20,000 sources collapsed into one scored record per incident, queryable from your code.
The only threat intelligence API that puts clustered incident reporting, validated IOCs, vulnerability intelligence and first-party dark-web collection behind one free key.
Free key on every account: 100 credits a day, the last 7 days, no card.
The API, in numbers
Incident records21,172+408 this week
Validated indicators13,813+930 this week
Leak-site victims20,587+247 this week
Entities104,835+3,818 this week
Articles214,105+4,159 this week
Lead over the trade press5.1 daysHow we measure it
What the API returns
45+ endpoints over incidents, IOCs, entities, vulnerabilities and the dark web. Pick an endpoint and a language, and see the real response.
Incident records, deduplicated from every source that covered them
GET /threats?time_filter=24hcurl -H "X-API-Key: $TC_KEY" \
"https://threatcluster.io/api/public/v1/threats?time_filter=24h"import requests
r = requests.get("https://threatcluster.io/api/public/v1/threats?time_filter=24h",
headers={"X-API-Key": TC_KEY})
print(r.json())const r = await fetch("https://threatcluster.io/api/public/v1/threats?time_filter=24h",
{headers: {"X-API-Key": process.env.TC_KEY}});
console.log(await r.json());{
"threats": [
{
"cluster_id": "5f578c75-abf8-4fbd-915b-d4037386092f",
"title": "Iranian cyber spies target aviation, fintech developers with new malware",
"ai_title": "Mirage Kitten Targets Aviation and FinTech with New Cross-Platform Malware",
"ai_summary": "The Iranian cyberespionage group Mirage Kitten has launched a campaign targeting technology professionals in the aviation and FinTech sectors across…",
"timeline": [
{
"date": "2026-09-01",
"event": "New malware families identified",
"detail": "Kaspersky reported on the discovery of NodeRabbit and PollCat used by Mirage Kitten to ta…",
"source": "Securelist"
}
],
"article_count": 3,
"threat_score": 78.5,
"severity_score": 80.0,
"urgency_level": "medium",
"keywords": [
"malware",
"iranian"
],
"sources": [
"Thehackernews",
"Therecord.Media"
],
"date_range_latest": "2026-09-01T13:08:58+00:00",
"articles": [
{
"title": "Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new m…",
"source": "Securelist",
"pub_date": "2026-09-01T07:00:26+00:00",
"url": "https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244/"
}
],
"entities": {
"apt_group": [
"Iranian Dream Job",
"Lazarus Group"
],
"attack_type": [
"Malware",
"Phishing"
]
},
"slug": "mirage-kitten-targets-aviation-and-fintech-with-new-cross-pl-7386092f",
"ioc_count": 12
},
{
"cluster_id": "afb356a7-d498-4c89-920a-44025c9b39fa",
"title": "CPAI-2026-10671 - Check Point Software",
"ai_title": "Multiple Remote Code Execution Vulnerabilities Identified in Check Point Software",
"ai_summary": "Check Point Software has issued advisories for two critical remote code execution vulnerabilities. The first, CVE-2026-53576, was published on June 2…",
"timeline": [
{
"date": "2026-06-11",
"event": "CVE-2026-44495 published",
"detail": "Check Point disclosed a remote code execution vulnerability affecting its Security Gatewa…",
"source": "Advisories.Checkpoint"
}
],
"article_count": 2,
"threat_score": 74.0,
"severity_score": 80.0,
"urgency_level": "medium",
"keywords": [
"protection",
"update"
],
"sources": [
"Advisories.Checkpoint"
],
"date_range_latest": "2026-08-31T18:52:57+00:00",
"articles": [
{
"title": "CPAI-2026-10476 - Check Point Software",
"source": "Advisories.Checkpoint",
"pub_date": "2026-08-30T19:04:16+00:00",
"url": "https://advisories.checkpoint.com/defense/advisories/public/2026/cpai-2026-10476.html"
}
],
"entities": {
"attack_type": [
"Zero-Day Exploit"
],
"cve": [
"CVE-2026-44495",
…Indicators validated on ingest, with the incidents behind them
GET /entities/ipv4/172.86.98.113curl -H "X-API-Key: $TC_KEY" \
"https://threatcluster.io/api/public/v1/entities/ipv4/172.86.98.113"import requests
r = requests.get("https://threatcluster.io/api/public/v1/entities/ipv4/172.86.98.113",
headers={"X-API-Key": TC_KEY})
print(r.json())const r = await fetch("https://threatcluster.io/api/public/v1/entities/ipv4/172.86.98.113",
{headers: {"X-API-Key": process.env.TC_KEY}});
console.log(await r.json());{
"entity": {
"entity_type": "ipv4",
"entity_value": "172.86.98.113",
"frequency": 3,
"first_seen": "2026-07-28T08:00:20+00:00",
"last_seen": "2026-08-26T13:14:45.486953+00:00",
"confidence": "false_positive",
"reason": "MISP warninglist: Specialized list of vpn-ipv4 addresses belonging to common VPN provider…"
},
"clusters": [
{
"cluster_id": "93bf14f2-0238-400a-a0c0-75d8682fb07b",
"title": "Tortoiseshell Expands Malware Toolset With New Backdoor, SSH Tunnel",
"ai_title": "Tortoiseshell Expands Malware Arsenal with New Backdoor and SSH Tunneling Tool",
"ai_summary": "The Iranian-linked Tortoiseshell APT group has expanded its malware toolkit, introducing a new backdoor and reverse SSH tunneling utility. Group-IB T…",
"article_count": 6,
"threat_score": 77.0,
"severity_score": 80.0,
"date_range_latest": "2026-08-26T14:30:00+00:00",
"slug": "tortoiseshell-apt-expands-malware-capabilities-with-new-tool-682fb07b"
},
{
"cluster_id": "c6981ff6-0654-4b96-abfc-7934c099231a",
"title": "Cybersecurity Researchers Uncover Mirage Kitten Malware Sweeping Across Africa",
"ai_title": "Mirage Kitten Malware Targets Middle East and Africa with New Toolset",
"ai_summary": "The Mirage Kitten APT group has deployed a sophisticated malware suite, including the NightLedger backdoor, across the Middle East and Africa. This c…",
"article_count": 2,
"threat_score": 75.5,
"severity_score": 80.0,
"date_range_latest": "2026-07-30T06:15:08+00:00",
"slug": "cybersecurity-researchers-uncover-mirage-kitten-malware-swee-c099231a"
}
],
"articles": [
{
"title": "Securelist",
"source": "securelist.com",
"pub_date": "2026-08-26T13:14:45.486953+00:00",
"url": "https://securelist.com/mirage-kitten-new-tools/120811/?kaspr=5bet"
},
{
"title": "Tortoiseshell: New Toolset and Operational Infrastructure Exposed | Group",
"source": "Group-Ib",
"pub_date": "2026-08-26T09:32:20+00:00",
"url": "https://www.group-ib.com/blog/tortoiseshell-apt-toolset-infrastructure/"
}
],
"co_entities_with_counts": {
"apt_group": [
{
"value": "Mirage Kitten",
"count": 3
}
],
"attack_type": [
{
"value": "Malware",
"count": 3
}
],
"platform": [
{
"value": "Windows",
"count": 3
}
],
"malware": [
{
"value": "Twostroke",
"count": 2
}
]
},
"aliases": []
}Leak sites, markets and postings from our own Tor collection
GET /darkweb/keyword-hits?keywords=Intracocurl -H "X-API-Key: $TC_KEY" \
"https://threatcluster.io/api/public/v1/darkweb/keyword-hits?keywords=Intraco"import requests
r = requests.get("https://threatcluster.io/api/public/v1/darkweb/keyword-hits?keywords=Intraco",
headers={"X-API-Key": TC_KEY})
print(r.json())const r = await fetch("https://threatcluster.io/api/public/v1/darkweb/keyword-hits?keywords=Intraco",
{headers: {"X-API-Key": process.env.TC_KEY}});
console.log(await r.json());{
"keywords": [
"Intraco"
],
"hits": {
"victims": [
{
"id": "bdd665d27f502e10",
"victim_name": "PT Intraco Penta Tbk",
"group_name": "direwolf",
"country": "ID",
"sector": "Manufacturing",
"discovered": "2026-09-01T15:53:54.238628+00:00"
}
],
"groups": [],
"markets": [],
"breaches": []
},
"total": 2
}Groups, malware, CVEs and companies as one linked record each
GET /entities/ransomware_group/Qilincurl -H "X-API-Key: $TC_KEY" \
"https://threatcluster.io/api/public/v1/entities/ransomware_group/Qilin"import requests
r = requests.get("https://threatcluster.io/api/public/v1/entities/ransomware_group/Qilin",
headers={"X-API-Key": TC_KEY})
print(r.json())const r = await fetch("https://threatcluster.io/api/public/v1/entities/ransomware_group/Qilin",
{headers: {"X-API-Key": process.env.TC_KEY}});
console.log(await r.json());{
"entity": {
"entity_type": "ransomware_group",
"entity_value": "Qilin",
"frequency": 202,
"first_seen": "2025-10-23T10:00:58+00:00",
"last_seen": "2026-08-28T04:41:40+00:00"
},
"overview": "Qilin is a hacking group associated with ransomware activities, known for deploying malware to encrypt victims’ data and demanding ransom payments. C…",
"clusters": [
{
"cluster_id": "ed358032-faeb-477c-a14e-91043243f6d9",
"title": "Akira Ransomware Group Poses ‘Imminent Threat’ to Critical Infrastructure: CISA",
"ai_title": "Akira Ransomware Group Targets Critical Infrastructure, Extracts $42 Million",
"ai_summary": "The Akira ransomware group has been identified as a significant threat to critical infrastructure, with the U.S. Cybersecurity and Infrastructure Sec…",
"article_count": 9,
"threat_score": 82.98,
"severity_score": 81.0,
"date_range_latest": "2025-11-14T06:57:11+00:00",
"slug": "akira-ransomware-group-targets-critical-infrastructure-extra-3243f6d9"
},
{
"cluster_id": "ed641903-140b-473f-ac63-c68536ffb106",
"title": "Pharma Firm Inotiv Confirms Data Breach Following Ransomware Attack",
"ai_title": "Inotiv Confirms Data Breach from August 2025 Ransomware Attack",
"ai_summary": "Inotiv, an Indiana-based pharmaceutical firm, has confirmed a data breach resulting from a ransomware attack that occurred in August 2025. The compan…",
"article_count": 4,
"threat_score": 78.81,
"severity_score": 75.0,
"date_range_latest": "2025-12-08T07:52:53+00:00",
"slug": "inotiv-confirms-data-breach-from-august-2025-ransomware-atta-36ffb106"
}
],
"articles": [
{
"title": "Two TeamPCP members arrested in Australia",
"source": "News.Risky.Biz",
"pub_date": "2026-08-28T04:41:40+00:00",
"url": "https://news.risky.biz/risky-bulletin-two-teampcp-members-arrested-in-australia/"
},
{
"title": "6054150 Atf Investigating Cybersecurity Incident Doj Qilin",
"source": "thehill.com",
"pub_date": "2026-08-27T18:34:38.113720+00:00",
"url": "https://thehill.com/homenews/administration/6054150-atf-investigating-cybersecurity-incident-doj-qi…"
}
],
"co_entities_with_counts": {
"attack_type": [
{
"value": "Ransomware",
"count": 180
}
],
"ransomware_group": [
{
"value": "Akira",
"count": 53
}
],
"industry": [
{
"value": "Government",
"count": 35
}
],
"platform": [
{
"value": "Windows",
"count": 31
}
]
},
"aliases": []
}One term across incidents, indicators, entities and leak sites
GET /search?q=Intracocurl -H "X-API-Key: $TC_KEY" \
"https://threatcluster.io/api/public/v1/search?q=Intraco"import requests
r = requests.get("https://threatcluster.io/api/public/v1/search?q=Intraco",
headers={"X-API-Key": TC_KEY})
print(r.json())const r = await fetch("https://threatcluster.io/api/public/v1/search?q=Intraco",
{headers: {"X-API-Key": process.env.TC_KEY}});
console.log(await r.json());{
"query": "Intraco",
"clusters": [],
"entities": [],
"darkweb": [
{
"type": "victim",
"name": "PT Intraco Penta Tbk",
"id": "bdd665d27f502e10",
"date": "2026-09-01T15:53:54.238628+00:00",
"group": "direwolf",
"country": "ID",
"sector": "Manufacturing"
}
],
"limit": 10,
"total": 1
}A cited answer, from the reporting itself
POST /threats/{id}/ask
{"action": "recommended_actions"}curl -X POST -H "X-API-Key: $TC_KEY" -H "Content-Type: application/json" \
-d '{"action": "recommended_actions"}' \
"https://threatcluster.io/api/public/v1/threats/windows-afdsys-zero-f15d3d54/ask"import requests
r = requests.post("https://threatcluster.io/api/public/v1/threats/windows-afdsys-zero-f15d3d54/ask",
headers={"X-API-Key": TC_KEY}, json={"action": "recommended_actions"})
