchestrating a drone attack on Leipzig-Halle Airport, marking a significant escalation in hybr…",
"timeline": [
{
"date": "2026-08-04",
"event": "Drone attack on Leipzig-Halle Airport",
"detail": "Three drones targeted the airport; one struck a parked plane and another collided with an inbound cargo jet.",
"source": "Rte.Ie",
"source_url": "https://www.rte.ie/news/2026/0905/1590402-russia-eu-hybrid-attacks/"
},
{
"date": "2026-09-05",
"event": "Germany accuses Russia of involvement",
"detail": "German Interior Minister Dobrindt stated that the drone attack reflects a new reality of hybrid threats from Russia.",
"source": "Rte.Ie",
"source_url": "https://www.rte.ie/news/2026/0905/1590402-russia-eu-hybrid-attacks/"
},
"…"
],
"article_count": 2,
"threat_score": 62.85,
"recency_score": 0.0,
"coverage_score": 63.11,
"severity_score": 61.0,
"sentiment_score": 80.0,
"geopolitical_score": 81.0,
"actionability_score": 41.0,
"severity_reason": "The incident represents a significant escalation in hybrid warfare tactics attributed to state-sponsored actions.",
"credibility_score": 0.0,
"urgency_level": "medium",
"ranking_score": 0.0,
"keywords": [
"germany",
"shield",
"…"
],
"sources": [
"Dw",
"Rte.Ie"
],
"severity_indicators": [
"pla"
],
"date_range_earliest": "2026-09-05T06:54:54+00:00",
"date_range_latest": "2026-09-06T10:46:40+00:00",
"created_at": "2026-09-06T11:44:17.169223+00:00",
"updated_at": "2026-09-06T11:46:20.876248+00:00",
"recent_article_count_12h": 1,
"recent_article_count_6h": 1,
"insights_count": 0,
"articles": [
{
"uuid": "b46e4478-070b-ac2d-b3d5-8941149de984",
"title": "Is Russia's alleged hybrid war on EU a genuine threat?",
"content": "<p>This week Germany accused Russia of involvement in a drone attack on Leipzig-Halle Airport, marking a new low in relations between the tw…",
"source": "Rte.Ie",
"pub_date": "2026-09-05T06:54:54+00:00",
"url": "https://www.rte.ie/news/2026/0905/1590402-russia-eu-hybrid-attacks/",
"author": "",
"og_image_url": "https://www.rte.ie/images/0024f53c-1600.jpg",
"is_reference_only": false,
"link_source_article_uuid": null,
"link_source_title": null,
"link_source_name": null,
"similarity_score": 0.7067529559135437,
…
}
POST /webhooks
{"webhook_url": "https://httpbin.org/post", "webhook_type": "json", "name": "SOAR intake", "secret_key": "change-me"}{
"webhook": {
"id": 24,
"name": "SOAR intake",
"webhook_url": "https://httpbin.org/post",
"webhook_type": "json",
"is_active": true,
"mssp_customer_id": null,
"created_at": "2026-09-06T12:04:15.167373+00:00",
"has_secret": true,
"scope": "personal"
}
}
POST /alert-rules
{"name": "Stack vendors", "logic_operator": "OR", "conditions": [{"entity_type": "platform", "entity_value": "FortiOS"}, {"entity_type": "company", "entity_value": "Okta"}], "notify_webhook": true, "webhook_id": 24}{
"success": true,
"rule": {
"id": 52,
"uuid": "9c165faf-a99c-49a8-8970-aa95a7e1e985",
"name": "Stack vendors",
"description": null,
"logic_operator": "OR",
"is_active": true,
"notify_webhook": true,
"notify_email": false,
"notify_inapp": true,
"notify_email_address": null,
"webhook_id": 24,
"mssp_customer_id": null,
"created_at": "2026-09-06T12:04:15.861142+00:00",
"conditions": [
{
"id": 459,
"entity_type": "platform",
"entity_value": "FortiOS",
"match_type": "exact",
"created_at": "2026-09-06T12:04:15.861142+00:00"
},
{
"id": 460,
"entity_type": "company",
"entity_value": "Okta",
"match_type": "exact",
"created_at": "2026-09-06T12:04:15.861142+00:00"
}
]
}
}
POST /cve-alerts
