Over 590,000 vetted threat intelligence artefacts, one URL away from your code or your agent.
20,000+ sources plus first-party dark-web collection, deduplicated into scored incident records, validated IOCs and leak-site victims — served over MCP or the REST API behind one free key.
As seen on
Three ways to tap into threat intelligence
Connect an agentOne MCP endpoint, ten tools. Claude, Cursor, VS Code or anything that speaks MCP. Nothing to install. Call the API70+ REST endpoints over incidents, indicators, entities, CVEs and the dark web. JSON, STIX, CSV. Read the feedThe same corpus as a scored, deduplicated news feed. Every incident once, with its sources and timeline.
Threat intelligence for the agentic era
One MCP endpoint, ten tools: search incidents, pull a cluster's IOCs, list leak-site victims, look up entities and CVEs, check what's trending and what's left of your budget. Every call reports its credit cost back to the model, so an agent can pace itself. Watch it work:
Threat intelligence
We found this IP in an alert, is it malicious? 210.1.231.13
Working with ThreatCluster Used ThreatCluster lookup_entity, get_threat- Looking up 210.1.231.13
lookup_entity - Pulling the incident record behind it
get_threat
Yes. Treat it as malicious, high confidence.
15 Sep 2026First and last seen
BambooTokenC2 family
5Related IPs to sweep
| Check | Result |
|---|---|
| Resolves | turbo.c2iznja.com — the C2's own resolution, not an incidental mention |
| Reported by | Lumen Black Lotus Labs, corroborated by BleepingComputer and The Hacker News |
| Record | ThreatCluster record for 210.1.231.13 ↗ |
BambooToken is a Windows/Linux implant that uses MQTT for C2. It is unusual enough that most egress monitoring ignores it, common enough in IoT estates that it is not automatically suspicious. Active since Feb 2023, targeting finance and government across Asia and South America.
Triage
Direction and port.
Outbound to 1883 or 8883 from an internal host is the signal. Inbound scanning is not.Pivot on the domains.
Infrastructure rotates, so the IP may go cold while *.c2iznja.com and *.chat5188.tk stay live. Hunt DNS for both.Sweep related infrastructure.
202.144.192.13, 202.144.192.23, 210.1.226.163, 43.245.198.195, 38.180.150.19.A block is safe; a compromise verdict is not. C2 infrastructure in an alert does not mean the host is infected — that depends on direction, volume and whether a session was established. Outbound and sustained: isolate.
Has anyone in manufacturing been hit this week?
Working with ThreatCluster Used ThreatCluster leak_site_victims, search_threats- Searching leak-site listings from the last 7 days
leak_site_victims - Grouping 182 claims by sector, country and group
- Searching reporting beyond the leak sites
search_threats
Yes. Manufacturing is the most-hit sector this week, by a wide margin.
43of 182 listings this week
ManufacturingTop sector this week
thegentlemenMost active group (32)
A quarter of all claims in the last seven days. The US leads with 58 listings across all sectors, then India (10), Germany (7), Japan (7). Most active groups: thegentlemen (32), qilin (18), krybit (13), auditteam (11), safepay (10).
Notable claims
| Victim | Group | Listed |
|---|---|---|
| Nippon Steel Corporation (JP) — Japan's largest steelmaker | metaencryptor | 15 Sep |
| Kimberly-Clark (US) | shinyhunters | 13 Sep |
| Honda (Peru) | panzer | 15 Sep |
| SFA Engineering (KR) — semiconductor equipment | metaencryptor | 15 Sep |
| Taurus Ibérica (ES) | qilin | 15 Sep |
The bulk were mid-market industrial suppliers: Foremost Mfg, Glasfloss, Steelhaus, Marlin HVAC, Pilot Precision (US); Neumerkel GmbH (DE); Gilco Scaffolding (GB); Hashimoto Jimuki (JP); Cumar Marble & Granite (TR).
Beyond the leak sites
AI-driven attacks on exposed ICS/PLCs 14 Sep · score 71.5
Canadian Cyber Centre warning; manufacturing named alongside utilities, energy, food.Russian AI-driven espionage against Ukrainian drone makers 12 Sep · score 77.9
GTG-20006, 20+ organisations, via phishing.These are claims posted by the groups, not confirmed breaches. Treat them as leads to verify.
What's the biggest incident right now?
Working with ThreatCluster Used ThreatCluster newest_threats, get_threat- Ranking the last 7 days by threat score
newest_threats - Opening the Cisco Secure FMC record
get_threat
Cisco Secure FMC under active exploitation: the highest-scoring incident over both 24 hours and 7 days.
88.25Threat score, top of the corpus
36Articles since 9 Sep
CVE-2026-20079CVSS 10.0 authentication bypass
| CVE | CVSS | What |
|---|---|---|
CVE-2026-20079 | 10.0 | Unauthenticated remote authentication bypass. Published 4 Mar. |
CVE-2026-20316 | n/a | Hard-coded credentials (CWE-798). Published 29 Jul. |
Why it's the biggest
It is the security control itself.
FMC is the firewall management plane, so compromise gives root and the power to rewrite policy downstream.State and criminal actors at once.
Sandworm / GRU Unit 74455 alongside Qilin ransomware, the same Qilin posting leak-site victims this week.A perfect-score bypass with a credential backdoor beside it.
No user interaction, no authentication.Post-exploitation: root, backdoor, credential dumping (T1003), lateral movement over remote services (T1021), pass-the-hash via Impacket and WinRM against AD, ADFS, Kerberos and LDAP. Malware: PivotC2 RAT, Cyclops Blink, Lumma Stealer, Vidar.
Runners-up
Cisco Secure Email Gateway zero-day 14 Sep · score 82.25
CVE-2026-76461, SQLi to root. Second Cisco perimeter product in a week.GitLab exploited within hours 11 Sep · score 81 · 82 articles
CVE-2026-85706, CVSS 10.0, weaponised same day.If you act on one thing: both Cisco products are internet-facing with active exploitation and a CVSS-10-class bypass. That is this week's patch queue.
What do you know about Midnight Blizzard?
Working with ThreatCluster Used ThreatCluster lookup_entity, search_threats- Opening the actor profile
lookup_entity - Pulling the clusters that mention it
search_threats
Russian SVR-attributed espionage actor. Active reporting up to three days ago.
15Clusters in the corpus
27Mentions
GTG-20006Latest activity tracker
Tracked under a cluster of names that all point at the same operation: APT29, Cozy Bear, The Dukes, and for the latest activity the tracker GTG-20006. Full profile: ThreatCluster record for Midnight Blizzard ↗.
What they're doing now
The live story is the Russian AI-driven espionage campaign (12 Sep, score 77.9, 20 articles): GTG-20006 using commercial AI tooling to automate espionage against 20+ organisations in Ukraine and Europe, government officials, military personnel and drone manufacturers, via phishing. Coverage: Kyiv Independent, The Guardian, United24.
Also in: APT28's Zimbra exploitation against Ukraine (19 Mar, 80.9, their highest-scoring cluster), the critical Zimbra RCE (19 Aug, 79), and Microsoft's record 974-vulnerability Patch Tuesday.
Tradecraft and targeting
Phishing (T1566) first, then credential dumping (T1003), exfiltration over C2 (T1041) and web services (T1567). Tooling in-corpus: CloudSyncSvc, ClickFix, BoxOfFriends, CompactGopher. Targets: Government first, then Energy, Technology, Healthcare, Financial. Platform focus is the Microsoft estate: M365, Entra ID, Azure, Windows.
The corpus lists APT29, Cozy Bear, The Dukes and Midnight Blizzard as related entities rather than merged aliases, so counts under each name are partial. Union them for a true total.
Get a free API keyAdd to Claude
Also works inChatGPTCursorVS CodeAll integrations →
What the API returns
70+ endpoints over incidents, IOCs, entities, vulnerabilities, the dark web, and the feeds, alerts and webhooks you run through the API. Pick an endpoint and a language, and see the real response.
Incident records, deduplicated from every source that covered them
GET /threats?time_filter=24hcurl -H "X-API-Key: $TC_KEY" \
"https://threatcluster.io/api/public/v1/threats?time_filter=24h"import requests
r = requests.get("https://threatcluster.io/api/public/v1/threats?time_filter=24h",
headers={"X-API-Key": TC_KEY})
print(r.json())const r = await fetch("https://threatcluster.io/api/public/v1/threats?time_filter=24h",
{headers: {"X-API-Key": process.env.TC_KEY}});
console.log(await r.json());{
"threats": [
{
"cluster_id": "5f578c75-abf8-4fbd-915b-d4037386092f",
"title": "Iranian cyber spies target aviation, fintech developers with new malware",
"ai_title": "Mirage Kitten Targets Aviation and FinTech with New Cross-Platform Malware",
"ai_summary": "The Iranian cyberespionage group Mirage Kitten has launched a campaign targeting technology professionals in the aviation and FinTech sectors across…",
"timeline": [
{
"date": "2026-09-01",
"event": "New malware families identified",
"detail": "Kaspersky reported on the discovery of NodeRabbit and PollCat used by Mirage Kitten to ta…",
"source": "Securelist"
}
],
"article_count": 3,
"threat_score": 78.5,
"severity_score": 80.0,
"urgency_level": "medium",
"keywords": [
"malware",
"iranian"
],
"sources": [
"Thehackernews",
"Therecord.Media"
],
"date_range_latest": "2026-09-01T13:08:58+00:00",
"articles": [
{
"title": "Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new m…",
"source": "Securelist",
"pub_date": "2026-09-01T07:00:26+00:00",
"url": "https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244/"
}
],
"entities": {
"apt_group": [
"Iranian Dream Job",
"Lazarus Group"
],
"attack_type": [
"Malware",
"Phishing"
]
},
"slug": "mirage-kitten-targets-aviation-and-fintech-with-new-cross-pl-7386092f",
"ioc_count": 12
},
{
"cluster_id": "afb356a7-d498-4c89-920a-44025c9b39fa",
"title": "CPAI-2026-10671 - Check Point Software",
"ai_title": "Multiple Remote Code Execution Vulnerabilities Identified in Check Point Software",
"ai_summary": "Check Point Software has issued advisories for two critical remote code execution vulnerabilities. The first, CVE-2026-53576, was published on June 2…",
"timeline": [
{
"date": "2026-06-11",
"event": "CVE-2026-44495 published",
"detail": "Check Point disclosed a remote code execution vulnerability affecting its Security Gatewa…",
"source": "Advisories.Checkpoint"
}
],
"article_count": 2,
"threat_score": 74.0,
"severity_score": 80.0,
"urgency_level": "medium",
"keywords": [
"protection",
"update"
],
"sources": [
"Advisories.Checkpoint"
],
"date_range_latest": "2026-08-31T18:52:57+00:00",
"articles": [
{
"title": "CPAI-2026-10476 - Check Point Software",
"source": "Advisories.Checkpoint",
"pub_date": "2026-08-30T19:04:16+00:00",
"url": "https://advisories.checkpoint.com/defense/advisories/public/2026/cpai-2026-10476.html"
}
],
"entities": {
"attack_type": [
"Zero-Day Exploit"
],
"cve": [
"CVE-2026-44495",
…Indicators validated on ingest, with the incidents behind them
GET /entities/ipv4/172.86.98.113curl -H "X-API-Key: $TC_KEY" \
"https://threatcluster.io/api/public/v1/entities/ipv4/172.86.98.113"import requests
r = requests.get("https://threatcluster.io/api/public/v1/entities/ipv4/172.86.98.113",
headers={"X-API-Key": TC_KEY})
print(r.json())const r = await fetch("https://threatcluster.io/api/public/v1/entities/ipv4/172.86.98.113",
{headers: {"X-API-Key": process.env.TC_KEY}});
console.log(await r.json());{
"entity": {
"entity_type": "ipv4",
"entity_value": "172.86.98.113",
"frequency": 3,
"first_seen": "2026-07-28T08:00:20+00:00",
"last_seen": "2026-08-26T13:14:45.486953+00:00",
"confidence": "false_positive",
"reason": "MISP warninglist: Specialized list of vpn-ipv4 addresses belonging to common VPN provider…"
},
"clusters": [
{
"cluster_id": "93bf14f2-0238-400a-a0c0-75d8682fb07b",
"title": "Tortoiseshell Expands Malware Toolset With New Backdoor, SSH Tunnel",
"ai_title": "Tortoiseshell Expands Malware Arsenal with New Backdoor and SSH Tunneling Tool",
"ai_summary": "The Iranian-linked Tortoiseshell APT group has expanded its malware toolkit, introducing a new backdoor and reverse SSH tunneling utility. Group-IB T…",
"article_count": 6,
"threat_score": 77.0,
"severity_score": 80.0,
"date_range_latest": "2026-08-26T14:30:00+00:00",
"slug": "tortoiseshell-apt-expands-malware-capabilities-with-new-tool-682fb07b"
},
{
"cluster_id": "c6981ff6-0654-4b96-abfc-7934c099231a",
"title": "Cybersecurity Researchers Uncover Mirage Kitten Malware Sweeping Across Africa",
"ai_title": "Mirage Kitten Malware Targets Middle East and Africa with New Toolset",
"ai_summary": "The Mirage Kitten APT group has deployed a sophisticated malware suite, including the NightLedger backdoor, across the Middle East and Africa. This c…",
"article_count": 2,
"threat_score": 75.5,
"severity_score": 80.0,
"date_range_latest": "2026-07-30T06:15:08+00:00",
"slug": "cybersecurity-researchers-uncover-mirage-kitten-malware-swee-c099231a"
}
],
"articles": [
{
"title": "Securelist",
"source": "securelist.com",
"pub_date": "2026-08-26T13:14:45.486953+00:00",
"url": "https://securelist.com/mirage-kitten-new-tools/120811/?kaspr=5bet"
},
{
"title": "Tortoiseshell: New Toolset and Operational Infrastructure Exposed | Group",
"source": "Group-Ib",
"pub_date": "2026-08-26T09:32:20+00:00",
"url": "https://www.group-ib.com/blog/tortoiseshell-apt-toolset-infrastructure/"
}
],
"co_entities_with_counts": {
"apt_group": [
{
"value": "Mirage Kitten",
"count": 3
}
],
"attack_type": [
{
"value": "Malware",
"count": 3
}
],
"platform": [
{