print(r.json()["answer"])const r = await fetch("https://threatcluster.io/api/public/v1/threats/windows-afdsys-zero-f15d3d54/ask", {
method: "POST", headers: {"X-API-Key": TC_KEY, "Content-Type": "application/json"},
body: JSON.stringify({action: "recommended_actions"}) });
console.log((await r.json()).answer);{
"answer": "**Patch first.** Apply the AFD.sys fix from the February cumulative update; the exploited build range is 10.0.19041–22631 [A1].\n- **Detection** — hunt for afd.sys crash events (0x7E) preceding new service creation [A2] [A3].\n- **Containment** — Lazarus tooling stages via a signed loader; block the listed hashes at the EDR [A4].\n- ...",
"sources": [ {"tag": "A1", "title": "Microsoft: CVE-2026-… actively exploited", "url": "https://…"}, {"tag": "A2", "title": "…"} ],
"context_used": {"cluster_title": "Lazarus Group Exploits Windows Zero-Day to Target Defense Sector", "primary_articles_used": 7, "cves_enriched": 1},
"cost": 25,
"cached": false
}POST /ask
{"query": "Which ransomware groups hit healthcare this week, and how?"}curl -X POST -H "X-API-Key: $TC_KEY" -H "Content-Type: application/json" \
-d '{"query": "Which ransomware groups hit healthcare this week, and how?"}' \
"https://threatcluster.io/api/public/v1/ask"import requests
r = requests.post("https://threatcluster.io/api/public/v1/ask", headers={"X-API-Key": TC_KEY},
json={"query": "Which ransomware groups hit healthcare this week, and how?"})
print(r.json()["answer"])const r = await fetch("https://threatcluster.io/api/public/v1/ask", {
method: "POST", headers: {"X-API-Key": TC_KEY, "Content-Type": "application/json"},
body: JSON.stringify({query: "Which ransomware groups hit healthcare this week, and how?"}) });
console.log((await r.json()).answer);{
"answer": "Three groups named healthcare victims in the last seven days.\n- **Qilin** listed a UK NHS supplier, 400 GB claimed, initial access via a Citrix appliance [C1] [C2].\n- **INC Ransom** posted two US clinics; both reports describe phishing to a billing platform login [C3].\n- **Rhysida** ...",
"sources": [ {"tag": "C1", "cluster_id": "…", "title": "Qilin claims UK NHS supplier…", "url": "https://threatcluster.io/cluster/…"} ],
"context_used": {"engine": "agent", "tool_calls": [{"tool": "leak_site_victims", "args": {"days": 7, "sector": "Healthcare"}}], "clusters_matched": 6, "victims_listed": 15},
"cost": 50,
"cached": false
}GET /threats?time_filter=7d&sort_by=score{
"threats": [
{
"cluster_id": "32e38748-219f-4340-853f-7c4593fb80f8",
"title": "Chinese Speaking Operator Philippine Nuclear Naval Contractor",
"ai_title": "Chinese Operator Breaches Philippine Nuclear and Naval Entities",
"ai_summary": "A suspected Chinese-speaking operator has compromised a Philippine nuclear research body and a marine engineering company supporting the Philippine N…",
"timeline": [
{
"date": "2023-11-21",
"event": "CVE-2023-49105 published",
"detail": "Authentication-bypass flaw in ownCloud allows unauthorized file access via WebDAV.",
"source": "Article 2"
}
],
"article_count": 4,
"threat_score": 80.7,
"severity_score": 81.0,
"urgency_level": "medium",
"keywords": [
"philippine",
"nuclear"
],
"sources": [
"hunt.io",
"Securityaffairs.Co"
],
"date_range_latest": "2026-08-31T12:34:31.263942+00:00",
"articles": [
{
"title": "Philippine Nuclear and Naval Targets Hit by Suspected Chinese Operator",
"source": "Securityaffairs.Co",
"pub_date": "2026-08-29T09:16:52+00:00",
"url": "https://securityaffairs.com/198041/intelligence/philippine-nuclear-and-naval-targets-hit-by-suspect…"
}
],
"entities": {
"attack_type": [
"Data Breach"
],
"campaign": [
"Operation CameraSwarm"
]
},
"slug": "chinese-speaking-actor-breaches-philippine-nuclear-and-naval-93fb80f8",
"ioc_count": 4
},
{
"cluster_id": "5f578c75-abf8-4fbd-915b-d4037386092f",
"title": "Iranian cyber spies target aviation, fintech developers with new malware",
"ai_title": "Mirage Kitten Targets Aviation and FinTech with New Cross-Platform Malware",
"ai_summary": "The Iranian cyberespionage group Mirage Kitten has launched a campaign targeting technology professionals in the aviation and FinTech sectors across…",
"timeline": [
{
"date": "2026-09-01",
"event": "New malware families identified",
"detail": "Kaspersky reported on the discovery of NodeRabbit and PollCat used by Mirage Kitten to ta…",
"source": "Securelist"
}
],
"article_count": 3,
"threat_score": 78.5,
"severity_score": 80.0,
"urgency_level": "medium",
"keywords": [
"malware",
"iranian"
],
"sources": [
"Thehackernews",
"Therecord.Media"
],
"date_range_latest": "2026-09-01T13:08:58+00:00",
"articles": [
{
"title": "Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new m…",
"source": "Securelist",
"pub_date": "2026-09-01T07:00:26+00:00",
"url": "https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244/"
}
],
"entities": {
"apt_group": [
"Iranian Dream Job",
"Lazarus Group"
],
"attack_type": [
"Malware",
…
GET /threats?keyword=Windows{
"threats": [
{
"cluster_id": "93bf14f2-0238-400a-a0c0-75d8682fb07b",
"title": "Tortoiseshell Expands Malware Toolset With New Backdoor, SSH Tunnel",
"ai_title": "Tortoiseshell Expands Malware Arsenal with New Backdoor and SSH Tunneling Tool",
"ai_summary": "The Iranian-linked Tortoiseshell APT group has expanded its malware toolkit, introducing a new backdoor and reverse SSH tunneling utility. Group-IB T…",
"timeline": [
{
"date": "2026-08-26",
"event": "Group-IB publishes findings on Tortoiseshell",
"detail": "Group-IB identified new malware samples and infrastructure linked to Tortoiseshell, revea…",
"source": "Group-IB"
}
],
"article_count": 6,
"threat_score": 77.0,
"severity_score": 80.0,
"urgency_level": "medium",
"keywords": [
"tortoiseshell",
"toolset"
],
"sources": [
"Infosecurity-Magazine",
"Gbhackers"
],
"date_range_latest": "2026-08-26T14:30:00+00:00",
"articles": [
{
"title": "Tortoiseshell: New Toolset and Operational Infrastructure Exposed | Group",
"source": "Group-Ib",
"pub_date": "2026-08-26T09:32:20+00:00",
"url": "https://www.group-ib.com/blog/tortoiseshell-apt-toolset-infrastructure/"
}
],
"entities": {
"apt_group": [
"GalaxyGato",
"Imperial Kitten"
],
"attack_type": [
"Data Breach",
"Malware"
]
},
"slug": "tortoiseshell-apt-expands-malware-capabilities-with-new-tool-682fb07b",
"ioc_count": 10
},
{
"cluster_id": "2984a6af-53aa-42eb-b22d-e01373643c61",
"title": "Suspected China-linked espionage campaign targets India's finance ecosystem: Seqrite",
"ai_title": "China-Linked Cyber Espionage Targets India's Tax Ecosystem",
"ai_summary": "Seqrite has reported a cyber-espionage campaign named Operation DragonReturn, targeting India's taxpayer ecosystem by impersonating the Income Tax De…",
"timeline": [
{
"date": "2026-08-31",
"event": "Seqrite discloses Operation DragonReturn",
"detail": "Seqrite reveals a cyber-espionage campaign targeting India's tax ecosystem, leveraging ph…",
"source": "Crnasia"
}
],
"article_count": 2,
"threat_score": 76.25,
"severity_score": 80.0,
"urgency_level": "medium",
"keywords": [
"campaign",
"seqrite"
],
"sources": [
"Crnasia",
"Itvoice.In"
],
"date_range_latest": "2026-08-31T07:05:10+00:00",
"articles": [
{
"title": "Seqrite Uncovers China-Linked Cyber Espionage Campaign Targeting India's Tax Ecosystem",
"source": "Itvoice.In",
"pub_date": "2026-08-31T07:00:01+00:00",
"url": "https://www.itvoice.in/seqrite-uncovers-operation-dragonreturn-china-nexus-cyber-espionage-campaign…"
}
],
"entities": {
"attack_type": [
"Malware",
"Phishing"
],
…
GET /threats?keyword=NASA{
"threats": [
{
"cluster_id": "466996d6-4a06-43a7-af8c-116354a06405",
"title": "US officials backpedal on claims that government agencies were hacked by Chinese",
"ai_title": "US Officials Clarify Cyberattack Claims Involving Chinese Hackers",
"ai_summary": "On August 28, 2026, U.S. officials revised previous statements claiming that several government agencies were hacked by Chinese spies. The Justice De…",
"timeline": [
{
"date": "2026-08-25",
"event": "Initial claims of hacking made",
"detail": "U.S. officials initially claimed that multiple government agencies had been hacked by Chi…",
"source": "Databreaches"
}
],
"article_count": 6,
"threat_score": 43.0,
"severity_score": 41.0,
"urgency_level": "medium",
"keywords": [
"officials",
"claims"
],
"sources": [
"Databreaches",
"Straitstimes"
],
"date_range_latest": "2026-08-29T15:02:26+00:00",
"articles": [
{
"title": "US officials backpedal on claims that government agencies were hacked by Chinese, now ...",
"source": "Straitstimes",
"pub_date": "2026-08-29T09:17:02+00:00",
"url": "https://www.straitstimes.com/world/united-states/us-officials-backpedal-on-claims-that-government-a…"
}
],
"entities": {
"apt_group": [
"QTFY"
],
"attack_type": [
"Data Breach"
]
},
"slug": "us-officials-clarify-cyberattack-claims-involving-chinese-ha-54a06405",
"ioc_count": 0
}
],
"count": 1,
"limit": 50,
"offset": 0,
"time_filter": "7d",
"sort_by": "trending"
}
GET /threats?keyword=healthcare{
"threats": [
{
"cluster_id": "3c37d8bc-d676-48ec-aabd-a7fe732cdfd2",
"title": "Attack hides malware in PNGs and drops custom reverse tunnel on victims' machines",
"ai_title": "Healthcare Cyberattacks Disrupt Patient Care and Expose Sensitive Data",
"ai_summary": "Two major healthcare companies, Boston Scientific and Nutex Health, reported cyberattacks that compromised patient data and disrupted operations. Bos…",
"timeline": [
{
"date": "2026-08-24",
"event": "Nutex Health discloses cyberattack",
"detail": "Nutex confirmed unauthorized access to sensitive patient and employee data, with threats…",
"source": "Article 4"
}
],
"article_count": 4,
"threat_score": 71.0,
"severity_score": 80.0,
"urgency_level": "medium",
"keywords": [
"researcher",
"shows"
],
"sources": [
"Theregister"
],
"date_range_latest": "2026-08-31T18:26:03+00:00",
"articles": [
{
"title": "Anthropic cracks down on hijacked user accounts mining AI tokens",
"source": "Theregister",
"pub_date": "2026-08-31T16:03:46+00:00",
"url": "https://www.theregister.com/security/2026/08/31/anthropic-cracks-down-on-hijacked-user-accounts-min…"
}
],
"entities": {
"attack_type": [
"Data Breach",
"Malware"
],
"campaign": [
"ClickFix",
"TerminalFix"
]
},
"slug": "new-malware-campaign-exploits-pngs-and-infostealers-for-acco-732cdfd2",
"ioc_count": 0
},
{
"cluster_id": "468a50ef-290c-4ca4-bf97-0a645e837ef6",
"title": "9.5 Million Impacted by Aesto Health Data Breach",
"ai_title": "Aesto Health Data Breach Exposes 9.5 Million Patients' Information",
"ai_summary": "A data breach at Aesto Health, a healthcare technology company in Birmingham, Alabama, was discovered on December 18, 2025. The breach affected at le…",
"timeline": [
{
"date": "2025-12-02",
"event": "Unauthorized access began",
"detail": "Hackers accessed Aesto Health's AWS infrastructure, compromising sensitive data.",
"source": "Hipaajournal"
}
],
"article_count": 4,
"threat_score": 69.0,
"severity_score": 80.0,
"urgency_level": "medium",
"keywords": [
"aesto",
"health"
],
"sources": [
"www.aestohealth.com",
"Feeds.Feedburner"
],
"date_range_latest": "2026-09-01T09:16:19.170172+00:00",
"articles": [
{
"title": "Aesto Health Data Breach Affects 9.5 Million Patients",
"source": "Hipaajournal",
"pub_date": "2026-09-01T06:07:50+00:00",
"url": "https://www.hipaajournal.com/aesto-health-data-breach/"
}
],
"entities": {
"attack_type": [
"Data Breach"
],
"company": [
"Aesto Health",
…
GET /threats?keyword=Australia{
"threats": [
{