{"name": "Fortinet KEV", "vendors": ["Fortinet"], "severity": ["CRITICAL", "HIGH"], "require_kev": true, "notify_webhook": true, "webhook_id": 24}{
"success": true,
"rule": {
"id": 22,
"uuid": "dd2259f4-3d7c-4d58-b36c-4fb7949ac3dd",
"name": "Fortinet KEV",
"description": null,
"is_active": true,
"match_logic": "AND",
"vendors": [
"Fortinet"
],
"products": null,
"cwe_ids": null,
"severity": [
"CRITICAL",
"HIGH"
],
"cvss_min": null,
"cvss_max": null,
"epss_min": null,
"epss_percentile_min": null,
"require_kev": true,
"require_exploit": null,
"ransomware_use": null,
"keywords": null,
"notify_email": false,
"notify_webhook": true,
"notify_inapp": true,
"webhook_id": 24,
"mssp_customer_id": null,
"created_at": "2026-09-06T12:04:16.856241+00:00",
"updated_at": "2026-09-06T12:04:16.856241+00:00"
}
}
POST /alert-rules/9c165faf-a99c-49a8-8970-aa95a7e1e985/test{
"rule_uuid": "9c165faf-a99c-49a8-8970-aa95a7e1e985",
"rule_name": "Stack vendors",
"logic_operator": "OR",
"conditions_count": 2,
"window_days": 7,
"matching_clusters": [
{
"cluster_id": "e057d32f-1ed6-4558-8f9a-15cd4e5deb78",
"title": "AI Infrastructure Under Siege: Session Hijacking and Exploits Surge",
"threat_score": 73.25,
"created_at": "2026-09-05T18:17:26.363704+00:00"
}
],
"total_matches": 1
}
GET /alerts?since=2026-09-06T00:04:14Z&limit=3{
"count": 2,
"limit": 3,
"offset": 0,
"alerts": [
{
"alert_source": "cluster",
"trigger_id": 3484,
"mssp_customer_id": null,
"rule_name": "Alerts: CNI Sector Threats Feed",
"entity_ref": "5505b25f",
"triggered_at": "2026-09-06T11:46:22.832877+00:00",
"disposition": "open",
"disposition_note": null,
"disposed_by": null,
"disposed_at": null
},
{
"alert_source": "cve",
"trigger_id": 48600,
"mssp_customer_id": null,
"rule_name": "CVEs",
"entity_ref": "CVE-2026-78362",
"triggered_at": "2026-09-06T11:45:13.371441+00:00",
"disposition": "open",
"disposition_note": null,
"disposed_by": null,
"disposed_at": null
}
]
}
GET /entities/company/Foxconn/darkweb-profile{
"name": "Foxconn",
"normalised": "foxconn",
"authed": true,
"hero": {
"multi_claim_actors": [],
"multi_claim": false,
"total_articles": 39,
"total_clusters": 7,
"total_leak_sights": 1,
"first_seen": "2025-12-08T18:16:52.019925+00:00",
"last_seen": "2026-07-15T14:02:24+00:00"
},
"leak_sites": [
{
"actor": "incransom",
"category": "ransomware_leak",
"published_at": "2025-12-08T18:16:52.019925+00:00",
"first_seen_at": "2025-12-08T18:16:52.019925+00:00",
"country": "TW",
"industry": "Technology",
"victim_id": "984ba3676d3e8e22",
"victim_domain": "",
"description": "Foxconn Interconnect Technology Limited (FIT) focuses on the development, manufacturing, and marketing of electronic and optoelectronic conn…",
"screenshot_url": "https://images.ransomware.live/victims/5fd3a0ead34dbf09d83c0d040aa3209c.png"
}
],
"news_clusters": [
{
"cluster_id": "528dc1d6-689f-458a-b971-4c342fab9361",
"ai_title": "Foxconn Cyberattack: Nitrogen Ransomware Claims 8TB of Data Theft",
"article_count": 54,
"threat_score": 71.0,
"date_range_latest": "2026-05-12T22:04:33.683254+00:00",
"og_image_url": null,
"mentions": 24
},
{
"cluster_id": "cfa725bf-e481-4682-b0eb-4693cdddd0f1",
"ai_title": "Tata Electronics Cyber Breach Exposes Apple and Tesla Trade Secrets",
"article_count": 217,
"threat_score": 67.75,
"date_range_latest": "2026-06-22T17:15:08+00:00",
"og_image_url": null,
"mentions": 6
},
"…"
],
"articles": [
{
"uuid": "b6a90175-b0e8-ded7-5c36-500f2c992758",
"title": "Independent Testing Shows Which Business Security Products Actually Hold Up When It Matters",