"value": "Windows",
"count": 3
}
],
"malware": [
{
"value": "Twostroke",
"count": 2
}
]
},
"aliases": []
}Leak sites, markets and postings from our own Tor collection
GET /darkweb/keyword-hits?keywords=Intracocurl -H "X-API-Key: $TC_KEY" \
"https://threatcluster.io/api/public/v1/darkweb/keyword-hits?keywords=Intraco"import requests
r = requests.get("https://threatcluster.io/api/public/v1/darkweb/keyword-hits?keywords=Intraco",
headers={"X-API-Key": TC_KEY})
print(r.json())const r = await fetch("https://threatcluster.io/api/public/v1/darkweb/keyword-hits?keywords=Intraco",
{headers: {"X-API-Key": process.env.TC_KEY}});
console.log(await r.json());{
"keywords": [
"Intraco"
],
"hits": {
"victims": [
{
"id": "bdd665d27f502e10",
"victim_name": "PT Intraco Penta Tbk",
"group_name": "direwolf",
"country": "ID",
"sector": "Manufacturing",
"discovered": "2026-09-01T15:53:54.238628+00:00"
}
],
"groups": [],
"markets": [],
"breaches": []
},
"total": 2
}Groups, malware, CVEs and companies as one linked record each
GET /entities/ransomware_group/Qilincurl -H "X-API-Key: $TC_KEY" \
"https://threatcluster.io/api/public/v1/entities/ransomware_group/Qilin"import requests
r = requests.get("https://threatcluster.io/api/public/v1/entities/ransomware_group/Qilin",
headers={"X-API-Key": TC_KEY})
print(r.json())const r = await fetch("https://threatcluster.io/api/public/v1/entities/ransomware_group/Qilin",
{headers: {"X-API-Key": process.env.TC_KEY}});
console.log(await r.json());{
"entity": {
"entity_type": "ransomware_group",
"entity_value": "Qilin",
"frequency": 202,
"first_seen": "2025-10-23T10:00:58+00:00",
"last_seen": "2026-08-28T04:41:40+00:00"
},
"overview": "Qilin is a hacking group associated with ransomware activities, known for deploying malware to encrypt victims’ data and demanding ransom payments. C…",
"clusters": [
{
"cluster_id": "ed358032-faeb-477c-a14e-91043243f6d9",
"title": "Akira Ransomware Group Poses ‘Imminent Threat’ to Critical Infrastructure: CISA",
"ai_title": "Akira Ransomware Group Targets Critical Infrastructure, Extracts $42 Million",
"ai_summary": "The Akira ransomware group has been identified as a significant threat to critical infrastructure, with the U.S. Cybersecurity and Infrastructure Sec…",
"article_count": 9,
"threat_score": 82.98,
"severity_score": 81.0,
"date_range_latest": "2025-11-14T06:57:11+00:00",
"slug": "akira-ransomware-group-targets-critical-infrastructure-extra-3243f6d9"
},
{
"cluster_id": "ed641903-140b-473f-ac63-c68536ffb106",
"title": "Pharma Firm Inotiv Confirms Data Breach Following Ransomware Attack",
"ai_title": "Inotiv Confirms Data Breach from August 2025 Ransomware Attack",
"ai_summary": "Inotiv, an Indiana-based pharmaceutical firm, has confirmed a data breach resulting from a ransomware attack that occurred in August 2025. The compan…",
"article_count": 4,
"threat_score": 78.81,
"severity_score": 75.0,
"date_range_latest": "2025-12-08T07:52:53+00:00",
"slug": "inotiv-confirms-data-breach-from-august-2025-ransomware-atta-36ffb106"
}
],
"articles": [
{
"title": "Two TeamPCP members arrested in Australia",
"source": "News.Risky.Biz",
"pub_date": "2026-08-28T04:41:40+00:00",
"url": "https://news.risky.biz/risky-bulletin-two-teampcp-members-arrested-in-australia/"
},
{
"title": "6054150 Atf Investigating Cybersecurity Incident Doj Qilin",
"source": "thehill.com",
"pub_date": "2026-08-27T18:34:38.113720+00:00",
"url": "https://thehill.com/homenews/administration/6054150-atf-investigating-cybersecurity-incident-doj-qi…"
}
],
"co_entities_with_counts": {
"attack_type": [
{
"value": "Ransomware",
"count": 180
}
],
"ransomware_group": [
{
"value": "Akira",
"count": 53
}
],
"industry": [
{
"value": "Government",
"count": 35
}
],
"platform": [
{
"value": "Windows",
"count": 31
}
]
},
"aliases": []
}One term across incidents, indicators, entities and leak sites
GET /search?q=Intracocurl -H "X-API-Key: $TC_KEY" \
"https://threatcluster.io/api/public/v1/search?q=Intraco"import requests
r = requests.get("https://threatcluster.io/api/public/v1/search?q=Intraco",
headers={"X-API-Key": TC_KEY})
print(r.json())const r = await fetch("https://threatcluster.io/api/public/v1/search?q=Intraco",
{headers: {"X-API-Key": process.env.TC_KEY}});
console.log(await r.json());{
"query": "Intraco",
"clusters": [],
"entities": [],
"darkweb": [
{
"type": "victim",
"name": "PT Intraco Penta Tbk",
"id": "bdd665d27f502e10",
"date": "2026-09-01T15:53:54.238628+00:00",
"group": "direwolf",
"country": "ID",
"sector": "Manufacturing"
}
],
"limit": 10,
"total": 1
}A cited answer, from the reporting itself
POST /threats/windows-afdsys-zero-f15d3d54/ask
{"action": "recommended_actions"}curl -X POST -H "X-API-Key: $TC_KEY" -H "Content-Type: application/json" \
-d '{"action": "recommended_actions"}' \
"https://threatcluster.io/api/public/v1/threats/windows-afdsys-zero-f15d3d54/ask"import requests
r = requests.post("https://threatcluster.io/api/public/v1/threats/windows-afdsys-zero-f15d3d54/ask",
headers={"X-API-Key": TC_KEY}, json={"action": "recommended_actions"})
print(r.json())const r = await fetch("https://threatcluster.io/api/public/v1/threats/windows-afdsys-zero-f15d3d54/ask", {
method: "POST", headers: {"X-API-Key": TC_KEY, "Content-Type": "application/json"},
body: JSON.stringify({"action": "recommended_actions"}) });
console.log(await r.json());{
"answer": "**Patch first.** Apply the AFD.sys fix from the February cumulative update; the exploited build range is 10.0.19041–22631 [A1].\n- **Detection** — hunt for afd.sys crash events (0x7E) preceding new service creation [A2] [A3].\n- **Containment** — Lazarus tooling stages via a signed loader; block the listed hashes at the EDR [A4].\n- ...",
"sources": [ {"tag": "A1", "title": "Microsoft: CVE-2026-… actively exploited", "url": "https://…"}, {"tag": "A2", "title": "…"} ],
"context_used": {"cluster_title": "Lazarus Group Exploits Windows Zero-Day to Target Defense Sector", "primary_articles_used": 7, "cves_enriched": 1},
"cost": 25,
"cached": false
}Your stack, your suppliers, your webhooks: monitoring you run through the API
POST /feeds
{"name": "Our stack", "entities": [{"keyword": "FortiOS", "entity_type": "platform"}, {"keyword": "Okta", "entity_type": "company"}, {"keyword": "Ivanti", "entity_type": "company"}]}curl -X POST -H "X-API-Key: $TC_KEY" -H "Content-Type: application/json" \
-d '{"name": "Our stack", "entities": [{"keyword": "FortiOS", "entity_type": "platform"}, {"keyword": "Okta", "entity_type": "company"}, {"keyword": "Ivanti", "entity_type": "company"}]}' \
"https://threatcluster.io/api/public/v1/feeds"import requests
r = requests.post("https://threatcluster.io/api/public/v1/feeds",
headers={"X-API-Key": TC_KEY}, json={"name": "Our stack", "entities": [{"keyword": "FortiOS", "entity_type": "platform"}, {"keyword": "Okta", "entity_type": "company"}, {"keyword": "Ivanti", "entity_type": "company"}]})
print(r.json())const r = await fetch("https://threatcluster.io/api/public/v1/feeds", {
method: "POST", headers: {"X-API-Key": TC_KEY, "Content-Type": "application/json"},
body: JSON.stringify({"name": "Our stack", "entities": [{"keyword": "FortiOS", "entity_type": "platform"}, {"keyword": "Okta", "entity_type": "company"}, {"keyword": "Ivanti", "entity_type": "company"}]}) });
console.log(await r.json());{
"feed_id": "17ae839a-a413-4c6b-91a5-b2b830f09699",
"name": "Our stack",
"mssp_customer_id": null,
"keywords_added": 3
}GET /threats?time_filter=7d&sort_by=score{
"threats": [
{
"cluster_id": "32e38748-219f-4340-853f-7c4593fb80f8",
"title": "Chinese Speaking Operator Philippine Nuclear Naval Contractor",
"ai_title": "Chinese Operator Breaches Philippine Nuclear and Naval Entities",
"ai_summary": "A suspected Chinese-speaking operator has compromised a Philippine nuclear research body and a marine engineering company supporting the Philippine N…",
"timeline": [
{
"date": "2023-11-21",
"event": "CVE-2023-49105 published",
"detail": "Authentication-bypass flaw in ownCloud allows unauthorized file access via WebDAV.",
"source": "Article 2"
}
],
"article_count": 4,
"threat_score": 80.7,
"severity_score": 81.0,
"urgency_level": "medium",
"keywords": [
"philippine",
"nuclear"
],
"sources": [
"hunt.io",
"Securityaffairs.Co"
],
"date_range_latest": "2026-08-31T12:34:31.263942+00:00",
"articles": [
{
"title": "Philippine Nuclear and Naval Targets Hit by Suspected Chinese Operator",
"source": "Securityaffairs.Co",
"pub_date": "2026-08-29T09:16:52+00:00",
"url": "https://securityaffairs.com/198041/intelligence/philippine-nuclear-and-naval-targets-hit-by-suspect…"
}
],
"entities": {
"attack_type": [
"Data Breach"
],
"campaign": [
"Operation CameraSwarm"
]
},
"slug": "chinese-speaking-actor-breaches-philippine-nuclear-and-naval-93fb80f8",
"ioc_count": 4
},
{
"cluster_id": "5f578c75-abf8-4fbd-915b-d4037386092f",
"title": "Iranian cyber spies target aviation, fintech developers with new malware",
"ai_title": "Mirage Kitten Targets Aviation and FinTech with New Cross-Platform Malware",
"ai_summary": "The Iranian cyberespionage group Mirage Kitten has launched a campaign targeting technology professionals in the aviation and FinTech sectors across…",
"timeline": [
{
"date": "2026-09-01",
"event": "New malware families identified",
"detail": "Kaspersky reported on the discovery of NodeRabbit and PollCat used by Mirage Kitten to ta…",
"source": "Securelist"
}
],
"article_count": 3,
"threat_score": 78.5,
"severity_score": 80.0,
"urgency_level": "medium",
"keywords": [
"malware",
"iranian"
],
"sources": [
"Thehackernews",
"Therecord.Media"
],
"date_range_latest": "2026-09-01T13:08:58+00:00",
"articles": [
{
"title": "Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new m…",
"source": "Securelist",
"pub_date": "2026-09-01T07:00:26+00:00",
"url": "https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244/"
}
],
"entities": {
"apt_group": [
"Iranian Dream Job",
"Lazarus Group"
],
"attack_type": [
"Malware",
…
GET /threats?keyword=Windows{
"threats": [
{
"cluster_id": "93bf14f2-0238-400a-a0c0-75d8682fb07b",
"title": "Tortoiseshell Expands Malware Toolset With New Backdoor, SSH Tunnel",
"ai_title": "Tortoiseshell Expands Malware Arsenal with New Backdoor and SSH Tunneling Tool",
"ai_summary": "The Iranian-linked Tortoiseshell APT group has expanded its malware toolkit, introducing a new backdoor and reverse SSH tunneling utility. Group-IB T…",
"timeline": [
{
"date": "2026-08-26",
"event": "Group-IB publishes findings on Tortoiseshell",
"detail": "Group-IB identified new malware samples and infrastructure linked to Tortoiseshell, revea…",
"source": "Group-IB"
}
],
"article_count": 6,
"threat_score": 77.0,
"severity_score": 80.0,
"urgency_level": "medium",
"keywords": [
"tortoiseshell",
"toolset"
],
"sources": [
"Infosecurity-Magazine",
"Gbhackers"
],
"date_range_latest": "2026-08-26T14:30:00+00:00",
"articles": [
{
"title": "Tortoiseshell: New Toolset and Operational Infrastructure Exposed | Group",
"source": "Group-Ib",
"pub_date": "2026-08-26T09:32:20+00:00",
"url": "https://www.group-ib.com/blog/tortoiseshell-apt-toolset-infrastructure/"
}
],
"entities": {
"apt_group": [
"GalaxyGato",
"Imperial Kitten"
],
"attack_type": [
"Data Breach",
"Malware"
]
},
"slug": "tortoiseshell-apt-expands-malware-capabilities-with-new-tool-682fb07b",
"ioc_count": 10
},
{
"cluster_id": "2984a6af-53aa-42eb-b22d-e01373643c61",
"title": "Suspected China-linked espionage campaign targets India's finance ecosystem: Seqrite",
"ai_title": "China-Linked Cyber Espionage Targets India's Tax Ecosystem",
"ai_summary": "Seqrite has reported a cyber-espionage campaign named Operation DragonReturn, targeting India's taxpayer ecosystem by impersonating the Income Tax De…",
"timeline": [
{
"date": "2026-08-31",
"event": "Seqrite discloses Operation DragonReturn",
"detail": "Seqrite reveals a cyber-espionage campaign targeting India's tax ecosystem, leveraging ph…",
"source": "Crnasia"
}
],
"article_count": 2,
"threat_score": 76.25,
"severity_score": 80.0,
"urgency_level": "medium",
"keywords": [
"campaign",
"seqrite"
],
"sources": [
"Crnasia",
"Itvoice.In"
],
"date_range_latest": "2026-08-31T07:05:10+00:00",
"articles": [
{
"title": "Seqrite Uncovers China-Linked Cyber Espionage Campaign Targeting India's Tax Ecosystem",
"source": "Itvoice.In",
"pub_date": "2026-08-31T07:00:01+00:00",
"url": "https://www.itvoice.in/seqrite-uncovers-operation-dragonreturn-china-nexus-cyber-espionage-campaign…"
}
],
"entities": {
"attack_type": [
"Malware",
"Phishing"
],
…
GET /threats?keyword=NASA{
"threats": [
{
"cluster_id": "466996d6-4a06-43a7-af8c-116354a06405",
"title": "US officials backpedal on claims that government agencies were hacked by Chinese",
"ai_title": "US Officials Clarify Cyberattack Claims Involving Chinese Hackers",
"ai_summary": "On August 28, 2026, U.S. officials revised previous statements claiming that several government agencies were hacked by Chinese spies. The Justice De…",
"timeline": [
{
"date": "2026-08-25",
"event": "Initial claims of hacking made",
"detail": "U.S. officials initially claimed that multiple government agencies had been hacked by Chi…",
"source": "Databreaches"
}
],
"article_count": 6,
"threat_score": 43.0,
"severity_score": 41.0,
"urgency_level": "medium",
"keywords": [
"officials",
"claims"
],
"sources": [
"Databreaches",
"Straitstimes"
],