"cluster_id": "16404270-63df-4325-8911-ffbf6ff3f4df",
"title": "Two Alleged ‘TeamPCP’ Hackers Arrested in Australia",
"ai_title": "TeamPCP Hackers Arrested for Major Supply Chain Attacks",
"ai_summary": "On August 26, 2026, Australian Federal Police arrested two men, Ruben Thomson and Louis Gaebler, linked to the TeamPCP hacking group. This group is n…",
"timeline": [
{
"date": "2026-04-01",
"event": "Investigation into TeamPCP begins",
"detail": "The AFP and FBI started investigating TeamPCP after receiving information from cybersecur…",
"source": "BleepingComputer"
}
],
"article_count": 26,
"threat_score": 70.25,
"severity_score": 80.0,
"urgency_level": "medium",
"keywords": [
"arrested",
"cybercrime"
],
"sources": [
"Feeds.Feedburner",
"Abc.Au"
],
"date_range_latest": "2026-08-27T11:04:15+00:00",
"articles": [
{
"title": "Two Perth hackers charged after major AFP, FBI investigation into alleged global cybercrime",
"source": "Abc.Au",
"pub_date": "2026-08-27T05:45:10+00:00",
"url": "https://www.abc.net.au/news/2026-08-27/two-wa-men-charged-after-investigation-into-alleged-cybercri…"
}
],
"entities": {
"apt_group": [
"TeamPCP"
],
"attack_type": [
"Botnet",
"Data Breach"
]
},
"slug": "teampcp-hackers-arrested-in-australia-amid-global-cybercrime-6ff3f4df",
"ioc_count": 0
},
{
"cluster_id": "1e07dd9a-62c5-4a2a-8455-e6a64b7705b1",
"title": "Zbt Darklantern Speakingstone",
"ai_title": "Backdoors Found in ZBT Routers Sold Globally",
"ai_summary": "ZBT routers, widely sold under various brands, have been found to contain multiple backdoors, including 'SpeakingStone' and 'DarkLantern'. These impl…",
"timeline": [
{
"date": "2026-08-06",
"event": "Backdoor discovery announced",
"detail": "Jacob Baines revealed ZBT's router firmware contains a root-level backdoor named 'Endless…",
"source": "Darkreading"
}
],
"article_count": 5,
"threat_score": 64.25,
"severity_score": 70.0,
"urgency_level": "medium",
"keywords": [
"routers",
"chinese"
],
"sources": [
"www.vulncheck.com",
"Darkreading"
],
"date_range_latest": "2026-08-27T20:02:41.584871+00:00",
"articles": [
{
"title": "Chinese Routers Sold Worldwide Contain Backdoors",
"source": "Darkreading",
"pub_date": "2026-08-27T19:31:45+00:00",
"url": "https://www.darkreading.com/vulnerabilities-threats/chinese-routers-sold-worldwide-backdoors"
}
],
"entities": {
"attack_type": [
"Malware",
"Man-in-the-Middle"
],
"company": [
…
GET /threats?keyword=CVE-2026-46037{
"threats": [
{
"cluster_id": "da662236-d210-4fa9-8968-7b30cebb7ea4",
"title": "SUSE Kernel RT Security Update 2026-23264",
"ai_title": "Multiple SUSE Kernel RT Security Updates Address Critical Vulnerabilities",
"ai_summary": "SUSE has released a series of important security updates for its Linux Enterprise Kernel, addressing multiple vulnerabilities across various versions…",
"timeline": [
{
"date": "2026-02-14",
"event": "CVE-2026-23161 published",
"detail": "A race condition in mm/shmem and swap was disclosed, affecting memory management.",
"source": "Linuxsecurity"
}
],
"article_count": 40,
"threat_score": 67.25,
"severity_score": 70.0,
"urgency_level": "medium",
"keywords": [
"security",
"linux"
],
"sources": [
"Linuxsecurity"
],
"date_range_latest": "2026-08-26T16:51:07+00:00",
"articles": [
{
"title": "SUSE Linux Enterprise Kernel RT Important Security Update 2026-23267",
"source": "Linuxsecurity",
"pub_date": "2026-08-26T16:41:14+00:00",
"url": "https://linuxsecurity.com/advisories/suse/suse-2026-23267-1-kernel-rt"
}
],
"entities": {
"company": [
"SUSE"
],
"cve": [
"CVE-2023-53995",
"CVE-2025-40204"
],
"cwe": [
"CWE-122 - Heap-based Buffer Overflow",
"CWE-125 - Out-of-bounds Read"
],
"platform": [
"Linux",
"SUSE Linux Enterprise 15 SP7 RT Kernel"
]
},
"slug": "multiple-suse-kernel-rt-security-updates-address-critical-vu-cebb7ea4",
"ioc_count": 0
}
],
"count": 1,
"limit": 50,
"offset": 0,
"time_filter": "7d",
"sort_by": "trending"
}
GET /threats/93fb80f8{
"cluster_id": "32e38748-219f-4340-853f-7c4593fb80f8",
"title": "Chinese Speaking Operator Philippine Nuclear Naval Contractor",
"ai_title": "Chinese Operator Breaches Philippine Nuclear and Naval Entities",
"ai_summary": "A suspected Chinese-speaking operator has compromised a Philippine nuclear research body and a marine engineering company supporting the Philippine N…",
"timeline": [
{
"date": "2023-11-21",
"event": "CVE-2023-49105 published",
"detail": "Authentication-bypass flaw in ownCloud allows unauthorized file access via WebDAV.",
"source": "Article 2"
}
],
"article_count": 4,
"threat_score": 80.7,
"severity_score": 81.0,
"urgency_level": "medium",
"keywords": [
"philippine",
"nuclear",
"operator"
],
"sources": [
"hunt.io",
"Securityaffairs.Co"
],
"date_range_latest": "2026-08-31T12:34:31.263942+00:00",
"articles": [
{
"title": "Philippine Nuclear and Naval Targets Hit by Suspected Chinese Operator",
"source": "Securityaffairs.Co",
"pub_date": "2026-08-29T09:16:52+00:00",
"url": "https://securityaffairs.com/198041/intelligence/philippine-nuclear-and-naval-targets-hit-by-suspect…"
},
{
"title": "Chinese operator exploits a 3-year",
"source": "Pasqualepillitteri.It",
"pub_date": "2026-08-30T20:09:53+00:00",
"url": "https://pasqualepillitteri.it/en/news/13473/chinese-operator-philippine-nuclear-data-owncloud"
}
],
"entities": {
"attack_type": [
"Data Breach"
],
"campaign": [
"Operation CameraSwarm"
],
"company": [
"CGI Global Limited",
"Naval Contractor",
"Philippine Nuclear Agency"
],
"country": [
"Philippines",
"Russia",
"Ukraine"
]
},
"slug": "chinese-speaking-actor-breaches-philippine-nuclear-and-naval-93fb80f8"
}
GET /threats/93fb80f8/iocs{
"iocs": [
{
"type": "ipv4",
"value": "31.58.209.241",
"confidence": "high",
"reason": "IP address hosting stolen data and offensive tools"
},
{
"type": "domain",
"value": "fine-work-team.com",
"confidence": "high",
"reason": "Listed as a delivery URL for a malicious script"
}
],
"count": 4,
"cluster_id": "93fb80f8"
}
GET /threats/93fb80f8/stix{
"type": "bundle",
"id": "bundle--40db38a3-6c4f-4ffd-9a79-ceb3a8d00241",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d",
"created": "2026-09-01T17:46:29.497276Z",
"modified": "2026-09-01T17:46:29.497276Z",
"name": "ThreatCluster",
"description": "Automated threat intelligence aggregation and clustering platform",
"identity_class": "organization",
"sectors": [
"technology"
],
"contact_information": "https://threatcluster.io"
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--92a159b2-33b1-57f7-b60c-9f340bf16776",
"created_by_ref": "identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d",
"created": "2026-09-01T17:46:29.497716Z",
"modified": "2026-09-01T17:46:29.497716Z",
"name": "Mettle",
"malware_types": [
"unknown"
],
"is_family": true,
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
}
]
}
GET /vulnerabilities?kev_only=true&days=7{
"cves": [
{
"cve_id": "CVE-2026-82078",
"description": "An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperC…",
"cvss_v3_score": 9.1,
"cvss_v3_severity": "CRITICAL",
"affected_vendors": [
"papercut"
],
"affected_products": [
"papercut_mf",
"papercut_ng"
],
"cpe_configurations": [
{
"vendor": "papercut",
"product": "papercut_mf",
"criteria": "cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*",
"vulnerable": true,
"version_end": "24.1.9",
"version_end_op": "excluding"
}
],
"in_kev": true,
"has_exploit": false,
"epss_score": 0.0046,
"epss_percentile": 0.3826,
"published_date": "2026-08-28T16:18:31.240000",
"last_modified": "2026-09-01T04:18:02.160000"
},
{
"cve_id": "CVE-2026-81578",
"description": "An improper access control vulnerability exists in the web management interface of PaperCut MF and…",
"cvss_v3_score": 9.8,
"cvss_v3_severity": "CRITICAL",
"affected_vendors": [
"papercut"
],
"affected_products": [
"papercut_mf",
"papercut_ng"
],
"cpe_configurations": [
{
"vendor": "papercut",
"product": "papercut_mf",
"criteria": "cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*",
"vulnerable": true,
"version_end": "24.1.9",
"version_end_op": "excluding"
}
],
"in_kev": true,
"has_exploit": true,
"epss_score": 0.0039,
"epss_percentile": 0.324,
"published_date": "2026-08-28T16:18:29.600000",
"last_modified": "2026-09-01T04:18:01.990000"
}
],
"total": 3,
"page": 1,
"limit": 50,
"pages": 1,
"days": 7
}
GET /vulnerabilities?has_exploit=true{
"cves": [
{
"cve_id": "CVE-2026-82539",
"description": "A vulnerability was determined in TOTOLINK A720R 4.1.5cu.630_B20250509. This impacts the function s…",
"cvss_v3_score": 9.1,
"cvss_v3_severity": "CRITICAL",
"in_kev": false,
"has_exploit": true,
"epss_score": 0.006,
"epss_percentile": 0.4628,
"published_date": "2026-08-30T11:17:35.067000",
"last_modified": "2026-08-31T20:56:08.800000"
},
{
"cve_id": "CVE-2026-55511",
"description": "Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPr…",
"cvss_v3_score": 9.1,
"cvss_v3_severity": "CRITICAL",
"in_kev": false,
"has_exploit": true,
"epss_score": 0.0068,
"epss_percentile": 0.4996,
"published_date": "2026-08-28T20:18:27.947000",
"last_modified": "2026-09-01T02:16:58.397000"
}
],
"total": 51,
"page": 1,
"limit": 50,
"pages": 2,
"days": 30
}
GET /vulnerabilities/CVE-2026-46037{
"cve_id": "CVE-2026-46037",
"description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: icmp: validate reply typ…",
"cvss_v3_score": 8.2,
"cvss_v3_severity": "HIGH",
"affected_vendors": [
"linux"
],
"affected_products": [
"linux_kernel"
],
"cpe_configurations": [
{
"vendor": "linux",
"product": "linux_kernel",
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"version_end": "5.15.209",
"version_start": "5.13",
"version_end_op": "excluding",
"version_start_op": "including"
},
{
"vendor": "linux",
"product": "linux_kernel",
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"version_end": "6.1.175",
"version_start": "5.16",
"version_end_op": "excluding",
"version_start_op": "including"
}
],
"in_kev": false,
"has_exploit": false,
"epss_score": 0.0043,
"epss_percentile": 0.3614,
"published_date": "2026-05-27T14:17:23.027000",
"last_modified": "2026-06-17T10:52:56.583000",
"id": 15467161,
"cvss_v3_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"reference_urls": [
{
"url": "https://git.kernel.org/stable/c/67bf002a2d7387a6312138210d0bd06e3cf4879b",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/92e7c209036dcc0e8ffdf806fdfd3645b263bea5",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"exploit_count": 0,
"fetched_at": "2026-06-26T23:30:16.327186",
"epss_updated_at": "2026-09-01T05:00:08.133433"
}
GET /entities/domain/businesswire.com{
"entity": {
"entity_type": "domain",
"entity_value": "businesswire.com",
"frequency": 172,
"first_seen": "2026-03-30T14:34:29+00:00",
"last_seen": "2026-08-30T18:03:55+00:00",
"confidence": "false_positive",
"reason": "MISP warninglist: Top 1 000 000 websites from Cisco Umbrella"
},
"clusters": [
{
"cluster_id": "70c6fdc1-40ff-45f4-81a5-f71898a55c29",
"title": "Sygnia Reveals New Activity by China",
"ai_title": "Fire Ant Threat Actor Targets Trusted Infrastructure in 2026",
"ai_summary": "The China-nexus threat actor known as Fire Ant has evolved its tactics in 2026, transitioning from targeting VMware hypervisors to compromising trust…",
"article_count": 13,
"threat_score": 77.75,
"severity_score": 80.0,
"date_range_latest": "2026-08-30T18:03:55+00:00",
"slug": "china-nexus-threat-actor-fire-ant-targets-critical-infrastru-98a55c29"
},
{
"cluster_id": "8d40b34e-bcb7-4aff-b194-bae9df8632a5",