"source": "Prnewswire",
"url": "https://www.prnewswire.co.uk/news-releases/independent-testing-shows-which-business-security-products-actually-hold-up-when-it-matters-30282…",
"pub_date": "2026-07-15T14:02:24+00:00",
"og_image_url": "https://mmx.prnewswire.com/media/MS1882555/PM_Business_H1_2026_AVC.jpg?id=OA2762342&p=facebook"
},
{
"uuid": "268242b7-2d36-a393-b44f-f5b40e89940e",
"title": "Independent Testing Shows Which Business Security Products Actually Hold Up When It Matters",
"source": "Ca.Finance.Yahoo",
"url": "https://ca.finance.yahoo.com/news/independent-testing-shows-business-security-080000602.html",
"pub_date": "2026-07-15T08:11:19+00:00",
"og_image_url": "https://s.yimg.com/lo/mysterio/api/DEEE955A76987C188683E2F1E67857228074D80E454FC4228D7F31A911740BD0/subgraphmysterio/resizefill_w1200_h675;q…"
},
"…"
],
"related": {
"actors": [
{
…
}
GET /threats/545ca28d/attack-flow{
"cluster_id": "a2e5969c-ad0f-4028-bfda-67e7545ca28d",
"flow": {
"nodes": [
{
"id": "n1",
"type": "initial_access",
"label": "Vulnerable Public-Facing Systems",
"tactic": "TA0001",
"evidence": "QTFY exploits vulnerabilities in internet-facing applications like Ivanti, BeyondTrust, and Check Point devices.",
"technique": "T1190",
"entity_ref": null
},
{
"id": "n2",
"type": "execution",
"label": "Exploit Vulnerabilities",
"tactic": "TA0002",
"evidence": "QTFY uses advanced exploits such as CVE-2024-8190, CVE-2024-8963, CVE-2024-9380, and others to gain initial access.",
"technique": "T1068",
"entity_ref": null
},
"…"
],
"edges": [
{
"to": "n2",
"from": "n1",
"label": "exploits vulnerabilities"
},
{
"to": "n3",
"from": "n2",
"label": "establishes persistence"
},
"…"
],
"notes": "Attack chain synthesizes multiple exploit and lateral movement steps, emphasizing the use of IoT proxies and web shells for persistence and …",
"confidence": 0.9
},
"stix": {
"id": "bundle--3af530c3-e1ca-42d0-bfa6-1ce834536718",
"type": "bundle",
"objects": [
{
"id": "identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d",
"name": "ThreatCluster",
"type": "identity",
"created": "2026-09-02T23:32:24.000Z",
"modified": "2026-09-02T23:32:24.000Z",
"spec_version": "2.1",
"identity_class": "organization"
},
{
"id": "attack-flow--03cf3be3-d451-5523-b295-c4e2f015a2fa",
"name": "China-Linked QTFY Group Targets Critical Infrastructure with Advanced Exploits",
"type": "attack-flow",
"scope": "incident",
"created": "2026-09-02T23:32:24.000Z",
"modified": "2026-09-02T23:32:24.000Z",
"extensions": {
"extension-definition--fb9c968a-a3ea-42f5-b3bf-fc9a9ebad18f": {
"extension_type": "new-sdo"
}
},
"start_refs": [
"attack-action--f8eba790-3c95-590d-bbc0-cfd90ffd5bed",
"attack-action--b89e98fb-4add-5fe0-9afb-9d8abc036923"
],
"description": "Attack chain synthesizes multiple exploit and lateral movement steps, emphasizing the use of IoT proxies and web shells for persistence and …",
…
}
The API, in numbers
Incident records22,192+651 this week
Validated indicators16,955+2,020 this week
Leak-site victims20,926+184 this week
Entities118,182+7,843 this week
Articles227,195+7,590 this week
Lead over the trade press5.1 daysHow we measure it
Build into your existing workflow
The API speaks the formats your tools already read. Each link is a short setup guide.
Terminal
pipx install threatcluster-cli, or plain curl. Drop-in for cron, CI and shell pipelines.
SIEM, firewall, TIP
Point the ingestor at the IOC feed, or import STIX bundles and the MISP manifest.