"date_range_latest": "2026-08-29T15:02:26+00:00",
"articles": [
{
"title": "US officials backpedal on claims that government agencies were hacked by Chinese, now ...",
"source": "Straitstimes",
"pub_date": "2026-08-29T09:17:02+00:00",
"url": "https://www.straitstimes.com/world/united-states/us-officials-backpedal-on-claims-that-government-a…"
}
],
"entities": {
"apt_group": [
"QTFY"
],
"attack_type": [
"Data Breach"
]
},
"slug": "us-officials-clarify-cyberattack-claims-involving-chinese-ha-54a06405",
"ioc_count": 0
}
],
"count": 1,
"limit": 50,
"offset": 0,
"time_filter": "7d",
"sort_by": "trending"
}
GET /threats?keyword=healthcare{
"threats": [
{
"cluster_id": "3c37d8bc-d676-48ec-aabd-a7fe732cdfd2",
"title": "Attack hides malware in PNGs and drops custom reverse tunnel on victims' machines",
"ai_title": "Healthcare Cyberattacks Disrupt Patient Care and Expose Sensitive Data",
"ai_summary": "Two major healthcare companies, Boston Scientific and Nutex Health, reported cyberattacks that compromised patient data and disrupted operations. Bos…",
"timeline": [
{
"date": "2026-08-24",
"event": "Nutex Health discloses cyberattack",
"detail": "Nutex confirmed unauthorized access to sensitive patient and employee data, with threats…",
"source": "Article 4"
}
],
"article_count": 4,
"threat_score": 71.0,
"severity_score": 80.0,
"urgency_level": "medium",
"keywords": [
"researcher",
"shows"
],
"sources": [
"Theregister"
],
"date_range_latest": "2026-08-31T18:26:03+00:00",
"articles": [
{
"title": "Anthropic cracks down on hijacked user accounts mining AI tokens",
"source": "Theregister",
"pub_date": "2026-08-31T16:03:46+00:00",
"url": "https://www.theregister.com/security/2026/08/31/anthropic-cracks-down-on-hijacked-user-accounts-min…"
}
],
"entities": {
"attack_type": [
"Data Breach",
"Malware"
],
"campaign": [
"ClickFix",
"TerminalFix"
]
},
"slug": "new-malware-campaign-exploits-pngs-and-infostealers-for-acco-732cdfd2",
"ioc_count": 0
},
{
"cluster_id": "468a50ef-290c-4ca4-bf97-0a645e837ef6",
"title": "9.5 Million Impacted by Aesto Health Data Breach",
"ai_title": "Aesto Health Data Breach Exposes 9.5 Million Patients' Information",
"ai_summary": "A data breach at Aesto Health, a healthcare technology company in Birmingham, Alabama, was discovered on December 18, 2025. The breach affected at le…",
"timeline": [
{
"date": "2025-12-02",
"event": "Unauthorized access began",
"detail": "Hackers accessed Aesto Health's AWS infrastructure, compromising sensitive data.",
"source": "Hipaajournal"
}
],
"article_count": 4,
"threat_score": 69.0,
"severity_score": 80.0,
"urgency_level": "medium",
"keywords": [
"aesto",
"health"
],
"sources": [
"www.aestohealth.com",
"Feeds.Feedburner"
],
"date_range_latest": "2026-09-01T09:16:19.170172+00:00",
"articles": [
{
"title": "Aesto Health Data Breach Affects 9.5 Million Patients",
"source": "Hipaajournal",
"pub_date": "2026-09-01T06:07:50+00:00",
"url": "https://www.hipaajournal.com/aesto-health-data-breach/"
}
],
"entities": {
"attack_type": [
"Data Breach"
],
"company": [
"Aesto Health",
…
GET /threats?keyword=Australia{
"threats": [
{
"cluster_id": "16404270-63df-4325-8911-ffbf6ff3f4df",
"title": "Two Alleged ‘TeamPCP’ Hackers Arrested in Australia",
"ai_title": "TeamPCP Hackers Arrested for Major Supply Chain Attacks",
"ai_summary": "On August 26, 2026, Australian Federal Police arrested two men, Ruben Thomson and Louis Gaebler, linked to the TeamPCP hacking group. This group is n…",
"timeline": [
{
"date": "2026-04-01",
"event": "Investigation into TeamPCP begins",
"detail": "The AFP and FBI started investigating TeamPCP after receiving information from cybersecur…",
"source": "BleepingComputer"
}
],
"article_count": 26,
"threat_score": 70.25,
"severity_score": 80.0,
"urgency_level": "medium",
"keywords": [
"arrested",
"cybercrime"
],
"sources": [
"Feeds.Feedburner",
"Abc.Au"
],
"date_range_latest": "2026-08-27T11:04:15+00:00",
"articles": [
{
"title": "Two Perth hackers charged after major AFP, FBI investigation into alleged global cybercrime",
"source": "Abc.Au",
"pub_date": "2026-08-27T05:45:10+00:00",
"url": "https://www.abc.net.au/news/2026-08-27/two-wa-men-charged-after-investigation-into-alleged-cybercri…"
}
],
"entities": {
"apt_group": [
"TeamPCP"
],
"attack_type": [
"Botnet",
"Data Breach"
]
},
"slug": "teampcp-hackers-arrested-in-australia-amid-global-cybercrime-6ff3f4df",
"ioc_count": 0
},
{
"cluster_id": "1e07dd9a-62c5-4a2a-8455-e6a64b7705b1",
"title": "Zbt Darklantern Speakingstone",
"ai_title": "Backdoors Found in ZBT Routers Sold Globally",
"ai_summary": "ZBT routers, widely sold under various brands, have been found to contain multiple backdoors, including 'SpeakingStone' and 'DarkLantern'. These impl…",
"timeline": [
{
"date": "2026-08-06",
"event": "Backdoor discovery announced",
"detail": "Jacob Baines revealed ZBT's router firmware contains a root-level backdoor named 'Endless…",
"source": "Darkreading"
}
],
"article_count": 5,
"threat_score": 64.25,
"severity_score": 70.0,
"urgency_level": "medium",
"keywords": [
"routers",
"chinese"
],
"sources": [
"www.vulncheck.com",
"Darkreading"
],
"date_range_latest": "2026-08-27T20:02:41.584871+00:00",
"articles": [
{
"title": "Chinese Routers Sold Worldwide Contain Backdoors",
"source": "Darkreading",
"pub_date": "2026-08-27T19:31:45+00:00",
"url": "https://www.darkreading.com/vulnerabilities-threats/chinese-routers-sold-worldwide-backdoors"
}
],
"entities": {
"attack_type": [
"Malware",
"Man-in-the-Middle"
],
"company": [
…
GET /threats?keyword=CVE-2026-46037{
"threats": [
{
"cluster_id": "da662236-d210-4fa9-8968-7b30cebb7ea4",
"title": "SUSE Kernel RT Security Update 2026-23264",
"ai_title": "Multiple SUSE Kernel RT Security Updates Address Critical Vulnerabilities",
"ai_summary": "SUSE has released a series of important security updates for its Linux Enterprise Kernel, addressing multiple vulnerabilities across various versions…",
"timeline": [
{
"date": "2026-02-14",
"event": "CVE-2026-23161 published",
"detail": "A race condition in mm/shmem and swap was disclosed, affecting memory management.",
"source": "Linuxsecurity"
}
],
"article_count": 40,
"threat_score": 67.25,
"severity_score": 70.0,
"urgency_level": "medium",
"keywords": [
"security",
"linux"
],
"sources": [
"Linuxsecurity"
],
"date_range_latest": "2026-08-26T16:51:07+00:00",
"articles": [
{
"title": "SUSE Linux Enterprise Kernel RT Important Security Update 2026-23267",
"source": "Linuxsecurity",
"pub_date": "2026-08-26T16:41:14+00:00",
"url": "https://linuxsecurity.com/advisories/suse/suse-2026-23267-1-kernel-rt"
}
],
"entities": {
"company": [
"SUSE"
],
"cve": [
"CVE-2023-53995",
"CVE-2025-40204"
],
"cwe": [
"CWE-122 - Heap-based Buffer Overflow",
"CWE-125 - Out-of-bounds Read"
],
"platform": [
"Linux",
"SUSE Linux Enterprise 15 SP7 RT Kernel"
]
},
"slug": "multiple-suse-kernel-rt-security-updates-address-critical-vu-cebb7ea4",
"ioc_count": 0
}
],
"count": 1,
"limit": 50,
"offset": 0,
"time_filter": "7d",
"sort_by": "trending"
}
GET /threats/93fb80f8{
"cluster_id": "32e38748-219f-4340-853f-7c4593fb80f8",
"title": "Chinese Speaking Operator Philippine Nuclear Naval Contractor",
"ai_title": "Chinese Operator Breaches Philippine Nuclear and Naval Entities",
"ai_summary": "A suspected Chinese-speaking operator has compromised a Philippine nuclear research body and a marine engineering company supporting the Philippine N…",
"timeline": [
{
"date": "2023-11-21",
"event": "CVE-2023-49105 published",
"detail": "Authentication-bypass flaw in ownCloud allows unauthorized file access via WebDAV.",
"source": "Article 2"
}
],
"article_count": 4,
"threat_score": 80.7,
"severity_score": 81.0,
"urgency_level": "medium",
"keywords": [
"philippine",
"nuclear",
"operator"
],
"sources": [
"hunt.io",
"Securityaffairs.Co"
],
"date_range_latest": "2026-08-31T12:34:31.263942+00:00",
"articles": [
{
"title": "Philippine Nuclear and Naval Targets Hit by Suspected Chinese Operator",
"source": "Securityaffairs.Co",
"pub_date": "2026-08-29T09:16:52+00:00",
"url": "https://securityaffairs.com/198041/intelligence/philippine-nuclear-and-naval-targets-hit-by-suspect…"
},
{
"title": "Chinese operator exploits a 3-year",
"source": "Pasqualepillitteri.It",
"pub_date": "2026-08-30T20:09:53+00:00",
"url": "https://pasqualepillitteri.it/en/news/13473/chinese-operator-philippine-nuclear-data-owncloud"
}
],
"entities": {
"attack_type": [
"Data Breach"
],
"campaign": [
"Operation CameraSwarm"
],
"company": [
"CGI Global Limited",
"Naval Contractor",
"Philippine Nuclear Agency"
],
"country": [
"Philippines",
"Russia",
"Ukraine"
]
},
"slug": "chinese-speaking-actor-breaches-philippine-nuclear-and-naval-93fb80f8"
}
GET /threats/93fb80f8/iocs{
"iocs": [
{
"type": "ipv4",
"value": "31.58.209.241",
"confidence": "high",
"reason": "IP address hosting stolen data and offensive tools"
},
{
"type": "domain",
"value": "fine-work-team.com",
"confidence": "high",
"reason": "Listed as a delivery URL for a malicious script"
}
],
"count": 4,
"cluster_id": "93fb80f8"
}
GET /threats/93fb80f8/stix{
"type": "bundle",
"id": "bundle--40db38a3-6c4f-4ffd-9a79-ceb3a8d00241",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d",
"created": "2026-09-01T17:46:29.497276Z",
"modified": "2026-09-01T17:46:29.497276Z",
"name": "ThreatCluster",
"description": "Automated threat intelligence aggregation and clustering platform",
"identity_class": "organization",
"sectors": [
"technology"
],
"contact_information": "https://threatcluster.io"
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--92a159b2-33b1-57f7-b60c-9f340bf16776",
"created_by_ref": "identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d",
"created": "2026-09-01T17:46:29.497716Z",
"modified": "2026-09-01T17:46:29.497716Z",
"name": "Mettle",
"malware_types": [
"unknown"
],
"is_family": true,
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
}
]
}
GET /vulnerabilities?kev_only=true&days=7{
"cves": [
{
"cve_id": "CVE-2026-82078",
"description": "An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperC…",
"cvss_v3_score": 9.1,
"cvss_v3_severity": "CRITICAL",
"affected_vendors": [
"papercut"
],
"affected_products": [
"papercut_mf",
"papercut_ng"
],
"cpe_configurations": [
{
"vendor": "papercut",
"product": "papercut_mf",
"criteria": "cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*",
"vulnerable": true,
"version_end": "24.1.9",
"version_end_op": "excluding"
}
],
"in_kev": true,
"has_exploit": false,
"epss_score": 0.0046,
"epss_percentile": 0.3826,
"published_date": "2026-08-28T16:18:31.240000",
"last_modified": "2026-09-01T04:18:02.160000"
},
{
"cve_id": "CVE-2026-81578",
"description": "An improper access control vulnerability exists in the web management interface of PaperCut MF and…",
"cvss_v3_score": 9.8,
"cvss_v3_severity": "CRITICAL",
"affected_vendors": [
"papercut"
],
"affected_products": [
"papercut_mf",
"papercut_ng"
],
"cpe_configurations": [
{
"vendor": "papercut",
"product": "papercut_mf",
"criteria": "cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*",
"vulnerable": true,
"version_end": "24.1.9",
"version_end_op": "excluding"
}
],
"in_kev": true,
"has_exploit": true,
"epss_score": 0.0039,
"epss_percentile": 0.324,
"published_date": "2026-08-28T16:18:29.600000",
"last_modified": "2026-09-01T04:18:01.990000"
}
],
"total": 3,
"page": 1,
"limit": 50,
"pages": 1,
"days": 7
}
GET /vulnerabilities?has_exploit=true{
"cves": [
{
"cve_id": "CVE-2026-82539",
"description": "A vulnerability was determined in TOTOLINK A720R 4.1.5cu.630_B20250509. This impacts the function s…",
"cvss_v3_score": 9.1,
"cvss_v3_severity": "CRITICAL",
"in_kev": false,
"has_exploit": true,
"epss_score": 0.006,
"epss_percentile": 0.4628,
"published_date": "2026-08-30T11:17:35.067000",
"last_modified": "2026-08-31T20:56:08.800000"
},
{
"cve_id": "CVE-2026-55511",
"description": "Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPr…",
"cvss_v3_score": 9.1,
"cvss_v3_severity": "CRITICAL",
"in_kev": false,
"has_exploit": true,
"epss_score": 0.0068,
"epss_percentile": 0.4996,
"published_date": "2026-08-28T20:18:27.947000",
"last_modified": "2026-09-01T02:16:58.397000"
}
],
"total": 51,
"page": 1,
"limit": 50,
"pages": 2,
"days": 30
}
GET /vulnerabilities/CVE-2026-46037{
"cve_id": "CVE-2026-46037",
"description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: icmp: validate reply typ…",
"cvss_v3_score": 8.2,
"cvss_v3_severity": "HIGH",
"affected_vendors": [
"linux"
],
"affected_products": [
"linux_kernel"
],
"cpe_configurations": [
{
"vendor": "linux",
"product": "linux_kernel",
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"version_end": "5.15.209",
"version_start": "5.13",
"version_end_op": "excluding",
"version_start_op": "including"
},
{
"vendor": "linux",
"product": "linux_kernel",
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"version_end": "6.1.175",
"version_start": "5.16",
"version_end_op": "excluding",
"version_start_op": "including"
}
],
"in_kev": false,
"has_exploit": false,
"epss_score": 0.0043,
"epss_percentile": 0.3614,
"published_date": "2026-05-27T14:17:23.027000",
"last_modified": "2026-06-17T10:52:56.583000",
"id": 15467161,
"cvss_v3_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"reference_urls": [
{