"title": "CrowdStrike 2026 Financial Services Threat Landscape Report",
"ai_title": "North Korean Cyber Adversaries Steal Billions from Financial Sector",
"ai_summary": "In 2025, North Korean-linked adversaries stole billions in digital assets, significantly impacting the financial services sector. The CrowdStrike 202…",
"article_count": 3,
"threat_score": 75.5,
"severity_score": 80.0,
"date_range_latest": "2026-05-14T17:06:57+00:00",
"slug": "north-korean-cyber-adversaries-steal-billions-from-financial-df8632a5"
}
],
"articles": [
{
"title": "Sygnia Reveals New Activity by China",
"source": "Morningstar",
"pub_date": "2026-08-30T18:03:55+00:00",
"url": "https://www.morningstar.com/news/business-wire/20260830433829/sygnia-reveals-new-activity-by-china-…"
},
{
"title": "Visa Expands Support for its Clients and the Industry as Organizations Navigate New AI Era ...",
"source": "Afp",
"pub_date": "2026-08-27T18:45:37+00:00",
"url": "https://www.afp.com/en/infos/visa-expands-support-its-clients-and-industry-organizations-navigate-n…"
}
],
"co_entities_with_counts": {
"attack_type": [
{
"value": "Phishing",
"count": 23
}
],
"mitre_attack": [
{
"value": "T1566 - Phishing",
"count": 19
}
],
"industry": [
{
"value": "Financial",
"count": 18
}
],
"country": [
{
"value": "United States",
"count": 10
}
]
},
"aliases": []
}
GET /entities/sha256/a9a71d111f2233634b91e0e08fe6b6f74a09f69e73ca09df1e9189594d1b1295{
"entity": {
"entity_type": "sha256",
"entity_value": "a9a71d111f2233634b91e0e08fe6b6f74a09f69e73ca09df1e9189594d1b1295",
"frequency": 2,
"first_seen": "2026-08-28T05:32:53.679219+00:00",
"last_seen": "2026-09-01T12:20:50.225501+00:00",
"confidence": "high",
"reason": "Listed among other hashes in a context suggesting they are malware samples"
},
"clusters": [
{
"cluster_id": "60b31b89-a1b3-4fb9-8b8c-46b1c18ccc2a",
"title": "PaperCut warns of NG, MF flaw exploited in zero",
"ai_title": "PaperCut NG/MF Vulnerability Under Active Exploitation",
"ai_summary": "On August 27, 2026, PaperCut issued an urgent advisory regarding a zero-day vulnerability affecting its NG and MF print management software. This fla…",
"article_count": 53,
"threat_score": 72.9,
"severity_score": 81.0,
"date_range_latest": "2026-08-27T16:48:35.471839+00:00",
"slug": "critical-zero-day-exploitation-of-papercut-ngmf-vulnerabilit-c18ccc2a"
}
],
"articles": [
{
"title": "Security Bulletin 27 Aug 2026 Urgent Security Advisory",
"source": "www.papercut.com",
"pub_date": "2026-09-01T12:20:50.225501+00:00",
"url": "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory"
},
{
"title": "Security Bulletin 27 Aug 2026 Urgent Security Advisory",
"source": "www.papercut.com",
"pub_date": "2026-08-28T05:32:53.679219+00:00",
"url": "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory?lid=0na0tu4…"
}
],
"co_entities_with_counts": {
"mitre_attack": [
{
"value": "T1190 - Exploit Public-Facing Application",
"count": 1
}
],
"tool": [
{
"value": "Pc-app.exe",
"count": 1
}
]
},
"aliases": []
}
GET /iocs/feed?format=txtacrobatreaderonline.com bookcheckarrival-gueststayhotel.com browser-app.com browsify.co case-apple.com ccleanerwind.top chat-apple.com cleankits.co coldcardteamnews.com crpx0.su cryptoprice.pw databreach.space
GET /iocs/feed?types=domainacrobatreaderonline.com bookcheckarrival-gueststayhotel.com browser-app.com browsify.co case-apple.com ccleanerwind.top chat-apple.com cleankits.co coldcardteamnews.com crpx0.su cryptoprice.pw databreach.space
GET /iocs/feed?format=json{
"iocs": [
{
"type": "domain",
"value": "acrobatreaderonline.com",
"confidence": "high",
"reason": "[article sweep] Used as a malicious site impersonating Adobe Acrobat Reader."
},
{
"type": "domain",
"value": "bookcheckarrival-gueststayhotel.com",
"confidence": "high",
"reason": "Indicates attacker-controlled phishing domain targeting hotel reservations."
}
],
"count": 629,
"confidence_filter": "confirmed",
"hours": 720
}
GET /iocs/feed?enrich=true&format=json{
"iocs": [
{
"type": "domain",
"value": "acrobatreaderonline.com",
"confidence": "high",
"reason": "[article sweep] Used as a malicious site impersonating Adobe Acrobat Reader.",
"clusters": [],
"sources": [
{
"source": "Cybersecuritynews",
"title": "New Malware-as-a-service Leveraging Adobe",
"url": "https://cybersecuritynews.com/malware-as-a-service-adobe-themed-domain/",
"pub_date": "2026-08-24 04:47:41+00:00"
}
]
},
{
"type": "domain",
"value": "bookcheckarrival-gueststayhotel.com",
"confidence": "high",
"reason": "Indicates attacker-controlled phishing domain targeting hotel reservations.",
"clusters": [
{
"cluster_id": "ca52b3c3-ad7b-4a47-981a-c7695de22ad8",
"title": "Phishing Attacks Target Hotels via Compromised Booking Data",
"url": "https://threatcluster.io/cluster/phishing-waves-cyberattacks-on-it-service-providers-for-hote-5de22…",
"threat_score": 61.5
}
],
"sources": [
{
"source": "Heise.De",
"title": "Phishing waves: Cyberattacks on IT service providers for hotels",
"url": "https://www.heise.de/en/news/Phishing-waves-Cyberattacks-on-IT-service-providers-for-hotels-1141219…",
"pub_date": "2026-08-13 06:24:31+00:00"
}
]
}
],
"count": 629,
"confidence_filter": "confirmed",
"hours": 720,
"enriched": true
}
GET /iocs/feed?format=csvtype,value,confidence,reason domain,acrobatreaderonline.com,high,[article sweep] Used as a malicious site impersonating Adobe Acrobat Reader. domain,bookcheckarrival-gueststayhotel.com,high,Indicates attacker-controlled phishing domain targeting hotel reservations. domain,browser-app.com,high,[article sweep] Domain used in a malicious browser extension campaign domain,browsify.co,high,[article sweep] Domain used in a malicious browser extension campaign domain,case-apple.com,high,[article sweep] Used in phishing scams impersonating Apple domain,ccleanerwind.top,high,Identified as attacker-controlled domain for malware distribution domain,chat-apple.com,high,[article sweep] Used in phishing scams impersonating Apple domain,cleankits.co,high,[article sweep] Associated with malicious Firefox extensions domain,coldcardteamnews.com,high,[article sweep] Used in a phishing campaign impersonating COLDCARD domain,crpx0.su,high,[article sweep] Identified as hosting a panel for a ransomware group domain,cryptoprice.pw,high,Listed as a service advertised by the actor for scams and malware delivery
GET /iocs/exportacrobatreaderonline.com bookcheckarrival-gueststayhotel.com browser-app.com browsify.co case-apple.com ccleanerwind.top chat-apple.com cleankits.co coldcardteamnews.com crpx0.su cryptoprice.pw databreach.space
GET /iocs/export?confidence=confirmed&format=json{
"iocs": [
{
"type": "domain",
"value": "acrobatreaderonline.com",
"confidence": "high",
"reason": "[article sweep] Used as a malicious site impersonating Adobe Acrobat Reader."
},
{
"type": "domain",
"value": "bookcheckarrival-gueststayhotel.com",
"confidence": "high",
"reason": "Indicates attacker-controlled phishing domain targeting hotel reservations."
}
],
"count": 675,
"confidence_filter": "confirmed",
"hours": 720,
"pending_count": 15
}
GET /threats/93fb80f8/iocs{
"iocs": [
{
"type": "ipv4",
"value": "31.58.209.241",
"confidence": "high",
"reason": "IP address hosting stolen data and offensive tools"
},
{
"type": "domain",
"value": "fine-work-team.com",
"confidence": "high",
"reason": "Listed as a delivery URL for a malicious script"
}
],
"count": 4,
"cluster_id": "93fb80f8"
}
GET /darkweb/ransomware/victims?days=7{
"victims": [
{
"id": "a4834f3163071aad",
"group": "rhysida",
"name": "Szechenyi Programiroda Nonprofit Kf",
"discovered": "2026-09-01 17:27:14.520298+00:00",
"country": "HU",
"sector": "Other",
"description": "Szechenyi Programiroda Nonprofit Kf",
"first_party": false,
"delisted": false,
"fp_has_note": false,
"fp_cats": 0
},
{
"id": "cb54d554aa40187f",
"group": "direwolf",
"name": "Oportunidados",
"discovered": "2026-09-01 16:25:03.194416+00:00",
"country": "BR",
"sector": "Not Found",
"description": "Business Services",
"website": "oportunidados.com.br",
"screenshot_url": "https://images.ransomware.live/victims/9d4bac68747992372f0db1e71b4bfd07.png",
"first_party": false,
"delisted": false,
"fp_has_note": false,
"fp_cats": 0
}
],
"count": 100
}
GET /darkweb/ransomware/victims?sector=Manufacturing{
"victims": [
{
"id": "bdd665d27f502e10",
"group": "direwolf",
"name": "PT Intraco Penta Tbk",
"discovered": "2026-09-01 15:53:54.238628+00:00",
"country": "ID",
"sector": "Manufacturing",
"description": "Industrial Machinery & Equipment",
"website": "intracopenta.com",
"screenshot_url": "https://images.ransomware.live/victims/174fc69efa77c10734c28c363a781bc4.png",
"first_party": false,
"delisted": false,
"fp_has_note": false,
"fp_cats": 0
},
{
"id": "7c85020e4123931c",
"group": "akira",
"name": "Congressional Iron Works",
"discovered": "2026-09-01 15:21:40.812015+00:00",
"sector": "Manufacturing",
"description": "Congressional Iron Works is a full-service miscellaneous metals contractor serving the commerci\nal…",
"first_party": false,
"delisted": false,
"fp_has_note": false,
"fp_cats": 0
}
],
"count": 100
}
GET /darkweb/ransomware/victims?country=ID{
"victims": [
{
"id": "bdd665d27f502e10",
"group": "direwolf",
"name": "PT Intraco Penta Tbk",
"discovered": "2026-09-01 15:53:54.238628+00:00",
"country": "ID",
"sector": "Manufacturing",
"description": "Industrial Machinery & Equipment",
"website": "intracopenta.com",
"screenshot_url": "https://images.ransomware.live/victims/174fc69efa77c10734c28c363a781bc4.png",
"first_party": false,
"delisted": false,
"fp_has_note": false,
"fp_cats": 0
},
{
"id": "0e90632976a3f63c",
"group": "shadowbyt3$",
"name": "Sinar Mas Agribusiness and Food Golden Agri-Resources)",
"discovered": "2026-08-25 14:26:02.536617+00:00",
"country": "ID",
"sector": "Agriculture and Food Production",
"description": "We Breached This company a few months ago. we stole 375.66MB.\nmirror 1: https://anonfilesnew.com/s/…",
"website": "www.smart-tbk.com",
"screenshot_url": "https://images.ransomware.live/victims/87a3d45930ebf5b2b152bb7bb58f291d.png",
"first_party": false,
"delisted": false,
"fp_has_note": false,
"fp_cats": 0
}
],
"count": 9
}
GET /darkweb/ransomware/victims?group=direwolf{
"victims": [
{
"id": "cb54d554aa40187f",
"group": "direwolf",
"name": "Oportunidados",
"discovered": "2026-09-01 16:25:03.194416+00:00",
"country": "BR",
"sector": "Not Found",
"description": "Business Services",
"website": "oportunidados.com.br",
"screenshot_url": "https://images.ransomware.live/victims/9d4bac68747992372f0db1e71b4bfd07.png",
"first_party": false,
"delisted": false,
"fp_has_note": false,
"fp_cats": 0
},
{
"id": "591a6d4c1db2a096",
"group": "direwolf",
"name": "Honeycomb Programs Inc",
"discovered": "2026-09-01 15:54:31.468817+00:00",
"country": "US",
"sector": "Other",
"description": "Insurance",
"website": "honeycombinsurance.com",
"screenshot_url": "https://images.ransomware.live/victims/7b226d1f66632ea92e72a12b32712cfc.png",
"first_party": false,
"delisted": false,
"fp_has_note": false,
"fp_cats": 0
}
],
"count": 46
}
GET /darkweb/ransomware/victim/bdd665d27f502e10{
"id": "bdd665d27f502e10",
"victim_name": "PT Intraco Penta Tbk",
"group_name": "direwolf",
"discovered": "2026-09-01 15:53:54.238628+00:00",
"country": "ID",
"sector": "Manufacturing",
"description": "Industrial Machinery & Equipment",
"website": "intracopenta.com",