Agents
Per-session agent keys with scoped budgets, tool definitions from the OpenAPI spec, and cost headers the model can read to pace itself.
Or start from a template
Sector ransomware watchSlack alert · 2 credits CVE triageKEV and EPSS · 1 credit per CVE SIEM indicator enrichmentDomain, IP or hash · 6 credits Weekly executive briefMarkdown · 1 credit IOC blocklist exportFirewall or Pi-hole · 3 credits Lookup tool for LLM agentsTool call, cited · 5 credits All 10 recipes
Start from your industry
We ingest news, vendor research, government advisories, CVE and exploit data and ransomware leak sites, then tag every incident with the sectors it hit. Pick yours to see what is aimed at it right now.
HealthcareHospitals, payers, labs and medical device makers. Financial servicesBanks, fintech and payment infrastructure. ManufacturingOT, ICS and industrial supply chains. TelecommunicationsCarriers, subsea cable and network kit. DefenceContractors and the cleared supply chain. TechnologySaaS, software and the dependencies you ship. EducationUniversities, colleges and multi-academy trusts. AerospaceAirlines, airports, MRO, avionics and space.
Pricing
Every account gets a free key. Paid plans add history, headroom and the write endpoints. Cancel any time.
Free $0 100 credits a day, the last 7 days
- Every read endpoint: incidents, IOCs, entities, vulnerabilities, dark web
- 30 requests a minute, 25 rows a request
- Public feeds and the IOC blocklist need no key at all
Starter $19.99/ month 1,000 credits a day, 90 days of history
- 120 requests a minute, 50 rows a request
- Custom feeds and alert rules over the API
- Internal business use
Growth $99/ month 5,000 credits a day, the full archive
- 240 requests a minute, 100 rows a request
- Everything in Starter
- The complete corpus back to launch, not a rolling window
Business From $399/ month No daily budget, unlimited rows
- 600 requests a minute, per-key overrides
- Managed customers: per-client feeds, alerts and branded digests
- Org sharing. Redistribution by agreement
Need more on a given day? Credit packs: 2,000 for $10 or 12,000 for $50. One-off, never expire, spent after the daily allowance. A request that finds nothing costs nothing. Full pricing and what each request costs.
FAQ
What does the free key include?
Every read scope over the last 7 days with 100 credits a day: incidents, IOCs, entities, vulnerabilities and dark web. Records are trimmed to the short summary, 3 timeline events and 25 rows per list.
Most calls cost 1 credit. The heavier ones cost more: unified search is 5, STIX bundles and bulk indicator pulls are 3, and a fully enriched leak-site victim record is 10. The budget resets daily.
How fresh is it?
Incidents form within minutes of the first credible report and indicators are validated on ingest.
The lead-time number is measured, not estimated: for every incident that later appeared in the trade press, we compare the timestamp our record was created with the earliest matching trade-press article, and take the median across the matched pairs over the last 90 days. Right now that is 5.1 days, from 82 matched incidents.
How does an incident record get made?
Articles from 20,000+ sources are deduplicated into one cluster per incident as reports arrive. Each record carries a rewritten title and summary, the extracted entities (actors, malware, CVEs, victims), a sourced timeline and a threat score, and it keeps updating as coverage grows. One id to follow instead of twenty headlines.
Where does the dark-web data come from?
Our own Tor collection of leak sites, markets and underground postings, with screenshots, extracted data sizes and negotiation state. Not resold from a broker.
What formats can I pull?
JSON everywhere, STIX 2.1 bundles per incident, MISP feeds, and CSV or plain-text blocklists from the indicator feeds. The public feeds are also available as RSS, and incident pages exist as .md and .json for LLM context windows.
Are there code examples?
Yes. The GitHub repository has a daily-refreshed OpenAPI snapshot, a small Python client and real request/response pairs for every major endpoint, and the live spec is browsable as Swagger UI.
Can I redistribute the data?
The free feeds are TLP:CLEAR, redistribute with attribution. Keyed responses are for your own tooling. Embedding them in a product you sell, or redistributing them to your own customers, is by agreement on the Business plan.
Can I cancel?
Plans are monthly with no minimum term. Cancel from settings and the key keeps working until the end of the period. The free key never expires.
Get started
The whole surface is in the spec: 70+ endpoints over incidents, IOCs, entities, vulnerabilities and the dark web. Mint a free key and make the first call in a minute.