"url": "https://git.kernel.org/stable/c/67bf002a2d7387a6312138210d0bd06e3cf4879b",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/92e7c209036dcc0e8ffdf806fdfd3645b263bea5",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"exploit_count": 0,
"fetched_at": "2026-06-26T23:30:16.327186",
"epss_updated_at": "2026-09-01T05:00:08.133433"
}
GET /entities/domain/businesswire.com{
"entity": {
"entity_type": "domain",
"entity_value": "businesswire.com",
"frequency": 172,
"first_seen": "2026-03-30T14:34:29+00:00",
"last_seen": "2026-08-30T18:03:55+00:00",
"confidence": "false_positive",
"reason": "MISP warninglist: Top 1 000 000 websites from Cisco Umbrella"
},
"clusters": [
{
"cluster_id": "70c6fdc1-40ff-45f4-81a5-f71898a55c29",
"title": "Sygnia Reveals New Activity by China",
"ai_title": "Fire Ant Threat Actor Targets Trusted Infrastructure in 2026",
"ai_summary": "The China-nexus threat actor known as Fire Ant has evolved its tactics in 2026, transitioning from targeting VMware hypervisors to compromising trust…",
"article_count": 13,
"threat_score": 77.75,
"severity_score": 80.0,
"date_range_latest": "2026-08-30T18:03:55+00:00",
"slug": "china-nexus-threat-actor-fire-ant-targets-critical-infrastru-98a55c29"
},
{
"cluster_id": "8d40b34e-bcb7-4aff-b194-bae9df8632a5",
"title": "CrowdStrike 2026 Financial Services Threat Landscape Report",
"ai_title": "North Korean Cyber Adversaries Steal Billions from Financial Sector",
"ai_summary": "In 2025, North Korean-linked adversaries stole billions in digital assets, significantly impacting the financial services sector. The CrowdStrike 202…",
"article_count": 3,
"threat_score": 75.5,
"severity_score": 80.0,
"date_range_latest": "2026-05-14T17:06:57+00:00",
"slug": "north-korean-cyber-adversaries-steal-billions-from-financial-df8632a5"
}
],
"articles": [
{
"title": "Sygnia Reveals New Activity by China",
"source": "Morningstar",
"pub_date": "2026-08-30T18:03:55+00:00",
"url": "https://www.morningstar.com/news/business-wire/20260830433829/sygnia-reveals-new-activity-by-china-…"
},
{
"title": "Visa Expands Support for its Clients and the Industry as Organizations Navigate New AI Era ...",
"source": "Afp",
"pub_date": "2026-08-27T18:45:37+00:00",
"url": "https://www.afp.com/en/infos/visa-expands-support-its-clients-and-industry-organizations-navigate-n…"
}
],
"co_entities_with_counts": {
"attack_type": [
{
"value": "Phishing",
"count": 23
}
],
"mitre_attack": [
{
"value": "T1566 - Phishing",
"count": 19
}
],
"industry": [
{
"value": "Financial",
"count": 18
}
],
"country": [
{
"value": "United States",
"count": 10
}
]
},
"aliases": []
}
GET /entities/sha256/a9a71d111f2233634b91e0e08fe6b6f74a09f69e73ca09df1e9189594d1b1295{
"entity": {
"entity_type": "sha256",
"entity_value": "a9a71d111f2233634b91e0e08fe6b6f74a09f69e73ca09df1e9189594d1b1295",
"frequency": 2,
"first_seen": "2026-08-28T05:32:53.679219+00:00",
"last_seen": "2026-09-01T12:20:50.225501+00:00",
"confidence": "high",
"reason": "Listed among other hashes in a context suggesting they are malware samples"
},
"clusters": [
{
"cluster_id": "60b31b89-a1b3-4fb9-8b8c-46b1c18ccc2a",
"title": "PaperCut warns of NG, MF flaw exploited in zero",
"ai_title": "PaperCut NG/MF Vulnerability Under Active Exploitation",
"ai_summary": "On August 27, 2026, PaperCut issued an urgent advisory regarding a zero-day vulnerability affecting its NG and MF print management software. This fla…",
"article_count": 53,
"threat_score": 72.9,
"severity_score": 81.0,
"date_range_latest": "2026-08-27T16:48:35.471839+00:00",
"slug": "critical-zero-day-exploitation-of-papercut-ngmf-vulnerabilit-c18ccc2a"
}
],
"articles": [
{
"title": "Security Bulletin 27 Aug 2026 Urgent Security Advisory",
"source": "www.papercut.com",
"pub_date": "2026-09-01T12:20:50.225501+00:00",
"url": "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory"
},
{
"title": "Security Bulletin 27 Aug 2026 Urgent Security Advisory",
"source": "www.papercut.com",
"pub_date": "2026-08-28T05:32:53.679219+00:00",
"url": "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory?lid=0na0tu4…"
}
],
"co_entities_with_counts": {
"mitre_attack": [
{
"value": "T1190 - Exploit Public-Facing Application",
"count": 1
}
],
"tool": [
{
"value": "Pc-app.exe",
"count": 1
}
]
},
"aliases": []
}
GET /iocs/feed?format=txtacrobatreaderonline.com bookcheckarrival-gueststayhotel.com browser-app.com browsify.co case-apple.com ccleanerwind.top chat-apple.com cleankits.co coldcardteamnews.com crpx0.su cryptoprice.pw databreach.space
GET /iocs/feed?types=domainacrobatreaderonline.com bookcheckarrival-gueststayhotel.com browser-app.com browsify.co case-apple.com ccleanerwind.top chat-apple.com cleankits.co coldcardteamnews.com crpx0.su cryptoprice.pw databreach.space
GET /iocs/feed?format=json{
"iocs": [
{
"type": "domain",
"value": "acrobatreaderonline.com",
"confidence": "high",
"reason": "Used as a malicious site impersonating Adobe Acrobat Reader."
},
{
"type": "domain",
"value": "bookcheckarrival-gueststayhotel.com",
"confidence": "high",
"reason": "Indicates attacker-controlled phishing domain targeting hotel reservations."
}
],
"count": 629,
"confidence_filter": "confirmed",
"hours": 720
}
GET /iocs/feed?enrich=true&format=json{
"iocs": [
{
"type": "domain",
"value": "acrobatreaderonline.com",
"confidence": "high",
"reason": "Used as a malicious site impersonating Adobe Acrobat Reader.",
"clusters": [],
"sources": [
{
"source": "Cybersecuritynews",
"title": "New Malware-as-a-service Leveraging Adobe",
"url": "https://cybersecuritynews.com/malware-as-a-service-adobe-themed-domain/",
"pub_date": "2026-08-24 04:47:41+00:00"
}
]
},
{
"type": "domain",
"value": "bookcheckarrival-gueststayhotel.com",
"confidence": "high",
"reason": "Indicates attacker-controlled phishing domain targeting hotel reservations.",
"clusters": [
{
"cluster_id": "ca52b3c3-ad7b-4a47-981a-c7695de22ad8",
"title": "Phishing Attacks Target Hotels via Compromised Booking Data",
"url": "https://threatcluster.io/cluster/phishing-waves-cyberattacks-on-it-service-providers-for-hote-5de22…",
"threat_score": 61.5
}
],
"sources": [
{
"source": "Heise.De",
"title": "Phishing waves: Cyberattacks on IT service providers for hotels",
"url": "https://www.heise.de/en/news/Phishing-waves-Cyberattacks-on-IT-service-providers-for-hotels-1141219…",
"pub_date": "2026-08-13 06:24:31+00:00"
}
]
}
],
"count": 629,
"confidence_filter": "confirmed",
"hours": 720,
"enriched": true
}
GET /iocs/feed?format=csvtype,value,confidence,reason domain,acrobatreaderonline.com,high,Used as a malicious site impersonating Adobe Acrobat Reader. domain,bookcheckarrival-gueststayhotel.com,high,Indicates attacker-controlled phishing domain targeting hotel reservations. domain,browser-app.com,high,Domain used in a malicious browser extension campaign domain,browsify.co,high,Domain used in a malicious browser extension campaign domain,case-apple.com,high,Used in phishing scams impersonating Apple domain,ccleanerwind.top,high,Identified as attacker-controlled domain for malware distribution domain,chat-apple.com,high,Used in phishing scams impersonating Apple domain,cleankits.co,high,Associated with malicious Firefox extensions domain,coldcardteamnews.com,high,Used in a phishing campaign impersonating COLDCARD domain,crpx0.su,high,Identified as hosting a panel for a ransomware group domain,cryptoprice.pw,high,Listed as a service advertised by the actor for scams and malware delivery
GET /iocs/exportacrobatreaderonline.com bookcheckarrival-gueststayhotel.com browser-app.com browsify.co case-apple.com ccleanerwind.top chat-apple.com cleankits.co coldcardteamnews.com crpx0.su cryptoprice.pw databreach.space
GET /iocs/export?confidence=confirmed&format=json{
"iocs": [
{
"type": "domain",
"value": "acrobatreaderonline.com",
"confidence": "high",
"reason": "Used as a malicious site impersonating Adobe Acrobat Reader."
},
{
"type": "domain",
"value": "bookcheckarrival-gueststayhotel.com",
"confidence": "high",
"reason": "Indicates attacker-controlled phishing domain targeting hotel reservations."
}
],
"count": 675,
"confidence_filter": "confirmed",
"hours": 720,
"pending_count": 15
}
GET /threats/93fb80f8/iocs{
"iocs": [
{
"type": "ipv4",
"value": "31.58.209.241",
"confidence": "high",
"reason": "IP address hosting stolen data and offensive tools"
},
{
"type": "domain",
"value": "fine-work-team.com",
"confidence": "high",
"reason": "Listed as a delivery URL for a malicious script"
}
],
"count": 4,
"cluster_id": "93fb80f8"
}
GET /darkweb/ransomware/victims?days=7{
"victims": [
{
"id": "a4834f3163071aad",
"group": "rhysida",
"name": "Szechenyi Programiroda Nonprofit Kf",
"discovered": "2026-09-01 17:27:14.520298+00:00",
"country": "HU",
"sector": "Other",
"description": "Szechenyi Programiroda Nonprofit Kf",
"first_party": false,
"delisted": false,
"fp_has_note": false,
"fp_cats": 0
},
{
"id": "cb54d554aa40187f",
"group": "direwolf",
"name": "Oportunidados",
"discovered": "2026-09-01 16:25:03.194416+00:00",
"country": "BR",
"sector": "Not Found",
"description": "Business Services",
"website": "oportunidados.com.br",
"screenshot_url": null,
"first_party": false,
"delisted": false,
"fp_has_note": false,
"fp_cats": 0
}
],
"count": 100
}
GET /darkweb/ransomware/victims?sector=Manufacturing{
"victims": [
{
"id": "bdd665d27f502e10",
"group": "direwolf",
"name": "PT Intraco Penta Tbk",
"discovered": "2026-09-01 15:53:54.238628+00:00",
"country": "ID",
"sector": "Manufacturing",
"description": "Industrial Machinery & Equipment",
"website": "intracopenta.com",
"screenshot_url": null,
"first_party": false,
"delisted": false,
"fp_has_note": false,
"fp_cats": 0
},
{
"id": "7c85020e4123931c",
"group": "akira",
"name": "Congressional Iron Works",
"discovered": "2026-09-01 15:21:40.812015+00:00",
"sector": "Manufacturing",
"description": "Congressional Iron Works is a full-service miscellaneous metals contractor serving the commerci\nal…",
"first_party": false,
"delisted": false,
"fp_has_note": false,
"fp_cats": 0
}
],
"count": 100
}
GET /darkweb/ransomware/victims?country=ID{
"victims": [
{
"id": "bdd665d27f502e10",
"group": "direwolf",
"name": "PT Intraco Penta Tbk",
"discovered": "2026-09-01 15:53:54.238628+00:00",
"country": "ID",
"sector": "Manufacturing",
"description": "Industrial Machinery & Equipment",
"website": "intracopenta.com",
"screenshot_url": null,
"first_party": false,
"delisted": false,
"fp_has_note": false,
"fp_cats": 0
},
{
"id": "0e90632976a3f63c",
"group": "shadowbyt3$",
"name": "Sinar Mas Agribusiness and Food Golden Agri-Resources)",
"discovered": "2026-08-25 14:26:02.536617+00:00",
"country": "ID",
"sector": "Agriculture and Food Production",
"description": "We Breached This company a few months ago. we stole 375.66MB.\nmirror 1: https://anonfilesnew.com/s/…",
"website": "www.smart-tbk.com",
"screenshot_url": null,
"first_party": false,
"delisted": false,
"fp_has_note": false,
"fp_cats": 0
}
],
"count": 9
}
GET /darkweb/ransomware/victims?group=direwolf{
"victims": [
{
"id": "cb54d554aa40187f",
"group": "direwolf",
"name": "Oportunidados",
"discovered": "2026-09-01 16:25:03.194416+00:00",
"country": "BR",
"sector": "Not Found",
"description": "Business Services",
"website": "oportunidados.com.br",
"screenshot_url": null,
"first_party": false,
"delisted": false,
"fp_has_note": false,
"fp_cats": 0
},
{
"id": "591a6d4c1db2a096",
"group": "direwolf",
"name": "Honeycomb Programs Inc",
"discovered": "2026-09-01 15:54:31.468817+00:00",
"country": "US",
"sector": "Other",
"description": "Insurance",
"website": "honeycombinsurance.com",
"screenshot_url": null,
"first_party": false,
"delisted": false,
"fp_has_note": false,
"fp_cats": 0
}
],
"count": 46
}
GET /darkweb/ransomware/victim/bdd665d27f502e10{
"id": "bdd665d27f502e10",
"victim_name": "PT Intraco Penta Tbk",
"group_name": "direwolf",
"discovered": "2026-09-01 15:53:54.238628+00:00",
"country": "ID",
"sector": "Manufacturing",
"description": "Industrial Machinery & Equipment",
"website": "intracopenta.com",
"post_url": "http://direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.onion/api/public/articles/117",
"entities": {},
"first_party": false,
"related_group_victims": [
{
"id": "cb54d554aa40187f",
"victim_name": "Oportunidados",
"discovered": "2026-09-01 16:25:03.194416+00:00",
"country": "BR",
"sector": "Not Found"
},
{
"id": "591a6d4c1db2a096",
"victim_name": "Honeycomb Programs Inc",
"discovered": "2026-09-01 15:54:31.468817+00:00",
"country": "US",
"sector": "Other"
}
]
}
GET /darkweb/ransomware/group/direwolf{
"name": "direwolf",
"description": "Dire Wolf is a sophisticated human-operated ransomware group first documented in May 2025, written…",
"active": false,
"has_captcha": false,
"first_seen": "2025-04-17 00:00:00+00:00",
"last_seen": "2026-08-30 14:35:36.508000+00:00",
"tools": [],
"urls": [
"http://direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.onion"
],
"profile_links": [],
"recent_victims": [
{
"id": "cb54d554aa40187f",
"name": "Oportunidados",
"discovered": "2026-09-01 16:25:03.194416+00:00",
"country": "BR",
"sector": "Not Found",
"first_party": false,
"delisted": false
},
{
"id": "591a6d4c1db2a096",
"name": "Honeycomb Programs Inc",
"discovered": "2026-09-01 15:54:31.468817+00:00",
"country": "US",
"sector": "Other",
"first_party": false,
"delisted": false
}
],
"screenshot_url": "https://threatcluster.lon1.digitaloceanspaces.com/darkweb-groups/direwolf/20260901T033014Z.png",