"post_url": "http://direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.onion/api/public/articles/117",
"entities": {},
"first_party": false,
"related_group_victims": [
{
"id": "cb54d554aa40187f",
"victim_name": "Oportunidados",
"discovered": "2026-09-01 16:25:03.194416+00:00",
"country": "BR",
"sector": "Not Found"
},
{
"id": "591a6d4c1db2a096",
"victim_name": "Honeycomb Programs Inc",
"discovered": "2026-09-01 15:54:31.468817+00:00",
"country": "US",
"sector": "Other"
}
]
}
GET /darkweb/ransomware/group/direwolf{
"name": "direwolf",
"description": "Dire Wolf is a sophisticated human-operated ransomware group first documented in May 2025, written…",
"active": false,
"has_captcha": false,
"first_seen": "2025-04-17 00:00:00+00:00",
"last_seen": "2026-08-30 14:35:36.508000+00:00",
"tools": [],
"urls": [
"http://direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.onion"
],
"profile_links": [],
"recent_victims": [
{
"id": "cb54d554aa40187f",
"name": "Oportunidados",
"discovered": "2026-09-01 16:25:03.194416+00:00",
"country": "BR",
"sector": "Not Found",
"first_party": false,
"delisted": false
},
{
"id": "591a6d4c1db2a096",
"name": "Honeycomb Programs Inc",
"discovered": "2026-09-01 15:54:31.468817+00:00",
"country": "US",
"sector": "Other",
"first_party": false,
"delisted": false
}
],
"screenshot_url": "https://threatcluster.lon1.digitaloceanspaces.com/darkweb-groups/direwolf/20260901T033014Z.png",
"page_title": "DireWolf",
"ai_description": "DireWolf's homepage displays a list of victim companies with associated data sizes, publication dat…",
"ai_risk_tags": [
"countdown_timer",
"data_published_badges",
"victim_list"
],
"ai_language": "en",
"captcha_or_login_gate": false,
"scraped_at": "2026-09-01T03:30:18.180614+00:00",
"entities": {
"company": [
"Allstar Industries",
"Authenticate Information Systems",
"Deer Creek-Mackinaw CUSD"
],
"country": [
"Australia",
"Austria",
"Brazil"
],
"industry": [
"Business Services",
"Education",
"Engineering Software"
]
},
"mirrors": [
{
"url": "http://direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.onion",
"alive": null,
"last_alive_at": null,
"last_checked_at": null,
"consecutive_failures": 0,
"text_bytes": null
}
],
"screenshot_is_victim_page": false,
"first_party_only": [],
"first_party_count": 30,
"total_victims": 109
}
GET /darkweb/ransomware/groups?active_only=true{
"groups": [
{
"name": "qilin",
"active": true,
"victim_count": 2070,
"recent_victim_count_30d": 158,
"last_seen": "2026-09-01 03:56:51.567977+00:00",
"description": "Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supp…",
"has_captcha": false,
"profile_links": [],
"tools": [
"Mimikatz",
"EDRSandBlast"
]
},
{
"name": "akira",
"active": true,
"victim_count": 1377,
"recent_victim_count_30d": 34,
"last_seen": "2026-08-31 00:00:00+00:00",
"description": "The Akira ransomware group is said to have emerged in March 2023, and there's much speculation abou…",
"has_captcha": false,
"profile_links": [],
"tools": [
"DonPAPI",
"LaZagne"
]
}
],
"count": 85
}
GET /darkweb/breaches{
"breaches": [
{
"id": 852,
"name": "SynthientCredentialStuffingThreatData",
"domain": "",
"breach_date": "2025-04-11",
"added_date": "2025-11-06 04:58:49+00:00",
"pwn_count": 1957476021,
"description": "During 2025, <a href=\"https://www.troyhunt.com/2-billion-email-addresses-were-exposed-and-we-indexe…",
"logo_url": "https://logos.haveibeenpwned.com/List.png",
"data_classes": [
"Email addresses",
"Passwords"
],
"is_verified": true,
"is_sensitive": false
},
{
"id": 198,
"name": "Collection1",
"domain": "",
"breach_date": "2019-01-07",
"added_date": "2019-01-16 21:46:07+00:00",
"pwn_count": 772904991,
"description": "In January 2019, a large collection of credential stuffing lists (combinations of email addresses a…",
"logo_url": "https://logos.haveibeenpwned.com/List.png",
"data_classes": [
"Email addresses",
"Passwords"
],
"is_verified": false,
"is_sensitive": false
}
],
"count": 50
}
GET /darkweb/ransomware/victims/facets?days=30{
"countries": [
{
"value": "US",
"count": 412
},
{
"value": "DE",
"count": 70
}
],
"sectors": [
{
"value": "Manufacturing",
"count": 185
},
{
"value": "Technology",
"count": 164
}
],
"groups": [
{
"value": "qilin",
"count": 158
},
{
"value": "thegentlemen",
"count": 115
}
]
}
GET /darkweb/trends?weeks=8{
"victims_weekly": [
{
"week": "2026-07-06",
"count": 185
},
{
"week": "2026-07-13",
"count": 176
}
],
"top_industries": [
{
"industry": "Manufacturing",
"count": 400
},
{
"industry": "Technology",
"count": 331
}
],
"group_heatmap": {
"groups": [
"qilin",
"thegentlemen",
"incransom"
],
"weeks": [
"2026-06-08",
"2026-06-15",
"2026-06-22"
],
"cells": {
"qilin": [
19,
21
],
"thegentlemen": [
5,
34
]
}
}
}
GET /darkweb/stats{
"ransomware_groups": 164,
"total_victims": 20523,
"victims_last_7d": 281,
"victims_last_30d": 1219,
"breaches_known": 1032,
"last_updated": "2026-09-01T16:45:02.520706+00:00",
"data_source": "database"
}
GET /entities/apt_group/Volt%20Typhoon{
"entity": {
"entity_type": "apt_group",
"entity_value": "Volt Typhoon",
"frequency": 102,
"first_seen": "2025-10-29T12:59:40+00:00",
"last_seen": "2026-08-27T14:45:56+00:00"
},
"overview": "Volt Typhoon is a cyber espionage Advanced Persistent Threat (APT) group believed to operate primarily from China, targeting critical infrastructure…",
"clusters": [
{
"cluster_id": "b1286d86-7a9c-43c4-9697-1cbcb94c0224",
"title": "Threat actor leveraged Cisco SD-WAN zero-day since 2023 (CVE-2026-20127)",
"ai_title": "Cisco SD-WAN Zero-Day Exploited by Threat Actor Since 2023",
"ai_summary": "A cyber threat actor has been exploiting a zero-day vulnerability (CVE-2026-20127) in Cisco Catalyst SD-WAN Controller since 2023. This vulnerability…",
"article_count": 104,
"threat_score": 82.13,
"severity_score": 82.6,
"date_range_latest": "2026-02-25T16:58:31+00:00",
"slug": "cisco-sd-wan-zero-day-exploited-by-threat-actor-since-2023-b94c0224"
},
{
"cluster_id": "bb0dbba1-2e42-40a6-b988-67be916848f5",
"title": "Critical FortiWeb WAF Flaw Actively Exploited to Establish Admin Access and Seize Total Control",
"ai_title": "FortiWeb WAF Vulnerability Enables Full Admin Control Exploitation",
"ai_summary": "A critical vulnerability in FortiWeb Web Application Firewall (WAF) has been actively exploited, allowing attackers to gain full administrative acces…",
"article_count": 100,
"threat_score": 79.52,
"severity_score": 93.15,
"date_range_latest": "2025-11-15T10:02:37+00:00",
"slug": "fortiweb-waf-vulnerability-enables-full-admin-control-exploi-916848f5"
}
],
"articles": [
{
"title": "U.S. Says Chinese Hackers Targeted Senate, NASA, Hospitals, and More",
"source": "Time",
"pub_date": "2026-08-27T14:45:56+00:00",
"url": "https://time.com/article/2026/08/27/china-hack-federal-agencies-cybersecurity-qtfy-senate-nasa/"
},
{
"title": "China Hacked NASA, Federal Reserve: FBI Seizes Platforms Behind Eight",
"source": "Techtimes",
"pub_date": "2026-08-27T13:47:51+00:00",
"url": "https://www.techtimes.com/articles/325708/20260827/china-hacked-nasa-federal-reserve-fbi-seizes-pla…"
}
],
"co_entities_with_counts": {
"country": [
{
"value": "China",
"count": 43
}
],
"apt_group": [
{
"value": "Salt Typhoon",
"count": 31
}
],
"industry": [
{
"value": "Energy",
"count": 30
}
],
"attack_type": [
{
"value": "Malware",
"count": 27
}
]
},
"aliases": []
}
GET /entities/malware/Vidar{
"entity": {
"entity_type": "malware",
"entity_value": "Vidar",
"frequency": 91,
"first_seen": "2025-11-07T09:44:57+00:00",
"last_seen": "2026-08-31T21:08:46+00:00"
},
"overview": "Vidar is a modular information-stealer malware family primarily used to harvest sensitive data such as personal information, credentials, and cryptoc…",
"clusters": [
{
"cluster_id": "4be45cfb-af53-487f-b336-37e9a87caff8",
"title": "GhostShell Targets Ukraine's UAV and Defense Supply Chain",
"ai_title": "GhostShell Malware Targets Ukraine's UAV and Defense Supply Chain",
"ai_summary": "The GhostShell malware cluster is actively targeting Ukraine’s UAV operations and defense supply chain. Utilizing advanced techniques such as mTLS-au…",
"article_count": 2,
"threat_score": 79.35,
"severity_score": 80.0,
"date_range_latest": "2026-06-25T16:51:35+00:00",
"slug": "ghostshell-targets-ukraines-uav-and-defense-supply-chain-a87caff8"
},
{
"cluster_id": "408e93b6-cc90-45ae-a164-94496e04b360",
"title": "Are The Notorious Cyber Criminals Evil Corp Actually Russian Spies",
"ai_title": "Operation Endgame Disrupts Evil Corp's SocGholish Malware Network",
"ai_summary": "On June 18, 2026, international law enforcement agencies launched Operation Endgame, disrupting the SocGholish malware infrastructure linked to the R…",
"article_count": 67,
"threat_score": 78.0,
"severity_score": 80.0,
"date_range_latest": "2026-06-18T12:33:31.474167+00:00",
"slug": "are-the-notorious-cyber-criminals-evil-corp-actually-russian-6e04b360"
}
],
"articles": [
{
"title": "Anthropic Users Hit by Infostealer Attacks, Session Thefts",
"source": "Darkreading",
"pub_date": "2026-08-31T21:08:46+00:00",
"url": "https://www.darkreading.com/cyberattacks-data-breaches/anthropic-users-infostealer-attacks-session-…"
},
{
"title": "Hackers Target Claude Accounts With Malware That Steals Login Sessions",
"source": "Pymnts",
"pub_date": "2026-08-31T20:53:26+00:00",
"url": "https://www.pymnts.com/news/artificial-intelligence/2026/hackers-target-claude-accounts-with-malwar…"
}
],
"co_entities_with_counts": {
"attack_type": [
{
"value": "Malware",
"count": 86
}
],
"platform": [
{
"value": "Windows",
"count": 56
}
],
"malware": [
{
"value": "StealC",
"count": 35
}
],
"mitre_attack": [
{
"value": "T1003 - OS Credential Dumping",
"count": 23
}
]
},
"aliases": []
}
GET /entities/company/NASA{
"entity": {
"entity_type": "company",
"entity_value": "NASA",
"frequency": 38,
"first_seen": "2025-11-30T07:53:56+00:00",
"last_seen": "2026-08-29T20:12:25+00:00"
},
"overview": "NASA, the National Aeronautics and Space Administration, is a U.S. federal government agency responsible for civilian space exploration, space scienc…",
"clusters": [
{
"cluster_id": "0e424056-44c8-4efe-8212-385dcfbb3fff",
"title": "Critical NASA AIT",
"ai_title": "Critical Vulnerability in NASA Ground Control Software Allows Unauthenticated Access",
"ai_summary": "A critical vulnerability in NASA's AMMOS Instrument Toolkit (AIT-GUI) software, tracked as GHSA-p9r8-2q67-fp86, allows unauthenticated attackers to i…",
"article_count": 7,
"threat_score": 78.0,
"severity_score": 90.0,
"date_range_latest": "2026-08-20T15:24:09+00:00",
"slug": "nasa-ait-gui-vulnerability-allows-unauthenticated-command-ex-cfbb3fff"
},
{
"cluster_id": "7b801b8d-477b-4769-b969-b142c59695c3",
"title": "How Chinese-Nexus Cyber Operations Have Evolved",
"ai_title": "Evolution of Chinese-Nexus Cyber Operations: Strategic Long-Term Threats",
"ai_summary": "Recent research from Darktrace reveals the evolution of Chinese-nexus cyber operations over the past two decades, highlighting a shift from high-volu…",
"article_count": 381,
"threat_score": 72.5,
"severity_score": 80.0,
"date_range_latest": "2026-04-02T10:37:49+00:00",
"slug": "evolution-of-chinese-nexus-cyber-operations-strategic-long-t-c59695c3"
}
],
"articles": [
{
"title": "US Officials Revise China Hacking Claims, Say Agencies Were Targeted",
"source": "Freepressjournal.In",
"pub_date": "2026-08-29T20:12:25+00:00",
"url": "https://www.freepressjournal.in/world/us-officials-revise-china-hacking-claims-say-agencies-were-ta…"
