Threat intelligence API / Threat actor API
Threat actor API
Profiles for APT groups, ransomware operators, malware families and the tools they use, built from what is being reported rather than a static wiki: an overview, the recent activity narrative, targets by sector and country, related CVEs, and every incident the entity appears in.
What is tracked
998 APT groups, 358 ransomware groups and 2,310 malware families, with a profile that is rewritten as reporting arrives. Ransomware groups also carry their leak-site activity from the dark web API. Companies, products, platforms, countries, industries and MITRE ATT&CK techniques are entities too, so "which actors target healthcare" and "who is exploiting this product" are the same call.
Endpoints
| Call | Returns | Cost |
|---|---|---|
| GET /entities/search | Search entities | 1 |
| GET /entities/{entity_type}/{entity_value}/related | Related entities | 1 |
| GET /entities/{entity_type}/{entity_value}/cooccurring-cves | Co-occurring CVEs for an entity | 1 |
| GET /entities/{category}/{entity_value} | Entity detail | 1 |
| GET /entities/trending | Trending entities by type | 1 |
One request
One actor, by type and name:
curl -H "X-API-Key: $TC_KEY" \ "https://threatcluster.io/api/public/v1/entities/apt-group/Lazarus%20Group"
| Field | Type | Meaning |
|---|---|---|
| entity_type | string | |
| entity_value | string | |
| related | array | |
| sub_relationships | null or null |
Every entity page on the site has a Markdown twin for LLM context: append .md to its URL.
Relationships and STIX
Entities are linked through the incidents they share: an actor to the malware it deploys, the CVEs it exploits, the sectors it hits. Per incident, the STIX endpoint exports those inferred relationships as a bundle; the entity explorer shows the graph on the site.
The rest of the API
Free threat intelligence API · Dark web API · IOC API · CVE API · Full reference
Threat actor API FAQ
Where do the profiles come from?
From the reporting. Each profile is generated from the incidents the entity appears in and is refreshed as new reporting arrives, with the sources attached, rather than copied from a vendor's actor wiki.
Are aliases handled?
Yes. Actor and malware names are normalised on ingest so APT29, Cozy Bear and Midnight Blizzard resolve to one profile with the aliases listed.
Is there MITRE ATT&CK mapping?
Techniques are entities and are linked to actors and malware through shared incidents, so an actor's profile lists the techniques reported alongside it.
Can I list every actor?
Yes, the entity list endpoints page through a type. On the site, the APT groups and ransomware groups directories are the same lists.
What does a free key get?
Profiles and lists trimmed to the last seven days of activity, 25 rows a page. Researcher reads the full history.
Get a key and make a request
Free account, read-only key, 100 credits a day. Upgrade when you need the history.