"page_title": "DireWolf",
"ai_description": "DireWolf's homepage displays a list of victim companies with associated data sizes, publication dat…",
"ai_risk_tags": [
"countdown_timer",
"data_published_badges",
"victim_list"
],
"ai_language": "en",
"captcha_or_login_gate": false,
"scraped_at": "2026-09-01T03:30:18.180614+00:00",
"entities": {
"company": [
"Allstar Industries",
"Authenticate Information Systems",
"Deer Creek-Mackinaw CUSD"
],
"country": [
"Australia",
"Austria",
"Brazil"
],
"industry": [
"Business Services",
"Education",
"Engineering Software"
]
},
"mirrors": [
{
"url": "http://direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.onion",
"alive": null,
"last_alive_at": null,
"last_checked_at": null,
"consecutive_failures": 0,
"text_bytes": null
}
],
"screenshot_is_victim_page": false,
"first_party_only": [],
"first_party_count": 30,
"total_victims": 109
}
GET /darkweb/ransomware/groups?active_only=true{
"groups": [
{
"name": "qilin",
"active": true,
"victim_count": 2070,
"recent_victim_count_30d": 158,
"last_seen": "2026-09-01 03:56:51.567977+00:00",
"description": "Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supp…",
"has_captcha": false,
"profile_links": [],
"tools": [
"Mimikatz",
"EDRSandBlast"
]
},
{
"name": "akira",
"active": true,
"victim_count": 1377,
"recent_victim_count_30d": 34,
"last_seen": "2026-08-31 00:00:00+00:00",
"description": "The Akira ransomware group is said to have emerged in March 2023, and there's much speculation abou…",
"has_captcha": false,
"profile_links": [],
"tools": [
"DonPAPI",
"LaZagne"
]
}
],
"count": 85
}
GET /darkweb/breaches{
"breaches": [
{
"id": 852,
"name": "SynthientCredentialStuffingThreatData",
"domain": "",
"breach_date": "2025-04-11",
"added_date": "2025-11-06 04:58:49+00:00",
"pwn_count": 1957476021,
"description": "During 2025, <a href=\"https://www.troyhunt.com/2-billion-email-addresses-were-exposed-and-we-indexe…",
"logo_url": "https://logos.haveibeenpwned.com/List.png",
"data_classes": [
"Email addresses",
"Passwords"
],
"is_verified": true,
"is_sensitive": false
},
{
"id": 198,
"name": "Collection1",
"domain": "",
"breach_date": "2019-01-07",
"added_date": "2019-01-16 21:46:07+00:00",
"pwn_count": 772904991,
"description": "In January 2019, a large collection of credential stuffing lists (combinations of email addresses a…",
"logo_url": "https://logos.haveibeenpwned.com/List.png",
"data_classes": [
"Email addresses",
"Passwords"
],
"is_verified": false,
"is_sensitive": false
}
],
"count": 50
}
GET /darkweb/ransomware/victims/facets?days=30{
"countries": [
{
"value": "US",
"count": 412
},
{
"value": "DE",
"count": 70
}
],
"sectors": [
{
"value": "Manufacturing",
"count": 185
},
{
"value": "Technology",
"count": 164
}
],
"groups": [
{
"value": "qilin",
"count": 158
},
{
"value": "thegentlemen",
"count": 115
}
]
}
GET /darkweb/trends?weeks=8{
"victims_weekly": [
{
"week": "2026-07-06",
"count": 185
},
{
"week": "2026-07-13",
"count": 176
}
],
"top_industries": [
{
"industry": "Manufacturing",
"count": 400
},
{
"industry": "Technology",
"count": 331
}
],
"group_heatmap": {
"groups": [
"qilin",
"thegentlemen",
"incransom"
],
"weeks": [
"2026-06-08",
"2026-06-15",
"2026-06-22"
],
"cells": {
"qilin": [
19,
21
],
"thegentlemen": [
5,
34
]
}
}
}
GET /darkweb/stats{
"ransomware_groups": 164,
"total_victims": 20523,
"victims_last_7d": 281,
"victims_last_30d": 1219,
"breaches_known": 1032,
"last_updated": "2026-09-01T16:45:02.520706+00:00",
"data_source": "database"
}
GET /entities/apt_group/Volt%20Typhoon{
"entity": {
"entity_type": "apt_group",
"entity_value": "Volt Typhoon",
"frequency": 102,
"first_seen": "2025-10-29T12:59:40+00:00",
"last_seen": "2026-08-27T14:45:56+00:00"
},
"overview": "Volt Typhoon is a cyber espionage Advanced Persistent Threat (APT) group believed to operate primarily from China, targeting critical infrastructure…",
"clusters": [
{
"cluster_id": "b1286d86-7a9c-43c4-9697-1cbcb94c0224",
"title": "Threat actor leveraged Cisco SD-WAN zero-day since 2023 (CVE-2026-20127)",
"ai_title": "Cisco SD-WAN Zero-Day Exploited by Threat Actor Since 2023",
"ai_summary": "A cyber threat actor has been exploiting a zero-day vulnerability (CVE-2026-20127) in Cisco Catalyst SD-WAN Controller since 2023. This vulnerability…",
"article_count": 104,
"threat_score": 82.13,
"severity_score": 82.6,
"date_range_latest": "2026-02-25T16:58:31+00:00",
"slug": "cisco-sd-wan-zero-day-exploited-by-threat-actor-since-2023-b94c0224"
},
{
"cluster_id": "bb0dbba1-2e42-40a6-b988-67be916848f5",
"title": "Critical FortiWeb WAF Flaw Actively Exploited to Establish Admin Access and Seize Total Control",
"ai_title": "FortiWeb WAF Vulnerability Enables Full Admin Control Exploitation",
"ai_summary": "A critical vulnerability in FortiWeb Web Application Firewall (WAF) has been actively exploited, allowing attackers to gain full administrative acces…",
"article_count": 100,
"threat_score": 79.52,
"severity_score": 93.15,
"date_range_latest": "2025-11-15T10:02:37+00:00",
"slug": "fortiweb-waf-vulnerability-enables-full-admin-control-exploi-916848f5"
}
],
"articles": [
{
"title": "U.S. Says Chinese Hackers Targeted Senate, NASA, Hospitals, and More",
"source": "Time",
"pub_date": "2026-08-27T14:45:56+00:00",
"url": "https://time.com/article/2026/08/27/china-hack-federal-agencies-cybersecurity-qtfy-senate-nasa/"
},
{
"title": "China Hacked NASA, Federal Reserve: FBI Seizes Platforms Behind Eight",
"source": "Techtimes",
"pub_date": "2026-08-27T13:47:51+00:00",
"url": "https://www.techtimes.com/articles/325708/20260827/china-hacked-nasa-federal-reserve-fbi-seizes-pla…"
}
],
"co_entities_with_counts": {
"country": [
{
"value": "China",
"count": 43
}
],
"apt_group": [
{
"value": "Salt Typhoon",
"count": 31
}
],
"industry": [
{
"value": "Energy",
"count": 30
}
],
"attack_type": [
{
"value": "Malware",
"count": 27
}
]
},
"aliases": []
}
GET /entities/malware/Vidar{
"entity": {
"entity_type": "malware",
"entity_value": "Vidar",
"frequency": 91,
"first_seen": "2025-11-07T09:44:57+00:00",
"last_seen": "2026-08-31T21:08:46+00:00"
},
"overview": "Vidar is a modular information-stealer malware family primarily used to harvest sensitive data such as personal information, credentials, and cryptoc…",
"clusters": [
{
"cluster_id": "4be45cfb-af53-487f-b336-37e9a87caff8",
"title": "GhostShell Targets Ukraine's UAV and Defense Supply Chain",
"ai_title": "GhostShell Malware Targets Ukraine's UAV and Defense Supply Chain",
"ai_summary": "The GhostShell malware cluster is actively targeting Ukraine’s UAV operations and defense supply chain. Utilizing advanced techniques such as mTLS-au…",
"article_count": 2,
"threat_score": 79.35,
"severity_score": 80.0,
"date_range_latest": "2026-06-25T16:51:35+00:00",
"slug": "ghostshell-targets-ukraines-uav-and-defense-supply-chain-a87caff8"
},
{
"cluster_id": "408e93b6-cc90-45ae-a164-94496e04b360",
"title": "Are The Notorious Cyber Criminals Evil Corp Actually Russian Spies",
"ai_title": "Operation Endgame Disrupts Evil Corp's SocGholish Malware Network",
"ai_summary": "On June 18, 2026, international law enforcement agencies launched Operation Endgame, disrupting the SocGholish malware infrastructure linked to the R…",
"article_count": 67,
"threat_score": 78.0,
"severity_score": 80.0,
"date_range_latest": "2026-06-18T12:33:31.474167+00:00",
"slug": "are-the-notorious-cyber-criminals-evil-corp-actually-russian-6e04b360"
}
],
"articles": [
{
"title": "Anthropic Users Hit by Infostealer Attacks, Session Thefts",
"source": "Darkreading",
"pub_date": "2026-08-31T21:08:46+00:00",
"url": "https://www.darkreading.com/cyberattacks-data-breaches/anthropic-users-infostealer-attacks-session-…"
},
{
"title": "Hackers Target Claude Accounts With Malware That Steals Login Sessions",
"source": "Pymnts",
"pub_date": "2026-08-31T20:53:26+00:00",
"url": "https://www.pymnts.com/news/artificial-intelligence/2026/hackers-target-claude-accounts-with-malwar…"
}
],
"co_entities_with_counts": {
"attack_type": [
{
"value": "Malware",
"count": 86
}
],
"platform": [
{
"value": "Windows",
"count": 56
}
],
"malware": [
{
"value": "StealC",
"count": 35
}
],
"mitre_attack": [
{
"value": "T1003 - OS Credential Dumping",
"count": 23
}
]
},
"aliases": []
}
GET /entities/company/NASA{
"entity": {
"entity_type": "company",
"entity_value": "NASA",
"frequency": 38,
"first_seen": "2025-11-30T07:53:56+00:00",
"last_seen": "2026-08-29T20:12:25+00:00"
},
"overview": "NASA, the National Aeronautics and Space Administration, is a U.S. federal government agency responsible for civilian space exploration, space scienc…",
"clusters": [
{
"cluster_id": "0e424056-44c8-4efe-8212-385dcfbb3fff",
"title": "Critical NASA AIT",
"ai_title": "Critical Vulnerability in NASA Ground Control Software Allows Unauthenticated Access",
"ai_summary": "A critical vulnerability in NASA's AMMOS Instrument Toolkit (AIT-GUI) software, tracked as GHSA-p9r8-2q67-fp86, allows unauthenticated attackers to i…",
"article_count": 7,
"threat_score": 78.0,
"severity_score": 90.0,
"date_range_latest": "2026-08-20T15:24:09+00:00",
"slug": "nasa-ait-gui-vulnerability-allows-unauthenticated-command-ex-cfbb3fff"
},
{
"cluster_id": "7b801b8d-477b-4769-b969-b142c59695c3",
"title": "How Chinese-Nexus Cyber Operations Have Evolved",
"ai_title": "Evolution of Chinese-Nexus Cyber Operations: Strategic Long-Term Threats",
"ai_summary": "Recent research from Darktrace reveals the evolution of Chinese-nexus cyber operations over the past two decades, highlighting a shift from high-volu…",
"article_count": 381,
"threat_score": 72.5,
"severity_score": 80.0,
"date_range_latest": "2026-04-02T10:37:49+00:00",
"slug": "evolution-of-chinese-nexus-cyber-operations-strategic-long-t-c59695c3"
}
],
"articles": [
{
"title": "US Officials Revise China Hacking Claims, Say Agencies Were Targeted",
"source": "Freepressjournal.In",
"pub_date": "2026-08-29T20:12:25+00:00",
"url": "https://www.freepressjournal.in/world/us-officials-revise-china-hacking-claims-say-agencies-were-ta…"
},
{
"title": "US officials backpedal on claims that government agencies were hacked by Chinese",
"source": "Databreaches",
"pub_date": "2026-08-29T15:02:26+00:00",
"url": "https://databreaches.net/2026/08/29/us-officials-backpedal-on-claims-that-government-agencies-were-…"
}
],
"co_entities_with_counts": {
"company": [
{
"value": "Federal Reserve",
"count": 24
}
],
"industry": [
{
"value": "Government",
"count": 23
}
],
"tool": [
{
"value": "QScan",
"count": 16
}
],
"country": [
{
"value": "China",
"count": 15
}
]
},
"aliases": []
}
GET /entities/platform/Windows{
"entity": {
"entity_type": "platform",
"entity_value": "Windows",
"frequency": 3026,
"first_seen": "2025-10-24T12:00:00+00:00",
"last_seen": "2026-09-01T16:41:10+00:00"
},
"overview": "Windows is a family of operating system platforms developed by Microsoft, designed to provide a graphical user interface and manage hardware and soft…",
"clusters": [
{
"cluster_id": "606197c6-712a-4d70-a437-49aa6a0b6977",
"title": "Chrome 143 Released With Fix for 13 Vulnerabilities that Enables Arbitrary Code Execution",
"ai_title": "Google Addresses Eighth Chrome Zero-Day Vulnerability in 2025",
"ai_summary": "Google has issued emergency updates to address the eighth zero-day vulnerability in Chrome for 2025. The flaw, identified as 466192044, was actively…",
"article_count": 45,
"threat_score": 96.9,
"severity_score": 100.0,
"date_range_latest": "2025-12-11T08:01:21+00:00",
"slug": "google-addresses-eighth-chrome-zero-day-vulnerability-in-202-6a0b6977"
},
{
"cluster_id": "1528e8d6-728a-4dc1-b355-97ee56e97522",
"title": "CVE-2025-14733 Vulnerability: WatchGuard Addresses a Critical RCE Affecting Firebox ...",
"ai_title": "China-linked Cyber Group Expands Targeting to Southeastern Europe",
"ai_summary": "A sophisticated threat actor known as UAT-7290, tracked by Cisco Talos, has expanded its operations to target telecommunications providers in Southea…",
"article_count": 1,
"threat_score": 95.89,
"severity_score": 100.0,
"date_range_latest": "2026-01-08T23:39:12+00:00",
"slug": "china-linked-cyber-group-expands-targeting-to-southeastern-e-56e97522"
}
],
"articles": [
{
"title": "Fake Claude Desktop App Used to Spread Malware Targeting Crypto Wallets",
"source": "Tech.Yahoo",
"pub_date": "2026-09-01T16:41:10+00:00",
"url": "https://tech.yahoo.com/cybersecurity/articles/fake-claude-desktop-app-used-160700784.html"
},
{
"title": "Fake Claude desktop app spreads crypto-stealing malware",
"source": "Tradingview",
"pub_date": "2026-09-01T14:20:39+00:00",
"url": "https://www.tradingview.com/news/cointelegraph:ffbe2a04e094b:0-fake-claude-desktop-app-spreads-cryp…"
}
],
"co_entities_with_counts": {
"attack_type": [
{
"value": "Malware",
"count": 1338
}
],
"platform": [
{
"value": "Linux",
"count": 563
}
],
"mitre_attack": [
{
"value": "T1059.001 - PowerShell",
"count": 388
}
],
"tool": [
{
"value": "PowerShell",
"count": 356
}
]
},
"aliases": []
}
GET /entities/country/Australia{
"entity": {
"entity_type": "country",
"entity_value": "Australia",
"frequency": 991,
"first_seen": "2025-10-23T20:19:43+00:00",
"last_seen": "2026-08-31T22:10:38+00:00"
},
"overview": "Australia is a sovereign country consisting of the mainland Australian continent, the island of Tasmania, and numerous smaller islands. It is recogni…",