},
{
"title": "US officials backpedal on claims that government agencies were hacked by Chinese",
"source": "Databreaches",
"pub_date": "2026-08-29T15:02:26+00:00",
"url": "https://databreaches.net/2026/08/29/us-officials-backpedal-on-claims-that-government-agencies-were-…"
}
],
"co_entities_with_counts": {
"company": [
{
"value": "Federal Reserve",
"count": 24
}
],
"industry": [
{
"value": "Government",
"count": 23
}
],
"tool": [
{
"value": "QScan",
"count": 16
}
],
"country": [
{
"value": "China",
"count": 15
}
]
},
"aliases": []
}
GET /entities/platform/Windows{
"entity": {
"entity_type": "platform",
"entity_value": "Windows",
"frequency": 3026,
"first_seen": "2025-10-24T12:00:00+00:00",
"last_seen": "2026-09-01T16:41:10+00:00"
},
"overview": "Windows is a family of operating system platforms developed by Microsoft, designed to provide a graphical user interface and manage hardware and soft…",
"clusters": [
{
"cluster_id": "606197c6-712a-4d70-a437-49aa6a0b6977",
"title": "Chrome 143 Released With Fix for 13 Vulnerabilities that Enables Arbitrary Code Execution",
"ai_title": "Google Addresses Eighth Chrome Zero-Day Vulnerability in 2025",
"ai_summary": "Google has issued emergency updates to address the eighth zero-day vulnerability in Chrome for 2025. The flaw, identified as 466192044, was actively…",
"article_count": 45,
"threat_score": 96.9,
"severity_score": 100.0,
"date_range_latest": "2025-12-11T08:01:21+00:00",
"slug": "google-addresses-eighth-chrome-zero-day-vulnerability-in-202-6a0b6977"
},
{
"cluster_id": "1528e8d6-728a-4dc1-b355-97ee56e97522",
"title": "CVE-2025-14733 Vulnerability: WatchGuard Addresses a Critical RCE Affecting Firebox ...",
"ai_title": "China-linked Cyber Group Expands Targeting to Southeastern Europe",
"ai_summary": "A sophisticated threat actor known as UAT-7290, tracked by Cisco Talos, has expanded its operations to target telecommunications providers in Southea…",
"article_count": 1,
"threat_score": 95.89,
"severity_score": 100.0,
"date_range_latest": "2026-01-08T23:39:12+00:00",
"slug": "china-linked-cyber-group-expands-targeting-to-southeastern-e-56e97522"
}
],
"articles": [
{
"title": "Fake Claude Desktop App Used to Spread Malware Targeting Crypto Wallets",
"source": "Tech.Yahoo",
"pub_date": "2026-09-01T16:41:10+00:00",
"url": "https://tech.yahoo.com/cybersecurity/articles/fake-claude-desktop-app-used-160700784.html"
},
{
"title": "Fake Claude desktop app spreads crypto-stealing malware",
"source": "Tradingview",
"pub_date": "2026-09-01T14:20:39+00:00",
"url": "https://www.tradingview.com/news/cointelegraph:ffbe2a04e094b:0-fake-claude-desktop-app-spreads-cryp…"
}
],
"co_entities_with_counts": {
"attack_type": [
{
"value": "Malware",
"count": 1338
}
],
"platform": [
{
"value": "Linux",
"count": 563
}
],
"mitre_attack": [
{
"value": "T1059.001 - PowerShell",
"count": 388
}
],
"tool": [
{
"value": "PowerShell",
"count": 356
}
]
},
"aliases": []
}
GET /entities/country/Australia{
"entity": {
"entity_type": "country",
"entity_value": "Australia",
"frequency": 991,
"first_seen": "2025-10-23T20:19:43+00:00",
"last_seen": "2026-08-31T22:10:38+00:00"
},
"overview": "Australia is a sovereign country consisting of the mainland Australian continent, the island of Tasmania, and numerous smaller islands. It is recogni…",
"clusters": [
{
"cluster_id": "14224782-0262-4282-b1e6-52b01bce6f08",
"title": "Victorian student information stolen in major data breach",
"ai_title": "Major Cyber Attack on Victorian Government Schools Exposes Student Data",
"ai_summary": "Hackers have compromised the personal information of thousands of current and former students in Victorian government schools. The breach includes na…",
"article_count": 19,
"threat_score": 83.11,
"severity_score": 84.0,
"date_range_latest": "2026-01-14T10:11:03+00:00",
"slug": "major-cyber-attack-on-victorian-government-schools-exposes-s-1bce6f08"
},
{
"cluster_id": "b1286d86-7a9c-43c4-9697-1cbcb94c0224",
"title": "Threat actor leveraged Cisco SD-WAN zero-day since 2023 (CVE-2026-20127)",
"ai_title": "Cisco SD-WAN Zero-Day Exploited by Threat Actor Since 2023",
"ai_summary": "A cyber threat actor has been exploiting a zero-day vulnerability (CVE-2026-20127) in Cisco Catalyst SD-WAN Controller since 2023. This vulnerability…",
"article_count": 104,
"threat_score": 82.13,
"severity_score": 82.6,
"date_range_latest": "2026-02-25T16:58:31+00:00",
"slug": "cisco-sd-wan-zero-day-exploited-by-threat-actor-since-2023-b94c0224"
}
],
"articles": [
{
"title": "Healthcare cyberattacks hit pacemakers and millions of patient records",
"source": "Theregister",
"pub_date": "2026-08-31T22:10:38+00:00",
"url": "https://www.theregister.com/cyber-crime/2026/08/31/healthcare-cyberattacks-hit-pacemakers-and-milli…"
},
{
"title": "SEPT. 8-10: Top Cyber Experts from Federal Agencies, Companies, and Allies Share ...",
"source": "Uk.Finance.Yahoo",
"pub_date": "2026-08-31T21:01:46+00:00",
"url": "https://uk.finance.yahoo.com/news/sept-8-10-top-cyber-205400910.html"
}
],
"co_entities_with_counts": {
"country": [
{
"value": "United States",
"count": 238
}
],
"attack_type": [
{
"value": "Data Breach",
"count": 190
}
],
"industry": [
{
"value": "Government",
"count": 130
}
],
"mitre_attack": [
{
"value": "T1566 - Phishing",
"count": 77
}
]
},
"aliases": []
}
GET /entities/cve/CVE-2026-46037{
"entity": {
"entity_type": "cve",
"entity_value": "CVE-2026-46037",
"frequency": 15,
"first_seen": "2026-07-21T10:02:39+00:00",
"last_seen": "2026-09-01T08:19:48.157769+00:00"
},
"clusters": [
{
"cluster_id": "3716ea53-84da-497b-a06e-522e50bf594e",
"title": "USN-8664-1: Linux kernel (NVIDIA BaseOS) vulnerabilities",
"ai_title": "Critical Linux Kernel Vulnerabilities Affecting Ubuntu Systems",
"ai_summary": "Multiple security vulnerabilities have been identified in the Linux kernel affecting Ubuntu 24.04 and 26.04 LTS. Key issues include improper isolatio…",
"article_count": 8,
"threat_score": 72.75,
"severity_score": 81.0,
"date_range_latest": "2026-08-20T23:31:14+00:00",
"slug": "vulnerabilities-in-amd-processors-affect-linux-kernel-securi-50bf594e"
},
{
"cluster_id": "884c17df-2b61-44be-a77a-589d65c97e75",
"title": "USN-8566-1: Linux kernel vulnerabilities",
"ai_title": "Critical Vulnerabilities in Linux Kernel Affect AMD Processors",
"ai_summary": "Multiple vulnerabilities have been identified in the Linux kernel affecting AMD processors, specifically in the floating point divider unit and Zen 2…",
"article_count": 60,
"threat_score": 72.75,
"severity_score": 81.0,
"date_range_latest": "2026-07-20T15:45:34+00:00",
"slug": "usn-8566-1-linux-kernel-vulnerabilities-65c97e75"
}
],
"articles": [
{
"title": "Suse Su 202623290 1",
"source": "www.suse.com",
"pub_date": "2026-09-01T08:19:48.157769+00:00",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202623290-1/"
},
{
"title": "Suse Su 202623288 1",
"source": "www.suse.com",
"pub_date": "2026-09-01T08:19:47.058937+00:00",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202623288-1/"
}
],
"co_entities_with_counts": {
"cve": [
{
"value": "CVE-2026-43109",
"count": 13
}
],
"platform": [
{
"value": "Linux",
"count": 12
}
],
"cwe": [
{
"value": "Cwe-416 - Use After Free",
"count": 8
}
]
},
"aliases": []
}
GET /entities/cve/CVE-2026-46037/related{
"entity_type": "cve",
"entity_value": "CVE-2026-46037",
"related": [
{
"entity_type": "platform",
"entity_value": "Linux",
"shared_clusters": 4,
"co_occurrences": 170
},
{
"entity_type": "company",
"entity_value": "SuSE",
"shared_clusters": 2,
"co_occurrences": 12
}
],
"sub_relationships": [
{
"source": "Linux",
"target": "Data Breach",
"shared_clusters": 200
},
{
"source": "Linux",
"target": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"shared_clusters": 5
}
]
}
GET /entities/trending?time_filter=7d{
"trending": {
"apt_group": [
{
"value": "Volt Typhoon",
"frequency": 7,
"change": 600.0,
"is_new": false
}
],
"attack_type": [
{
"value": "Malware",
"frequency": 194,
"change": 23.6,
"is_new": false
}
],
"campaign": [
{
"value": "Operation Jackal IV",
"frequency": 3,
"change": 200.0,
"is_new": false
}
],
"company": [
{
"value": "NASA",
"frequency": 28,
"change": 1300.0,
"is_new": false
}
]
},
"time_filter": "7d"
}
GET /entities/search?q=lock{
"entities": [
{
"entity_type": "ransomware_group",
"entity_value": "Lockbit",
"article_count": 154,
"cluster_count": 87
},
{
"entity_type": "platform",
"entity_value": "BitLocker",
"article_count": 39,
"cluster_count": 23
}
],
"count": 20,
"total": 163,
"limit": 20,
"offset": 0,
"query": "lock"
}
GET /stats/entities/timeline?entity_type=ransomware_group&days=30{
"entity_type": "ransomware_group",
"days": 30,
"timeline": {
"dates": [
"2026-08-03",
"2026-08-04",
"2026-08-05"
],
"entities": [
{
"name": "Qilin",
"counts": [
0,
0
]
}
]
}
}
GET /search?q=CVE-2026-46037{
"query": "CVE-2026-46037",
"clusters": [
{
"short_id": "cebb7ea4",
"cluster_id": "da662236-d210-4fa9-8968-7b30cebb7ea4",
"slug": "multiple-suse-kernel-rt-security-updates-address-critical-vu-cebb7ea4",
"ai_title": "Multiple SUSE Kernel RT Security Updates Address Critical Vulnerabilities",
"ai_summary": "SUSE has released a series of important security updates for its Linux Enterprise Kernel, addressing multiple vulnerabilities across various versions…",
"urgency_level": "medium",
"keywords": [
"security",
"linux"
],
"threat_score": 67.25,
"severity_score": 70.0,
"article_count": 40,
"date_range_latest": "2026-08-26T16:51:07+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
}
],
"entities": [
{
"entity_type": "cve",
"entity_value": "CVE-2026-46037",
"cluster_count": 4,
"article_count": 15
}
],
"darkweb": [],
"limit": 10,
"total": 2
}
GET /search?q=fortigate{
"query": "fortigate",
"clusters": [
{
"short_id": "b4c3b813",
"cluster_id": "d210e6b1-58d9-40aa-8d82-8b7eb4c3b813",
"slug": "hackers-breached-a-small-polish-energy-plant-via-private-apn-b4c3b813",
"ai_title": "Cyberattack on Polish Energy Sector Exploits Private APN Vulnerability",
"ai_summary": "In December 2025, hackers breached a Polish combined heat and power (CHP) plant using a private Access Point Name (APN) to access the operational tec…",
"urgency_level": "medium",
"keywords": [
"hackers",
"private"
],
"threat_score": 77.0,
"severity_score": 80.0,
"article_count": 8,
"date_range_latest": "2026-08-10T23:07:21+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
},
{
"short_id": "23e56b38",
"cluster_id": "4fe5a130-915f-4685-a552-542623e56b38",
"slug": "fortigate-1200g-brings-fortisase-outpost-to-customer-23e56b38",
"ai_title": "Fortinet Launches FortiGate 1200G with Integrated SASE Capabilities",
"ai_summary": "Fortinet has introduced the FortiGate 1200G series, enhancing its firewall offerings with integrated FortiSASE Outpost capabilities. This new series…",
"urgency_level": "medium",
"keywords": [
"fortigate",
"fortisase"
],
"threat_score": 21.9,
"severity_score": 21.0,
"article_count": 2,
"date_range_latest": "2026-07-29T08:38:45+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
}
],
"entities": [
{
"entity_type": "platform",
"entity_value": "Fortigate",
"cluster_count": 35,
"article_count": 71
},
{
"entity_type": "platform",
"entity_value": "Fortinet FortiGate",
"cluster_count": 7,
"article_count": 9
}
],
"darkweb": [],
"limit": 10,
"total": 19
}
GET /search?q=Qilin{
"query": "Qilin",
"clusters": [
{
"short_id": "3a29f452",