"clusters": [
{
"cluster_id": "14224782-0262-4282-b1e6-52b01bce6f08",
"title": "Victorian student information stolen in major data breach",
"ai_title": "Major Cyber Attack on Victorian Government Schools Exposes Student Data",
"ai_summary": "Hackers have compromised the personal information of thousands of current and former students in Victorian government schools. The breach includes na…",
"article_count": 19,
"threat_score": 83.11,
"severity_score": 84.0,
"date_range_latest": "2026-01-14T10:11:03+00:00",
"slug": "major-cyber-attack-on-victorian-government-schools-exposes-s-1bce6f08"
},
{
"cluster_id": "b1286d86-7a9c-43c4-9697-1cbcb94c0224",
"title": "Threat actor leveraged Cisco SD-WAN zero-day since 2023 (CVE-2026-20127)",
"ai_title": "Cisco SD-WAN Zero-Day Exploited by Threat Actor Since 2023",
"ai_summary": "A cyber threat actor has been exploiting a zero-day vulnerability (CVE-2026-20127) in Cisco Catalyst SD-WAN Controller since 2023. This vulnerability…",
"article_count": 104,
"threat_score": 82.13,
"severity_score": 82.6,
"date_range_latest": "2026-02-25T16:58:31+00:00",
"slug": "cisco-sd-wan-zero-day-exploited-by-threat-actor-since-2023-b94c0224"
}
],
"articles": [
{
"title": "Healthcare cyberattacks hit pacemakers and millions of patient records",
"source": "Theregister",
"pub_date": "2026-08-31T22:10:38+00:00",
"url": "https://www.theregister.com/cyber-crime/2026/08/31/healthcare-cyberattacks-hit-pacemakers-and-milli…"
},
{
"title": "SEPT. 8-10: Top Cyber Experts from Federal Agencies, Companies, and Allies Share ...",
"source": "Uk.Finance.Yahoo",
"pub_date": "2026-08-31T21:01:46+00:00",
"url": "https://uk.finance.yahoo.com/news/sept-8-10-top-cyber-205400910.html"
}
],
"co_entities_with_counts": {
"country": [
{
"value": "United States",
"count": 238
}
],
"attack_type": [
{
"value": "Data Breach",
"count": 190
}
],
"industry": [
{
"value": "Government",
"count": 130
}
],
"mitre_attack": [
{
"value": "T1566 - Phishing",
"count": 77
}
]
},
"aliases": []
}
GET /entities/cve/CVE-2026-46037{
"entity": {
"entity_type": "cve",
"entity_value": "CVE-2026-46037",
"frequency": 15,
"first_seen": "2026-07-21T10:02:39+00:00",
"last_seen": "2026-09-01T08:19:48.157769+00:00"
},
"clusters": [
{
"cluster_id": "3716ea53-84da-497b-a06e-522e50bf594e",
"title": "USN-8664-1: Linux kernel (NVIDIA BaseOS) vulnerabilities",
"ai_title": "Critical Linux Kernel Vulnerabilities Affecting Ubuntu Systems",
"ai_summary": "Multiple security vulnerabilities have been identified in the Linux kernel affecting Ubuntu 24.04 and 26.04 LTS. Key issues include improper isolatio…",
"article_count": 8,
"threat_score": 72.75,
"severity_score": 81.0,
"date_range_latest": "2026-08-20T23:31:14+00:00",
"slug": "vulnerabilities-in-amd-processors-affect-linux-kernel-securi-50bf594e"
},
{
"cluster_id": "884c17df-2b61-44be-a77a-589d65c97e75",
"title": "USN-8566-1: Linux kernel vulnerabilities",
"ai_title": "Critical Vulnerabilities in Linux Kernel Affect AMD Processors",
"ai_summary": "Multiple vulnerabilities have been identified in the Linux kernel affecting AMD processors, specifically in the floating point divider unit and Zen 2…",
"article_count": 60,
"threat_score": 72.75,
"severity_score": 81.0,
"date_range_latest": "2026-07-20T15:45:34+00:00",
"slug": "usn-8566-1-linux-kernel-vulnerabilities-65c97e75"
}
],
"articles": [
{
"title": "Suse Su 202623290 1",
"source": "www.suse.com",
"pub_date": "2026-09-01T08:19:48.157769+00:00",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202623290-1/"
},
{
"title": "Suse Su 202623288 1",
"source": "www.suse.com",
"pub_date": "2026-09-01T08:19:47.058937+00:00",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202623288-1/"
}
],
"co_entities_with_counts": {
"cve": [
{
"value": "CVE-2026-43109",
"count": 13
}
],
"platform": [
{
"value": "Linux",
"count": 12
}
],
"cwe": [
{
"value": "Cwe-416 - Use After Free",
"count": 8
}
]
},
"aliases": []
}
GET /entities/cve/CVE-2026-46037/related{
"entity_type": "cve",
"entity_value": "CVE-2026-46037",
"related": [
{
"entity_type": "platform",
"entity_value": "Linux",
"shared_clusters": 4,
"co_occurrences": 170
},
{
"entity_type": "company",
"entity_value": "SuSE",
"shared_clusters": 2,
"co_occurrences": 12
}
],
"sub_relationships": [
{
"source": "Linux",
"target": "Data Breach",
"shared_clusters": 200
},
{
"source": "Linux",
"target": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"shared_clusters": 5
}
]
}
GET /entities/trending?time_filter=7d{
"trending": {
"apt_group": [
{
"value": "Volt Typhoon",
"frequency": 7,
"change": 600.0,
"is_new": false
}
],
"attack_type": [
{
"value": "Malware",
"frequency": 194,
"change": 23.6,
"is_new": false
}
],
"campaign": [
{
"value": "Operation Jackal IV",
"frequency": 3,
"change": 200.0,
"is_new": false
}
],
"company": [
{
"value": "NASA",
"frequency": 28,
"change": 1300.0,
"is_new": false
}
]
},
"time_filter": "7d"
}
GET /entities/search?q=lock{
"entities": [
{
"entity_type": "ransomware_group",
"entity_value": "Lockbit",
"article_count": 154,
"cluster_count": 87
},
{
"entity_type": "platform",
"entity_value": "BitLocker",
"article_count": 39,
"cluster_count": 23
}
],
"count": 20,
"total": 163,
"limit": 20,
"offset": 0,
"query": "lock"
}
GET /stats/entities/timeline?entity_type=ransomware_group&days=30{
"entity_type": "ransomware_group",
"days": 30,
"timeline": {
"dates": [
"2026-08-03",
"2026-08-04",
"2026-08-05"
],
"entities": [
{
"name": "Qilin",
"counts": [
0,
0
]
}
]
}
}
GET /search?q=CVE-2026-46037{
"query": "CVE-2026-46037",
"clusters": [
{
"short_id": "cebb7ea4",
"cluster_id": "da662236-d210-4fa9-8968-7b30cebb7ea4",
"slug": "multiple-suse-kernel-rt-security-updates-address-critical-vu-cebb7ea4",
"ai_title": "Multiple SUSE Kernel RT Security Updates Address Critical Vulnerabilities",
"ai_summary": "SUSE has released a series of important security updates for its Linux Enterprise Kernel, addressing multiple vulnerabilities across various versions…",
"urgency_level": "medium",
"keywords": [
"security",
"linux"
],
"threat_score": 67.25,
"severity_score": 70.0,
"article_count": 40,
"date_range_latest": "2026-08-26T16:51:07+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
}
],
"entities": [
{
"entity_type": "cve",
"entity_value": "CVE-2026-46037",
"cluster_count": 4,
"article_count": 15
}
],
"darkweb": [],
"limit": 10,
"total": 2
}
GET /search?q=fortigate{
"query": "fortigate",
"clusters": [
{
"short_id": "b4c3b813",
"cluster_id": "d210e6b1-58d9-40aa-8d82-8b7eb4c3b813",
"slug": "hackers-breached-a-small-polish-energy-plant-via-private-apn-b4c3b813",
"ai_title": "Cyberattack on Polish Energy Sector Exploits Private APN Vulnerability",
"ai_summary": "In December 2025, hackers breached a Polish combined heat and power (CHP) plant using a private Access Point Name (APN) to access the operational tec…",
"urgency_level": "medium",
"keywords": [
"hackers",
"private"
],
"threat_score": 77.0,
"severity_score": 80.0,
"article_count": 8,
"date_range_latest": "2026-08-10T23:07:21+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
},
{
"short_id": "23e56b38",
"cluster_id": "4fe5a130-915f-4685-a552-542623e56b38",
"slug": "fortigate-1200g-brings-fortisase-outpost-to-customer-23e56b38",
"ai_title": "Fortinet Launches FortiGate 1200G with Integrated SASE Capabilities",
"ai_summary": "Fortinet has introduced the FortiGate 1200G series, enhancing its firewall offerings with integrated FortiSASE Outpost capabilities. This new series…",
"urgency_level": "medium",
"keywords": [
"fortigate",
"fortisase"
],
"threat_score": 21.9,
"severity_score": 21.0,
"article_count": 2,
"date_range_latest": "2026-07-29T08:38:45+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
}
],
"entities": [
{
"entity_type": "platform",
"entity_value": "Fortigate",
"cluster_count": 35,
"article_count": 71
},
{
"entity_type": "platform",
"entity_value": "Fortinet FortiGate",
"cluster_count": 7,
"article_count": 9
}
],
"darkweb": [],
"limit": 10,
"total": 19
}
GET /search?q=Qilin{
"query": "Qilin",
"clusters": [
{
"short_id": "3a29f452",
"cluster_id": "b2c83a72-8d2c-4913-bb97-47c73a29f452",
"slug": "qilin-ransomware-gang-targets-atf-in-cyberattack-3a29f452",
"ai_title": "Qilin Ransomware Gang Claims Attack on ATF, Major Incident Declared",
"ai_summary": "The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) is investigating a major cybersecurity incident after the Qilin ransomware gang claimed…",
"urgency_level": "medium",
"keywords": [
"ransomware",
"attack"
],
"threat_score": 61.25,
"severity_score": 70.0,
"article_count": 31,
"date_range_latest": "2026-08-26T22:35:02+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
},
{
"short_id": "2f4929ac",
"cluster_id": "5eb440b4-5ec7-457d-befd-98c12f4929ac",
"slug": "mexicos-cybersecurity-plan-addresses-rising-ransomware-threa-2f4929ac",
"ai_title": "Mexico's Cybersecurity Plan Addresses Rising Ransomware Threats",
"ai_summary": "Mexico's National Cybersecurity Plan, introduced in December 2025, aims to tackle increasing cyber threats, particularly ransomware, which has seen 2…",
"urgency_level": "medium",
"keywords": [
"mexico",
"cybersecurity"
],
"threat_score": 56.0,
"severity_score": 61.0,
"article_count": 2,
"date_range_latest": "2026-08-25T19:22:28+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
}
],
"entities": [
{
"entity_type": "ransomware_group",
"entity_value": "Qilin",
"cluster_count": 124,
"article_count": 202
},
{
"entity_type": "ransomware_group",
"entity_value": "Qilin Ransomware",
"cluster_count": 12,
"article_count": 12
}
],
"darkweb": [
{
"type": "victim",
"name": "Commission de la construction du Quebec",
"id": "87989ff49ba65be4",
"date": "2026-09-01T03:57:10.128191+00:00",
"group": "qilin",
"country": "CA",
"sector": "Government & Defense"
},
{
"type": "victim",
"name": "Inmac",
"id": "cc74ad77dd5371e1",
"date": "2026-08-31T19:02:21.022361+00:00",
"group": "qilin",
"country": "AR",
"sector": "Retail & E-Commerce"
}
],
"limit": 10,
"total": 30
}
GET /search?q=Volt%20Typhoon{
"query": "Volt Typhoon",
"clusters": [
{
"short_id": "36dd11fb",
"cluster_id": "cd4e93a9-6b89-4dc7-afad-be8536dd11fb",
"slug": "antares-backs-affirmative-cyber-war-cover-for-us-essential-36dd11fb",
"ai_title": "Antares Launches Cyber War Coverage for US Critical Infrastructure Operators",
"ai_summary": "Antares' Lloyd's Syndicate 1274 has introduced a new affirmative cyber war product for US critical infrastructure providers, including power, water,…",
"urgency_level": "medium",
"keywords": [
"antares",
"affirmative"
],
"threat_score": 60.0,
"severity_score": 61.0,
"article_count": 4,
"date_range_latest": "2026-07-03T05:32:24+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
},
{
"short_id": "02df2601",
"cluster_id": "e2dc39d2-3e07-4205-af9d-2ab702df2601",
"slug": "canadas-spy-service-won-permission-to-hack-two-state-linked--02df2601",
"ai_title": "Canada's CSIS Authorized to Hack State-Linked Botnets Targeting Critical Infrastructure",
"ai_summary": "Canada's Federal Court has granted the Canadian Security Intelligence Service (CSIS) permission to hack into privately owned routers and internet-con…",
"urgency_level": "medium",
"keywords": [
"canada",
"service"
],
"threat_score": 75.5,
"severity_score": 80.0,
"article_count": 6,
"date_range_latest": "2026-06-16T21:21:32+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
}
],
"entities": [
{
"entity_type": "apt_group",
"entity_value": "Volt Typhoon",
"cluster_count": 72,
"article_count": 102
},
{
"entity_type": "campaign",
"entity_value": "Volt Typhoon Campaign",
"cluster_count": 1,
"article_count": 1
}
],
"darkweb": [],
"limit": 10,
"total": 13
}
GET /search?q=Vidar{
"query": "Vidar",
"clusters": [
{
"short_id": "a083694a",
"cluster_id": "c6ba6c39-9904-4df7-9253-ab86a083694a",
"slug": "infostealer-malware-hijacks-claude-sessions-draining-user-li-a083694a",
"ai_title": "Infostealer Malware Hijacks Claude Sessions, Drains User Accounts",
"ai_summary": "Anthropic has alerted users that infostealer malware is compromising Claude accounts by hijacking active login sessions, allowing attackers to deplet…",
"urgency_level": "medium",
"keywords": [
"claude",
"anthropic"
],
"threat_score": 70.5,
"severity_score": 80.0,
"article_count": 35,
"date_range_latest": "2026-08-31T02:52:54+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
},
{
"short_id": "a9dff91d",
"cluster_id": "f0c4d02d-7da0-425e-b93f-da65a9dff91d",
"slug": "fake-google-gemini-installer-distributes-vidar-infostealer-v-a9dff91d",
"ai_title": "Fake Google Gemini Installer Distributes Vidar Infostealer via Google Colab",
"ai_summary": "A malicious executable disguised as a Google Gemini installer was used to deploy the Vidar infostealer on a company network in the EMEA region. Darkt…",
"urgency_level": "medium",
"keywords": [
"google",
"gemini"
],
"threat_score": 51.9,
"severity_score": 61.0,
"article_count": 3,
"date_range_latest": "2026-08-21T06:22:04+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
}
],
"entities": [
{
"entity_type": "malware",
"entity_value": "Vidar",
"cluster_count": 41,
"article_count": 91
},
{
"entity_type": "malware",
"entity_value": "Vidar Stealer",
"cluster_count": 4,
"article_count": 6
}
],
"darkweb": [],
"limit": 10,
"total": 18
}
GET /search?q=172.86.98.113{
"query": "172.86.98.113",
"clusters": [],
"entities": [
{
"entity_type": "ipv4",
"entity_value": "172.86.98.113",
"cluster_count": 2,
"article_count": 3
}
],
"darkweb": [],
"limit": 10,
"total": 1
}
GET /search?q=businesswire.com{
"query": "businesswire.com",
"clusters": [],
"entities": [
{
"entity_type": "domain",
"entity_value": "businesswire.com",
"cluster_count": 131,
"article_count": 172
}
],
"darkweb": [],
"limit": 10,
"total": 1
}
GET /search?q=Australia{
"query": "Australia",
"clusters": [
{
"short_id": "fcea078c",
"cluster_id": "b3b4cb52-0853-433e-8397-cbe6fcea078c",
"slug": "cybersecurity-governance-urged-amid-rising-ai-threats-fcea078c",
"ai_title": "Cybersecurity Governance Urged Amid Rising AI Threats",
"ai_summary": "The European Supervisory Authorities (EBA, EIOPA, and ESMA) have called for enhanced governance to mitigate ICT risks linked to frontier AI models. T…",
"urgency_level": "medium",
"keywords": [
"eiopa",
"esma"
],
"threat_score": 51.9,
"severity_score": 61.0,
"article_count": 2,
"date_range_latest": "2026-09-01T16:19:54.871384+00:00",
"is_new": true,
"is_trending": false,
"entities": {}
},
{
"short_id": "5c82aa5d",
"cluster_id": "67109d7f-1c87-4600-9277-22fb5c82aa5d",
"slug": "five-eyes-alliance-targets-global-fraud-networks-5c82aa5d",
"ai_title": "Five Eyes Alliance Targets Global Fraud Networks",
"ai_summary": "The UK, supported by the Five Eyes alliance (US, Canada, Australia, New Zealand), has initiated measures to combat global fraud and online scams. Dur…",
"urgency_level": "medium",
"keywords": [
"fraud",
"national"
],
"threat_score": 45.4,
"severity_score": 40.0,
"article_count": 2,
"date_range_latest": "2026-08-28T13:53:35+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
}
],
"entities": [
{
"entity_type": "country",
"entity_value": "Australia",
"cluster_count": 594,
"article_count": 991
},
{
"entity_type": "company",
"entity_value": "Australian Federal Police",
"cluster_count": 4,
"article_count": 4
}
],
"darkweb": [
{
"type": "victim",
"name": "3-point Australia",
"id": "a9397a294e5ddc1a",
"date": "2026-08-14T07:12:41.384020+00:00",
"group": "storm",
"country": "AU",
"sector": "Other"
},
{
"type": "victim",
"name": "INTERTRUST AUSTRALIA PTY LTD",
"id": "e44d9bb0c39303f2",
"date": "2026-08-02T20:27:11.858120+00:00",
"group": "qilin",
"country": "AU",
"sector": "Professional Services"
}
],
"limit": 10,
"total": 30
}
GET /search?q=healthcare{
"query": "healthcare",
"clusters": [
{
"short_id": "1e900c91",
"cluster_id": "55698251-3cce-41d4-8f9b-1fd71e900c91",
"slug": "phishing-vulnerability-reduced-by-83-through-training-in-eur-1e900c91",
"ai_title": "Phishing Vulnerability Reduced by 83% Through Training in Europe",
"ai_summary": "A new study reveals that European companies can reduce employee vulnerability to phishing by 83% after one year of security training. The 'Phishing b…",
"urgency_level": "medium",
"keywords": [
"phishing",
"study"
],
"threat_score": 42.75,
"severity_score": 41.0,
"article_count": 2,
"date_range_latest": "2026-09-01T16:20:42.925369+00:00",
"is_new": true,
"is_trending": false,
"entities": {}
},
{
"short_id": "2220c37d",
"cluster_id": "7c2baf1b-8165-400a-ace3-14fe2220c37d",
"slug": "massive-healthcare-data-breach-affects-375m-patients-2220c37d",
"ai_title": "Massive Healthcare Data Breach Affects 3.75M Patients",
"ai_summary": "In March 2026, CareCloud experienced a significant data breach affecting over 3.75 million patients. Hackers accessed CareCloud's cloud environment,…",
"urgency_level": "medium",
"keywords": [
"data",
"breach"
],
"threat_score": 61.5,
"severity_score": 75.0,
"article_count": 2,
"date_range_latest": "2026-09-01T15:13:51+00:00",
"is_new": true,
"is_trending": false,
"entities": {}
}
],
"entities": [
{
"entity_type": "industry",
"entity_value": "Healthcare",
"cluster_count": 845,
"article_count": 1378
},
{
"entity_type": "company",
"entity_value": "Change Healthcare",
"cluster_count": 31,
"article_count": 39
}
],
"darkweb": [
{
"type": "victim",
"name": "Nutex Health",
"id": "dff02778ccad0dc8",
"date": "2026-09-01T12:14:08.598913+00:00",
"group": "thegentlemen",
"country": "US",
"sector": "Healthcare"
},
{
"type": "victim",
"name": "seashellhospital.com",
"id": "f471acfa69878ee8",
"date": "2026-09-01T09:02:54.914837+00:00",
"group": "krybit",
"country": "IN",
"sector": "Healthcare"
}
],
"limit": 10,
"total": 30
}
GET /search?q=ransomware&days=1{
"query": "ransomware",
"clusters": [
{
"short_id": "c92c65c3",
"cluster_id": "83855d94-b8a0-4d53-bf44-7bb7c92c65c3",
"slug": "superna-launches-cyberstorage-v215-for-enhanced-security-ope-c92c65c3",
"ai_title": "Superna Launches Cyberstorage v2.15 for Enhanced Security Operations",
"ai_summary": "On September 1, 2026, Superna announced the release of version 2.15 of its Cyberstorage platform. This update aims to streamline security and resilie…",
"urgency_level": "medium",
"keywords": [
"security",
"superna"
],
"threat_score": 24.0,
"severity_score": 20.0,
"article_count": 2,
"date_range_latest": "2026-09-01T15:19:13.891342+00:00",
"is_new": true,
"is_trending": false,
"entities": {}
},
{
"short_id": "2c02b996",
"cluster_id": "5329414f-a3ee-4f5f-af4d-24152c02b996",
"slug": "spinai-acquires-docontrol-to-enhance-saas-and-ai-security-so-2c02b996",
"ai_title": "Spin.AI Acquires DoControl to Enhance SaaS and AI Security Solutions",
"ai_summary": "Spin.AI has acquired DoControl, an Israeli cybersecurity firm, to integrate their technologies into a unified SaaS and AI security platform. The acqu…",
"urgency_level": "medium",
"keywords": [
"spin",
"security"
],
"threat_score": 21.9,
"severity_score": 21.0,
"article_count": 2,
"date_range_latest": "2026-08-31T22:22:17+00:00",
"is_new": true,
"is_trending": false,
"entities": {}
}
],
"entities": [
{
"entity_type": "attack_type",
"entity_value": "Ransomware",
"cluster_count": 2086,
"article_count": 4320
},
{
"entity_type": "ransomware_group",
"entity_value": "Qilin Ransomware",
"cluster_count": 12,
"article_count": 12
}
],
"darkweb": [
{
"type": "group",
"name": "0mega",
"active": true,
"victim_count": 1
},
{
"type": "group",
"name": "abrahams_ax",
"active": true,
"victim_count": 0
}
],
"limit": 10,
"days": 1,
"total": 25
}
GET /search?q=lockbit&include_articles=true{
"query": "lockbit",
"clusters": [
{
"short_id": "2f4929ac",
"cluster_id": "5eb440b4-5ec7-457d-befd-98c12f4929ac",
"slug": "mexicos-cybersecurity-plan-addresses-rising-ransomware-threa-2f4929ac",
"ai_title": "Mexico's Cybersecurity Plan Addresses Rising Ransomware Threats",
"ai_summary": "Mexico's National Cybersecurity Plan, introduced in December 2025, aims to tackle increasing cyber threats, particularly ransomware, which has seen 2…",
"urgency_level": "medium",
"keywords": [
"mexico",
"cybersecurity"
],
"threat_score": 56.0,
"severity_score": 61.0,
"article_count": 2,
"date_range_latest": "2026-08-25T19:22:28+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
},
{
"short_id": "84095fb7",
"cluster_id": "58924ad2-b41a-4e6c-b1c4-5b6084095fb7",
"slug": "lockbit-ransomware-targets-icbc-financial-services-and-us-ba-84095fb7",
"ai_title": "LockBit Ransomware Targets ICBC Financial Services and U.S. Bank",
"ai_summary": "On November 8, 2025, the LockBit ransomware group attacked ICBC Financial Services, disrupting U.S. Treasury trading operations. The attack exploited…",
"urgency_level": "medium",
"keywords": [
"ransomware",
"financial"
],
"threat_score": 65.5,
"severity_score": 80.0,
"article_count": 10,
"date_range_latest": "2026-08-20T14:34:35.622452+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
}
],
"entities": [
{
"entity_type": "ransomware_group",
"entity_value": "Lockbit",
"cluster_count": 87,
"article_count": 138
},
{
"entity_type": "ransomware_group",
"entity_value": "Lockbit 3.0",
"cluster_count": 7,
"article_count": 5
}
],
"darkweb": [
{
"type": "victim",
"name": "svfcu.org",
"id": "5e9204528e5ca8a6",
"date": "2026-08-31T23:02:07.027296+00:00",
"group": "lockbit5",
"country": "US",
"sector": "Financial Services"
},
{
"type": "victim",
"name": "hoaattorneys.com",
"id": "20374774ed86a8db",
"date": "2026-08-31T22:59:59.933621+00:00",
"group": "lockbit5",
"country": "US",
"sector": "Professional Services"
}
],
"articles": [
{
"title": "US Bank investigates LockBit claim of data theft, faces September 3 deadline",
"source": "Teiss",
"url": "https://www.teiss.co.uk/news/us-bank-investigates-lockbit-claim-of-data-theft-faces-september-3-dea…",
"pub_date": "2026-08-24T11:00:51+00:00",
"is_new": false
},
{
"title": "US Bank investigates LockBit ransomware claims of data breach",
"source": "Feeds.Feedburner",
"url": "https://www.scworld.com/brief/us-bank-investigates-lockbit-ransomware-claims-of-data-breach",
…
POST /ask
{"query": "Which ransomware groups hit healthcare this week, and how?"}{
"answer": "Three groups named healthcare victims in the last seven days.\n- **Qilin** listed a UK NHS supplier, 400 GB claimed, initial access via a Citrix appliance [C1] [C2].\n- **INC Ransom** posted two US clinics; both reports describe phishing to a billing platform login [C3].\n- **Rhysida** ...",
"sources": [ {"tag": "C1", "cluster_id": "…", "title": "Qilin claims UK NHS supplier…", "url": "https://threatcluster.io/cluster/…"} ],
"context_used": {"engine": "agent", "tool_calls": [{"tool": "leak_site_victims", "args": {"days": 7, "sector": "Healthcare"}}], "clusters_matched": 6, "victims_listed": 15},
"cost": 50,
"cached": false
}
POST /feeds/17ae839a-a413-4c6b-91a5-b2b830f09699/entities
{"keyword": "Snowflake", "entity_type": "company"}{
"feed_id": "17ae839a-a413-4c6b-91a5-b2b830f09699",
"added": [
{
"keyword": "snowflake",
"entity_type": "company",
"is_custom": false
}
],
"skipped": [],
"count": 4,
"limit": 75
}
GET /feed?feed_type=custom&feed_id=17ae839a-a413-4c6b-91a5-b2b830f09699&time_filter=30d&limit=3{
"items": [
{
"cluster_id": "15e5588e-5ec9-44e7-a292-9de007cce8c9",
"title": "An AI broke Snowflake's code. Then another AI agent exploited it",
"ai_title": "AI-Driven Command Injection Vulnerability Exposes Snowflake Jira Credentials",
"ai_summary": "A critical command injection vulnerability was discovered in Snowflake's GitHub Actions workflow, allowing unauthenticated attackers to exec…",
"timeline": [
{
"date": "2026-06-18",
"event": "Vulnerability introduced by AI assistant",
"detail": "GitHub Copilot Autofix altered the workflow code, creating a command injection vector.",
"source": "News.Ycombinator",
"source_url": "https://www.wiz.io/blog/red-agent-snowflake-copilot-cicd-bug"
},
{
"date": "2026-06-23",
"event": "Vulnerability discovered and disclosed",
"detail": "Wiz Research's Red Agent identified the flaw and reported it to Snowflake via HackerOne.",
"source": "Rescana",
"source_url": "https://www.rescana.com/post/critical-command-injection-vulnerability-in-snowflake-snowflake-connector-net-github-actions-exposes-jira-crede…"
},
"…"
],
"article_count": 12,
"threat_score": 67.5,
"recency_score": 0.0,
"coverage_score": 63.11,
"severity_score": 80.0,
"sentiment_score": 70.0,
"geopolitical_score": 0.0,
"actionability_score": 60.0,
"severity_reason": "The vulnerability was critical due to its potential for exploitation, but it was quickly remediated.",
"credibility_score": 0.0,
"urgency_level": "medium",
"ranking_score": 0.0,
"keywords": [
"snowflake",
"another",
"…"
],
"sources": [
"Theregister",
"News.Ycombinator"
],
"severity_indicators": [
"ot"
],
"date_range_earliest": "2026-08-17T14:18:38+00:00",
"date_range_latest": "2026-08-17T16:36:21+00:00",
"created_at": "2026-08-17T17:31:58.339730+00:00",
"updated_at": "2026-09-05T11:28:06.165066+00:00",
"recent_article_count_12h": 0,
"recent_article_count_6h": 0,
"insights_count": 0,
"articles": [
{
"uuid": "d28b0a87-ff5b-7219-bc56-206f3cb9fe78",
"title": "AI-Generated GitHub Copilot \"Autofix\" Allowed Compromise of Snowflake's Jira",
"content": "<p>As part of ongoing security research conducted through Snowflake’s HackerOne vulnerability disclosure program, Wiz Research’s \"Red Agent\"…",
"source": "News.Ycombinator",
"pub_date": "2026-08-17T14:18:38+00:00",
"url": "https://www.wiz.io/blog/red-agent-snowflake-copilot-cicd-bug",
"author": "",
"og_image_url": "https://www.datocms-assets.com/75231/1786964856-image.png?fm=webp",
"is_reference_only": false,
"link_source_article_uuid": null,
"link_source_title": null,
"link_source_name": null,
"similarity_score": 0.8978291153907776,
…
}
GET /threats?since=2026-09-06T00:04:14Z&sort_by=new&limit=3{
"threats": [
{
"cluster_id": "a421faa9-01c2-45f0-862f-5fd7e1322f03",
"title": "Germany plans anti-drone shield after Leipzig attack: report",
"ai_title": "Germany Accuses Russia of Drone Attack Amid Rising Hybrid Warfare Threats",
"ai_summary": "On August 4, 2026, Germany accused Russia of orchestrating a drone attack on Leipzig-Halle Airport, marking a significant escalation in hybr…",
"timeline": [
{
"date": "2026-08-04",
"event": "Drone attack on Leipzig-Halle Airport",
"detail": "Three drones targeted the airport; one struck a parked plane and another collided with an inbound cargo jet.",
"source": "Rte.Ie",
"source_url": "https://www.rte.ie/news/2026/0905/1590402-russia-eu-hybrid-attacks/"
},
{
"date": "2026-09-05",
"event": "Germany accuses Russia of involvement",
"detail": "German Interior Minister Dobrindt stated that the drone attack reflects a new reality of hybrid threats from Russia.",
"source": "Rte.Ie",