"cluster_id": "b2c83a72-8d2c-4913-bb97-47c73a29f452",
"slug": "qilin-ransomware-gang-targets-atf-in-cyberattack-3a29f452",
"ai_title": "Qilin Ransomware Gang Claims Attack on ATF, Major Incident Declared",
"ai_summary": "The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) is investigating a major cybersecurity incident after the Qilin ransomware gang claimed…",
"urgency_level": "medium",
"keywords": [
"ransomware",
"attack"
],
"threat_score": 61.25,
"severity_score": 70.0,
"article_count": 31,
"date_range_latest": "2026-08-26T22:35:02+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
},
{
"short_id": "2f4929ac",
"cluster_id": "5eb440b4-5ec7-457d-befd-98c12f4929ac",
"slug": "mexicos-cybersecurity-plan-addresses-rising-ransomware-threa-2f4929ac",
"ai_title": "Mexico's Cybersecurity Plan Addresses Rising Ransomware Threats",
"ai_summary": "Mexico's National Cybersecurity Plan, introduced in December 2025, aims to tackle increasing cyber threats, particularly ransomware, which has seen 2…",
"urgency_level": "medium",
"keywords": [
"mexico",
"cybersecurity"
],
"threat_score": 56.0,
"severity_score": 61.0,
"article_count": 2,
"date_range_latest": "2026-08-25T19:22:28+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
}
],
"entities": [
{
"entity_type": "ransomware_group",
"entity_value": "Qilin",
"cluster_count": 124,
"article_count": 202
},
{
"entity_type": "ransomware_group",
"entity_value": "Qilin Ransomware",
"cluster_count": 12,
"article_count": 12
}
],
"darkweb": [
{
"type": "victim",
"name": "Commission de la construction du Quebec",
"id": "87989ff49ba65be4",
"date": "2026-09-01T03:57:10.128191+00:00",
"group": "qilin",
"country": "CA",
"sector": "Government & Defense"
},
{
"type": "victim",
"name": "Inmac",
"id": "cc74ad77dd5371e1",
"date": "2026-08-31T19:02:21.022361+00:00",
"group": "qilin",
"country": "AR",
"sector": "Retail & E-Commerce"
}
],
"limit": 10,
"total": 30
}
GET /search?q=Volt%20Typhoon{
"query": "Volt Typhoon",
"clusters": [
{
"short_id": "36dd11fb",
"cluster_id": "cd4e93a9-6b89-4dc7-afad-be8536dd11fb",
"slug": "antares-backs-affirmative-cyber-war-cover-for-us-essential-36dd11fb",
"ai_title": "Antares Launches Cyber War Coverage for US Critical Infrastructure Operators",
"ai_summary": "Antares' Lloyd's Syndicate 1274 has introduced a new affirmative cyber war product for US critical infrastructure providers, including power, water,…",
"urgency_level": "medium",
"keywords": [
"antares",
"affirmative"
],
"threat_score": 60.0,
"severity_score": 61.0,
"article_count": 4,
"date_range_latest": "2026-07-03T05:32:24+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
},
{
"short_id": "02df2601",
"cluster_id": "e2dc39d2-3e07-4205-af9d-2ab702df2601",
"slug": "canadas-spy-service-won-permission-to-hack-two-state-linked--02df2601",
"ai_title": "Canada's CSIS Authorized to Hack State-Linked Botnets Targeting Critical Infrastructure",
"ai_summary": "Canada's Federal Court has granted the Canadian Security Intelligence Service (CSIS) permission to hack into privately owned routers and internet-con…",
"urgency_level": "medium",
"keywords": [
"canada",
"service"
],
"threat_score": 75.5,
"severity_score": 80.0,
"article_count": 6,
"date_range_latest": "2026-06-16T21:21:32+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
}
],
"entities": [
{
"entity_type": "apt_group",
"entity_value": "Volt Typhoon",
"cluster_count": 72,
"article_count": 102
},
{
"entity_type": "campaign",
"entity_value": "Volt Typhoon Campaign",
"cluster_count": 1,
"article_count": 1
}
],
"darkweb": [],
"limit": 10,
"total": 13
}
GET /search?q=Vidar{
"query": "Vidar",
"clusters": [
{
"short_id": "a083694a",
"cluster_id": "c6ba6c39-9904-4df7-9253-ab86a083694a",
"slug": "infostealer-malware-hijacks-claude-sessions-draining-user-li-a083694a",
"ai_title": "Infostealer Malware Hijacks Claude Sessions, Drains User Accounts",
"ai_summary": "Anthropic has alerted users that infostealer malware is compromising Claude accounts by hijacking active login sessions, allowing attackers to deplet…",
"urgency_level": "medium",
"keywords": [
"claude",
"anthropic"
],
"threat_score": 70.5,
"severity_score": 80.0,
"article_count": 35,
"date_range_latest": "2026-08-31T02:52:54+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
},
{
"short_id": "a9dff91d",
"cluster_id": "f0c4d02d-7da0-425e-b93f-da65a9dff91d",
"slug": "fake-google-gemini-installer-distributes-vidar-infostealer-v-a9dff91d",
"ai_title": "Fake Google Gemini Installer Distributes Vidar Infostealer via Google Colab",
"ai_summary": "A malicious executable disguised as a Google Gemini installer was used to deploy the Vidar infostealer on a company network in the EMEA region. Darkt…",
"urgency_level": "medium",
"keywords": [
"google",
"gemini"
],
"threat_score": 51.9,
"severity_score": 61.0,
"article_count": 3,
"date_range_latest": "2026-08-21T06:22:04+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
}
],
"entities": [
{
"entity_type": "malware",
"entity_value": "Vidar",
"cluster_count": 41,
"article_count": 91
},
{
"entity_type": "malware",
"entity_value": "Vidar Stealer",
"cluster_count": 4,
"article_count": 6
}
],
"darkweb": [],
"limit": 10,
"total": 18
}
GET /search?q=172.86.98.113{
"query": "172.86.98.113",
"clusters": [],
"entities": [
{
"entity_type": "ipv4",
"entity_value": "172.86.98.113",
"cluster_count": 2,
"article_count": 3
}
],
"darkweb": [],
"limit": 10,
"total": 1
}
GET /search?q=businesswire.com{
"query": "businesswire.com",
"clusters": [],
"entities": [
{
"entity_type": "domain",
"entity_value": "businesswire.com",
"cluster_count": 131,
"article_count": 172
}
],
"darkweb": [],
"limit": 10,
"total": 1
}
GET /search?q=Australia{
"query": "Australia",
"clusters": [
{
"short_id": "fcea078c",
"cluster_id": "b3b4cb52-0853-433e-8397-cbe6fcea078c",
"slug": "cybersecurity-governance-urged-amid-rising-ai-threats-fcea078c",
"ai_title": "Cybersecurity Governance Urged Amid Rising AI Threats",
"ai_summary": "The European Supervisory Authorities (EBA, EIOPA, and ESMA) have called for enhanced governance to mitigate ICT risks linked to frontier AI models. T…",
"urgency_level": "medium",
"keywords": [
"eiopa",
"esma"
],
"threat_score": 51.9,
"severity_score": 61.0,
"article_count": 2,
"date_range_latest": "2026-09-01T16:19:54.871384+00:00",
"is_new": true,
"is_trending": false,
"entities": {}
},
{
"short_id": "5c82aa5d",
"cluster_id": "67109d7f-1c87-4600-9277-22fb5c82aa5d",
"slug": "five-eyes-alliance-targets-global-fraud-networks-5c82aa5d",
"ai_title": "Five Eyes Alliance Targets Global Fraud Networks",
"ai_summary": "The UK, supported by the Five Eyes alliance (US, Canada, Australia, New Zealand), has initiated measures to combat global fraud and online scams. Dur…",
"urgency_level": "medium",
"keywords": [
"fraud",
"national"
],
"threat_score": 45.4,
"severity_score": 40.0,
"article_count": 2,
"date_range_latest": "2026-08-28T13:53:35+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
}
],
"entities": [
{
"entity_type": "country",
"entity_value": "Australia",
"cluster_count": 594,
"article_count": 991
},
{
"entity_type": "company",
"entity_value": "Australian Federal Police",
"cluster_count": 4,
"article_count": 4
}
],
"darkweb": [
{
"type": "victim",
"name": "3-point Australia",
"id": "a9397a294e5ddc1a",
"date": "2026-08-14T07:12:41.384020+00:00",
"group": "storm",
"country": "AU",
"sector": "Other"
},
{
"type": "victim",
"name": "INTERTRUST AUSTRALIA PTY LTD",
"id": "e44d9bb0c39303f2",
"date": "2026-08-02T20:27:11.858120+00:00",
"group": "qilin",
"country": "AU",
"sector": "Professional Services"
}
],
"limit": 10,
"total": 30
}
GET /search?q=healthcare{
"query": "healthcare",
"clusters": [
{
"short_id": "1e900c91",
"cluster_id": "55698251-3cce-41d4-8f9b-1fd71e900c91",
"slug": "phishing-vulnerability-reduced-by-83-through-training-in-eur-1e900c91",
"ai_title": "Phishing Vulnerability Reduced by 83% Through Training in Europe",
"ai_summary": "A new study reveals that European companies can reduce employee vulnerability to phishing by 83% after one year of security training. The 'Phishing b…",
"urgency_level": "medium",
"keywords": [
"phishing",
"study"
],
"threat_score": 42.75,
"severity_score": 41.0,
"article_count": 2,
"date_range_latest": "2026-09-01T16:20:42.925369+00:00",
"is_new": true,
"is_trending": false,
"entities": {}
},
{
"short_id": "2220c37d",
"cluster_id": "7c2baf1b-8165-400a-ace3-14fe2220c37d",
"slug": "massive-healthcare-data-breach-affects-375m-patients-2220c37d",
"ai_title": "Massive Healthcare Data Breach Affects 3.75M Patients",
"ai_summary": "In March 2026, CareCloud experienced a significant data breach affecting over 3.75 million patients. Hackers accessed CareCloud's cloud environment,…",
"urgency_level": "medium",
"keywords": [
"data",
"breach"
],
"threat_score": 61.5,
"severity_score": 75.0,
"article_count": 2,
"date_range_latest": "2026-09-01T15:13:51+00:00",
"is_new": true,
"is_trending": false,
"entities": {}
}
],
"entities": [
{
"entity_type": "industry",
"entity_value": "Healthcare",
"cluster_count": 845,
"article_count": 1378
},
{
"entity_type": "company",
"entity_value": "Change Healthcare",
"cluster_count": 31,
"article_count": 39
}
],
"darkweb": [
{
"type": "victim",
"name": "Nutex Health",
"id": "dff02778ccad0dc8",
"date": "2026-09-01T12:14:08.598913+00:00",
"group": "thegentlemen",
"country": "US",
"sector": "Healthcare"
},
{
"type": "victim",
"name": "seashellhospital.com",
"id": "f471acfa69878ee8",
"date": "2026-09-01T09:02:54.914837+00:00",
"group": "krybit",
"country": "IN",
"sector": "Healthcare"
}
],
"limit": 10,
"total": 30
}
GET /search?q=ransomware&days=1{
"query": "ransomware",
"clusters": [
{
"short_id": "c92c65c3",
"cluster_id": "83855d94-b8a0-4d53-bf44-7bb7c92c65c3",
"slug": "superna-launches-cyberstorage-v215-for-enhanced-security-ope-c92c65c3",
"ai_title": "Superna Launches Cyberstorage v2.15 for Enhanced Security Operations",
"ai_summary": "On September 1, 2026, Superna announced the release of version 2.15 of its Cyberstorage platform. This update aims to streamline security and resilie…",
"urgency_level": "medium",
"keywords": [
"security",
"superna"
],
"threat_score": 24.0,
"severity_score": 20.0,
"article_count": 2,
"date_range_latest": "2026-09-01T15:19:13.891342+00:00",
"is_new": true,
"is_trending": false,
"entities": {}
},
{
"short_id": "2c02b996",
"cluster_id": "5329414f-a3ee-4f5f-af4d-24152c02b996",
"slug": "spinai-acquires-docontrol-to-enhance-saas-and-ai-security-so-2c02b996",
"ai_title": "Spin.AI Acquires DoControl to Enhance SaaS and AI Security Solutions",
"ai_summary": "Spin.AI has acquired DoControl, an Israeli cybersecurity firm, to integrate their technologies into a unified SaaS and AI security platform. The acqu…",
"urgency_level": "medium",
"keywords": [
"spin",
"security"
],
"threat_score": 21.9,
"severity_score": 21.0,
"article_count": 2,
"date_range_latest": "2026-08-31T22:22:17+00:00",
"is_new": true,
"is_trending": false,
"entities": {}
}
],
"entities": [
{
"entity_type": "attack_type",
"entity_value": "Ransomware",
"cluster_count": 2086,
"article_count": 4320
},
{
"entity_type": "ransomware_group",
"entity_value": "Qilin Ransomware",
"cluster_count": 12,
"article_count": 12
}
],
"darkweb": [
{
"type": "group",
"name": "0mega",
"active": true,
"victim_count": 1
},
{
"type": "group",
"name": "abrahams_ax",
"active": true,
"victim_count": 0
}
],