"source_url": "https://www.rte.ie/news/2026/0905/1590402-russia-eu-hybrid-attacks/"
},
"…"
],
"article_count": 2,
"threat_score": 62.85,
"recency_score": 0.0,
"coverage_score": 63.11,
"severity_score": 61.0,
"sentiment_score": 80.0,
"geopolitical_score": 81.0,
"actionability_score": 41.0,
"severity_reason": "The incident represents a significant escalation in hybrid warfare tactics attributed to state-sponsored actions.",
"credibility_score": 0.0,
"urgency_level": "medium",
"ranking_score": 0.0,
"keywords": [
"germany",
"shield",
"…"
],
"sources": [
"Dw",
"Rte.Ie"
],
"severity_indicators": [
"pla"
],
"date_range_earliest": "2026-09-05T06:54:54+00:00",
"date_range_latest": "2026-09-06T10:46:40+00:00",
"created_at": "2026-09-06T11:44:17.169223+00:00",
"updated_at": "2026-09-06T11:46:20.876248+00:00",
"recent_article_count_12h": 1,
"recent_article_count_6h": 1,
"insights_count": 0,
"articles": [
{
"uuid": "b46e4478-070b-ac2d-b3d5-8941149de984",
"title": "Is Russia's alleged hybrid war on EU a genuine threat?",
"content": "<p>This week Germany accused Russia of involvement in a drone attack on Leipzig-Halle Airport, marking a new low in relations between the tw…",
"source": "Rte.Ie",
"pub_date": "2026-09-05T06:54:54+00:00",
"url": "https://www.rte.ie/news/2026/0905/1590402-russia-eu-hybrid-attacks/",
"author": "",
"og_image_url": "https://www.rte.ie/images/0024f53c-1600.jpg",
"is_reference_only": false,
"link_source_article_uuid": null,
"link_source_title": null,
"link_source_name": null,
"similarity_score": 0.7067529559135437,
…
}
POST /webhooks
{"webhook_url": "https://httpbin.org/post", "webhook_type": "json", "name": "SOAR intake", "secret_key": "change-me"}{
"webhook": {
"id": 24,
"name": "SOAR intake",
"webhook_url": "https://httpbin.org/post",
"webhook_type": "json",
"is_active": true,
"mssp_customer_id": null,
"created_at": "2026-09-06T12:04:15.167373+00:00",
"has_secret": true,
"scope": "personal"
}
}
POST /alert-rules
{"name": "Stack vendors", "logic_operator": "OR", "conditions": [{"entity_type": "platform", "entity_value": "FortiOS"}, {"entity_type": "company", "entity_value": "Okta"}], "notify_webhook": true, "webhook_id": 24}{
"success": true,
"rule": {
"id": 52,
"uuid": "9c165faf-a99c-49a8-8970-aa95a7e1e985",
"name": "Stack vendors",
"description": null,
"logic_operator": "OR",
"is_active": true,
"notify_webhook": true,
"notify_email": false,
"notify_inapp": true,
"notify_email_address": null,
"webhook_id": 24,
"mssp_customer_id": null,
"created_at": "2026-09-06T12:04:15.861142+00:00",
"conditions": [
{
"id": 459,
"entity_type": "platform",
"entity_value": "FortiOS",
"match_type": "exact",
"created_at": "2026-09-06T12:04:15.861142+00:00"
},
{
"id": 460,
"entity_type": "company",
"entity_value": "Okta",
"match_type": "exact",
"created_at": "2026-09-06T12:04:15.861142+00:00"
}
]
}
}
POST /cve-alerts
{"name": "Fortinet KEV", "vendors": ["Fortinet"], "severity": ["CRITICAL", "HIGH"], "require_kev": true, "notify_webhook": true, "webhook_id": 24}{
"success": true,
"rule": {
"id": 22,
"uuid": "dd2259f4-3d7c-4d58-b36c-4fb7949ac3dd",
"name": "Fortinet KEV",
"description": null,
"is_active": true,
"match_logic": "AND",
"vendors": [
"Fortinet"
],
"products": null,
"cwe_ids": null,
"severity": [
"CRITICAL",
"HIGH"
],
"cvss_min": null,
"cvss_max": null,
"epss_min": null,
"epss_percentile_min": null,
"require_kev": true,
"require_exploit": null,
"ransomware_use": null,
"keywords": null,
"notify_email": false,
"notify_webhook": true,
"notify_inapp": true,
"webhook_id": 24,
"mssp_customer_id": null,
"created_at": "2026-09-06T12:04:16.856241+00:00",
"updated_at": "2026-09-06T12:04:16.856241+00:00"
}
}
POST /alert-rules/9c165faf-a99c-49a8-8970-aa95a7e1e985/test{
"rule_uuid": "9c165faf-a99c-49a8-8970-aa95a7e1e985",
"rule_name": "Stack vendors",
"logic_operator": "OR",
"conditions_count": 2,
"window_days": 7,
"matching_clusters": [
{
"cluster_id": "e057d32f-1ed6-4558-8f9a-15cd4e5deb78",
"title": "AI Infrastructure Under Siege: Session Hijacking and Exploits Surge",
"threat_score": 73.25,
"created_at": "2026-09-05T18:17:26.363704+00:00"
}
],
"total_matches": 1
}
GET /alerts?since=2026-09-06T00:04:14Z&limit=3{
"count": 2,
"limit": 3,
"offset": 0,
"alerts": [
{
"alert_source": "cluster",
"trigger_id": 3484,
"mssp_customer_id": null,
"rule_name": "Alerts: CNI Sector Threats Feed",
"entity_ref": "5505b25f",
"triggered_at": "2026-09-06T11:46:22.832877+00:00",
"disposition": "open",
"disposition_note": null,
"disposed_by": null,
"disposed_at": null
},
{
"alert_source": "cve",
"trigger_id": 48600,
"mssp_customer_id": null,
"rule_name": "CVEs",
"entity_ref": "CVE-2026-78362",
"triggered_at": "2026-09-06T11:45:13.371441+00:00",
"disposition": "open",
"disposition_note": null,
"disposed_by": null,
"disposed_at": null
}
]
}
GET /entities/company/Foxconn/darkweb-profile{
"name": "Foxconn",
"normalised": "foxconn",
"authed": true,
"hero": {
"multi_claim_actors": [],
"multi_claim": false,
"total_articles": 39,
"total_clusters": 7,
"total_leak_sights": 1,
"first_seen": "2025-12-08T18:16:52.019925+00:00",
"last_seen": "2026-07-15T14:02:24+00:00"
},
"leak_sites": [
{
"actor": "incransom",
"category": "ransomware_leak",
"published_at": "2025-12-08T18:16:52.019925+00:00",
"first_seen_at": "2025-12-08T18:16:52.019925+00:00",
"country": "TW",
"industry": "Technology",
"victim_id": "984ba3676d3e8e22",
"victim_domain": "",
"description": "Foxconn Interconnect Technology Limited (FIT) focuses on the development, manufacturing, and marketing of electronic and optoelectronic conn…",
"screenshot_url": null
}
],
"news_clusters": [
{
"cluster_id": "528dc1d6-689f-458a-b971-4c342fab9361",
"ai_title": "Foxconn Cyberattack: Nitrogen Ransomware Claims 8TB of Data Theft",
"article_count": 54,
"threat_score": 71.0,
"date_range_latest": "2026-05-12T22:04:33.683254+00:00",
"og_image_url": null,
"mentions": 24
},
{
"cluster_id": "cfa725bf-e481-4682-b0eb-4693cdddd0f1",
"ai_title": "Tata Electronics Cyber Breach Exposes Apple and Tesla Trade Secrets",
"article_count": 217,
"threat_score": 67.75,
"date_range_latest": "2026-06-22T17:15:08+00:00",
"og_image_url": null,
"mentions": 6
},
"…"
],
"articles": [
{
"uuid": "b6a90175-b0e8-ded7-5c36-500f2c992758",
"title": "Independent Testing Shows Which Business Security Products Actually Hold Up When It Matters",
"source": "Prnewswire",
"url": "https://www.prnewswire.co.uk/news-releases/independent-testing-shows-which-business-security-products-actually-hold-up-when-it-matters-30282…",
"pub_date": "2026-07-15T14:02:24+00:00",
"og_image_url": "https://mmx.prnewswire.com/media/MS1882555/PM_Business_H1_2026_AVC.jpg?id=OA2762342&p=facebook"
},
{
"uuid": "268242b7-2d36-a393-b44f-f5b40e89940e",
"title": "Independent Testing Shows Which Business Security Products Actually Hold Up When It Matters",
"source": "Ca.Finance.Yahoo",
"url": "https://ca.finance.yahoo.com/news/independent-testing-shows-business-security-080000602.html",
"pub_date": "2026-07-15T08:11:19+00:00",
"og_image_url": "https://s.yimg.com/lo/mysterio/api/DEEE955A76987C188683E2F1E67857228074D80E454FC4228D7F31A911740BD0/subgraphmysterio/resizefill_w1200_h675;q…"
},
"…"
],
"related": {
"actors": [
{
…
}
GET /threats/545ca28d/attack-flow{
"cluster_id": "a2e5969c-ad0f-4028-bfda-67e7545ca28d",
"flow": {
"nodes": [
{
"id": "n1",
"type": "initial_access",
"label": "Vulnerable Public-Facing Systems",
"tactic": "TA0001",
"evidence": "QTFY exploits vulnerabilities in internet-facing applications like Ivanti, BeyondTrust, and Check Point devices.",
"technique": "T1190",
"entity_ref": null
},
{
"id": "n2",
"type": "execution",
"label": "Exploit Vulnerabilities",
"tactic": "TA0002",
"evidence": "QTFY uses advanced exploits such as CVE-2024-8190, CVE-2024-8963, CVE-2024-9380, and others to gain initial access.",
"technique": "T1068",
"entity_ref": null
},
"…"
],
"edges": [
{
"to": "n2",
"from": "n1",
"label": "exploits vulnerabilities"
},
{
"to": "n3",
"from": "n2",
"label": "establishes persistence"
},
"…"
],
"notes": "Attack chain synthesizes multiple exploit and lateral movement steps, emphasizing the use of IoT proxies and web shells for persistence and …",
"confidence": 0.9
},
"stix": {
"id": "bundle--3af530c3-e1ca-42d0-bfa6-1ce834536718",
"type": "bundle",
"objects": [
{
"id": "identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d",
"name": "ThreatCluster",
"type": "identity",
"created": "2026-09-02T23:32:24.000Z",
"modified": "2026-09-02T23:32:24.000Z",
"spec_version": "2.1",
"identity_class": "organization"
},
{
"id": "attack-flow--03cf3be3-d451-5523-b295-c4e2f015a2fa",
"name": "China-Linked QTFY Group Targets Critical Infrastructure with Advanced Exploits",
"type": "attack-flow",
"scope": "incident",
"created": "2026-09-02T23:32:24.000Z",
"modified": "2026-09-02T23:32:24.000Z",
"extensions": {
"extension-definition--fb9c968a-a3ea-42f5-b3bf-fc9a9ebad18f": {
"extension_type": "new-sdo"
}
},
"start_refs": [
"attack-action--f8eba790-3c95-590d-bbc0-cfd90ffd5bed",
"attack-action--b89e98fb-4add-5fe0-9afb-9d8abc036923"
],
"description": "Attack chain synthesizes multiple exploit and lateral movement steps, emphasizing the use of IoT proxies and web shells for persistence and …",
…
}
The API, in numbers
Incident records30,988+1,680 this week
Validated indicators35,841+2,491 this week
Leak-site victims22,798+265 this week
Entities177,241+8,372 this week
Articles330,739+20,700 this week
Lead over the trade press5.1 daysMeasured monthly
Build into your existing workflow
The API speaks the formats your tools already read. Each link is a short setup guide.
Terminal
pipx install threatcluster-cli, or plain curl. Drop-in for cron, CI and shell pipelines.
SIEM, firewall, TIP
Point the ingestor at the IOC feed, or import STIX bundles and the MISP manifest.
Agents
Per-session agent keys with scoped budgets, tool definitions from the OpenAPI spec, and cost headers the model can read to pace itself.
Or start from a template
Sector ransomware watchSlack alert · 2 credits CVE triageKEV and EPSS · 1 credit per CVE SIEM indicator enrichmentDomain, IP or hash · 6 credits Exploited this weekKEV or public exploit · 2 credits IOC blocklist exportFirewall or Pi-hole · 3 credits Lookup tool for LLM agentsTool call, cited · 5 credits All 7 scripts
Start from your industry
Every incident is tagged with the sectors it hit. Pick yours to see what is aimed at it right now.
Pricing
Every account gets a free key. Paid plans add history, headroom and the write endpoints. Cancel any time.
Free $0 100 credits a day, the last 7 days
- Every read endpoint: incidents, IOCs, entities, vulnerabilities, dark web
- 30 requests a minute, 25 rows a request
- Public feeds and the IOC blocklist need no key at all
Starter $7.99/ month 1,000 credits a day, 90 days of history
- 120 requests a minute, 50 rows a request
- Custom feeds and alert rules over the API
- Internal business use
Growth $29/ month 5,000 credits a day, the full archive
- 240 requests a minute, 100 rows a request
- Everything in Starter
- The complete corpus back to launch, not a rolling window
Business $199/ month 10,000 credits a day, unlimited rows
- 600 requests a minute, per-key overrides
- +$59 a month per managed customer: own feeds, alerts and branded digest, +10,000 credits a day each
- Org sharing. Redistribution by agreement
A request that finds nothing costs nothing. Past the daily allowance, credit packs: 2,000 for $10, 12,000 for $50, never expire. Full pricing.
FAQ
What does the free key include?
Every read scope over the last 7 days with 100 credits a day: incidents, IOCs, entities, vulnerabilities and dark web. Records are trimmed to the short summary, 3 timeline events and 25 rows per list; the budget resets daily.
How fresh is it?
Incidents form within minutes of the first credible report, and records land a median 5.1 days ahead of the trade press (82 matched incidents, last 90 days). The number is measured, not estimated: our record's creation time against the earliest matching trade-press article. The month-by-month numbers and the full method are on the early-warning report.
How does an incident record get made?
Articles from 20,000+ sources are deduplicated into one cluster per incident as reports arrive. Each record carries a rewritten title and summary, the extracted entities (actors, malware, CVEs, victims), a sourced timeline and a threat score, and it keeps updating as coverage grows. One id to follow instead of twenty headlines.
Where does the dark-web data come from?
Our own Tor collection of ransomware leak sites, with screenshots, extracted data sizes and negotiation state. Not resold from a broker.
Are there code examples?
Yes. The GitHub repository has a daily-refreshed OpenAPI snapshot, a small Python client and real request/response pairs for every major endpoint, and the live spec is browsable as Swagger UI.
Can I redistribute the data?
The public feeds are free with attribution for your own environment and non-commercial community defence. Keyed responses are for your own tooling. Embedding or redistributing in a product you sell is by agreement on Business.
Can I cancel?
Plans are monthly with no minimum term. Cancel from settings and the key keeps working until the end of the period. The free key never expires.
Get started
Mint a free key and make the first call in a minute.