"limit": 10,
"days": 1,
"total": 25
}
GET /search?q=lockbit&include_articles=true{
"query": "lockbit",
"clusters": [
{
"short_id": "2f4929ac",
"cluster_id": "5eb440b4-5ec7-457d-befd-98c12f4929ac",
"slug": "mexicos-cybersecurity-plan-addresses-rising-ransomware-threa-2f4929ac",
"ai_title": "Mexico's Cybersecurity Plan Addresses Rising Ransomware Threats",
"ai_summary": "Mexico's National Cybersecurity Plan, introduced in December 2025, aims to tackle increasing cyber threats, particularly ransomware, which has seen 2…",
"urgency_level": "medium",
"keywords": [
"mexico",
"cybersecurity"
],
"threat_score": 56.0,
"severity_score": 61.0,
"article_count": 2,
"date_range_latest": "2026-08-25T19:22:28+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
},
{
"short_id": "84095fb7",
"cluster_id": "58924ad2-b41a-4e6c-b1c4-5b6084095fb7",
"slug": "lockbit-ransomware-targets-icbc-financial-services-and-us-ba-84095fb7",
"ai_title": "LockBit Ransomware Targets ICBC Financial Services and U.S. Bank",
"ai_summary": "On November 8, 2025, the LockBit ransomware group attacked ICBC Financial Services, disrupting U.S. Treasury trading operations. The attack exploited…",
"urgency_level": "medium",
"keywords": [
"ransomware",
"financial"
],
"threat_score": 65.5,
"severity_score": 80.0,
"article_count": 10,
"date_range_latest": "2026-08-20T14:34:35.622452+00:00",
"is_new": false,
"is_trending": false,
"entities": {}
}
],
"entities": [
{
"entity_type": "ransomware_group",
"entity_value": "Lockbit",
"cluster_count": 87,
"article_count": 138
},
{
"entity_type": "ransomware_group",
"entity_value": "Lockbit 3.0",
"cluster_count": 7,
"article_count": 5
}
],
"darkweb": [
{
"type": "victim",
"name": "svfcu.org",
"id": "5e9204528e5ca8a6",
"date": "2026-08-31T23:02:07.027296+00:00",
"group": "lockbit5",
"country": "US",
"sector": "Financial Services"
},
{
"type": "victim",
"name": "hoaattorneys.com",
"id": "20374774ed86a8db",
"date": "2026-08-31T22:59:59.933621+00:00",
"group": "lockbit5",
"country": "US",
"sector": "Professional Services"
}
],
"articles": [
{
"title": "US Bank investigates LockBit claim of data theft, faces September 3 deadline",
"source": "Teiss",
"url": "https://www.teiss.co.uk/news/us-bank-investigates-lockbit-claim-of-data-theft-faces-september-3-dea…",
"pub_date": "2026-08-24T11:00:51+00:00",
"is_new": false
},
{
"title": "US Bank investigates LockBit ransomware claims of data breach",
"source": "Feeds.Feedburner",
"url": "https://www.scworld.com/brief/us-bank-investigates-lockbit-ransomware-claims-of-data-breach",
…
Explore
From your existing workflow
The API speaks the formats your tools already read. Each link is a short setup guide.
Terminal
pipx install threatcluster-cli, or plain curl. Drop-in for cron, CI and shell pipelines.
SIEM, firewall, TIP
Point the ingestor at the IOC feed, or import STIX bundles and the MISP manifest.
Build it
Short scripts against the API, each shown with the output it produced. All run on the free key.
Sector ransomware watchSlack alert · 2 credits
CVE triageKEV and EPSS · 1 credit per CVE
SIEM indicator enrichmentDomain, IP or hash · 6 credits
Weekly executive briefMarkdown · 1 credit
IOC blocklist exportFirewall or Pi-hole · 3 credits
Lookup tool for LLM agentsTool call, cited · 5 credits
All 10 recipes →Each with its captured output
Who it's for
Security teams
A morning board, a KEV watch, a blocklist and an "are we on a leak site" check, on an expense card.
Builders and agents
License the corpus instead of building a collection pipeline, callable from your code or an agent.
MSSPs and vCISOs
Per-client feeds, alerts and branded digests from one data layer. For service providers →
Analysts
One deduplicated record instead of 40 articles, a median 5.1 days ahead of the trade press.
Where we sit
Threat intelligence is not one market. Each kind of tool answers a different question well, and most teams end up running several. This is what each is for, and what it leaves for you to do.
Indicator lookup
VirusTotal, Shodan, AbuseIPDB
- Answers
- Is this file, IP or domain known bad, and what is exposed on it
- Leaves you
- One indicator at a time. Not built to say what happened this week, or who reported it
Community feeds
abuse.ch, AlienVault OTX, CISA advisories
- Answers
- Fresh indicators and advisories, free, in bulk
- Leaves you
- Indicators without the story around them. Deduplicating 40 articles into one incident is still your job
Leak-site trackers
RansomLook, ransomware.live
- Answers
- Which victims a ransomware group has posted
- Leaves you
- Victims only. No link to the reporting that followed, and no other threat activity
Reader tools
Feedly Threat Intelligence
- Answers
- An AI-assisted reading experience over open sources
- Leaves you
- Priced per seat and quote-only. The data access is the upsell rather than the product
Enterprise platforms
Recorded Future, Flashpoint, Intel 471
- Answers
- Analyst-produced intelligence over open and dark web sources
- Leaves you
- Procurement-gated and quote-only. Machine consumption is usually metered as the expensive part
ThreatCluster
The layer between them
- Answers
- What happened this week, deduplicated into one scored record per incident, with the entities, indicators and leak-site victims attached. Read it over the API or in the platform, same records either way
- Leaves you
- The judgement. We do not run your SOC, detonate your samples or scan your perimeter, and the tools above stay better at those
Facts about other tools come from their own documentation, checked on 2 September 2026. We use several of them ourselves. See what the API returns
Pricing
Every account gets a free key: 100 credits a day over the last 7 days, no card. That is about 100 record lookups or 20 searches, every day.
| Plan | Price | API allowance | Rate | Includes |
|---|---|---|---|---|
| Free | $0 | 100 credits a day, last 7 days, trimmed records | 30 a minute | Every read endpoint: incidents, IOCs, entities, vulnerabilities and dark web. The public feeds and IOC blocklist need no key at all. |
| Researcher | $19.99 a month | 1,000 credits a day, full records, all history | 120 a minute | Everything in Free, plus custom feeds and alert rules over the API. |
| Business | $399 a month | No daily budget, per-key overrides | 600 a minute | Everything in Researcher, plus managed customers (on request; per-client feeds, alerts and branded digests) and org sharing. |
Credit packs, for anything past the daily allowance
| Pack | Price | Credits | Roughly |
|---|---|---|---|
| Starter | $10 | 2,000 | 2,000 record lookups, 400 searches or 200 dark-web enrichments |
| Bulk | $50 | 12,000 | 12,000 record lookups, 2,400 searches or 1,200 dark-web enrichments |
One-off, never expire, spent only after the day's allowance, on any plan. Past about 4,000 credits a month, Researcher is the better buy.
What a request costs
| Credits | Requests |
|---|---|
| 1 | Records and lists: incidents, entities, vulnerabilities, dark-web lists, stats |
| 3 | Bulk and fan-out: the IOC feed and export, STIX bundles, dark-web keyword hits and trends |
| 5 | Search, one query across the whole corpus |
| 10 | A dark-web victim enrichment record: screenshots, extracted data, negotiation state |
A request that finds nothing costs nothing: empty searches and 404 lookups refund their credits. Every response carries X-Request-Cost and your remaining balance. Monthly plans cancel anytime. All plans.
Security and reliability
- Availability
- 99.8% of the 1.7 million requests served in the last 30 days succeeded, median response 48 ms, measured from our edge logs, not a status-page promise.
- Freshness
- Incidents form within minutes of the first credible report. Indicators are validated on ingest and a false-positive list is applied on every export path.
- Data handling
- The public feeds are TLP:CLEAR. Keyed responses are for your own tooling, and we do not resell your queries or your watchlists.
- Dark-web collection
- Passive observation of leak sites, markets and postings over Tor. We record what criminals publish; we do not intrude, purchase or engage.
- Certification
- SOC 2 is on the roadmap. Until it lands, our security summary is available on request for procurement reviews.
Instead of building it yourself
The alternative to this API is not another vendor. It is free feeds plus labour.
- The analyst hour
- Twenty sources cover the same incident with twenty headlines. Someone reads them all to learn there is one story. Clustering does that before you open the feed.
- The pipeline team
- Collectors for 20,000 sources, deduplication, entity extraction, scoring, and the on-call to keep it all running. That is an engineering project with a payroll, not a weekend script.
- The Tor operation
- Leak sites move, mirrors die and boards change layout weekly. We run the collection, the screenshots and the re-crawls so you consume a record, not an onion address.
FAQ
What does the free key include?
Every read scope over the last 7 days with 100 credits a day: incidents, IOCs, entities, vulnerabilities and dark web. Records are trimmed to the short summary, 3 timeline events and 25 rows per list.
Most calls cost 1 credit. The heavier ones cost more: unified search is 5, STIX bundles and bulk indicator pulls are 3, and a fully enriched leak-site victim record is 10. The budget resets daily.
How fresh is it?
Incidents form within minutes of the first credible report and indicators are validated on ingest.
The lead-time number is measured, not estimated: for every incident that later appeared in the trade press, we compare the timestamp our record was created with the earliest matching trade-press article, and take the median across the matched pairs over the last 90 days. Right now that is 5.1 days, from 82 matched incidents.
How does an incident record get made?
Articles from 20,000+ sources are deduplicated into one cluster per incident as reports arrive. Each record carries a rewritten title and summary, the extracted entities (actors, malware, CVEs, victims), a sourced timeline and a threat score, and it keeps updating as coverage grows. One id to follow instead of twenty headlines.
Where does the dark-web data come from?
Our own Tor collection of leak sites, markets and underground postings, with screenshots, extracted data sizes and negotiation state. Not resold from a broker.
What formats can I pull?
JSON everywhere, STIX 2.1 bundles per incident, MISP feeds, and CSV or plain-text blocklists from the indicator feeds. The public feeds are also available as RSS, and incident pages exist as .md and .json for LLM context windows.
Are there code examples?
Yes. The GitHub repository has a daily-refreshed OpenAPI snapshot, a small Python client and real request/response pairs for every major endpoint, and the live spec is browsable as Swagger UI.
Can I redistribute the data?
The free feeds are TLP:CLEAR, redistribute with attribution. Keyed responses are for your own tooling. Embedding them in a product you sell needs a Business agreement.
Can I cancel?
Plans are monthly with no minimum term. Cancel from settings and the key keeps working until the end of the period. The free key never expires.
Get started
The whole surface is in the spec: 45+ endpoints over incidents, IOCs, entities, vulnerabilities and the dark web. Mint a free key and make the first call in a minute.