Threat intelligence shows the criminal and state-backed groups attacking businesses like yours: the sectors they target, how they get in and which flaws they use. Every claim carries its source.
Example threat group profile for Akira, a financially motivated ransomware group, suspected to be from Russia, also known as Howling Scorpius and Storm-1567. The profile links it to 36 techniques, 9 vulnerabilities, 7 targeted sectors and 6 malware families. Each claim shows the quote it came from and a source link, and the profile can be exported as a PDF dossier.
Ransomware · Financially motivated · Russia (suspected) · First seen March 2023 · Also known as Howling Scorpius, Storm-1567
Evidence“Akira threat actors likely abused … CVE-2024-40766”
Source linkFirewall access control flaw · Government advisoryEvidence“Akira threat actors using these CVE exploits for initial access: CVE-2023-27532”
Source linkBackup server flaw · Government advisoryStart from a group, a sector, a technique or a single suspicious address. Everything links together, so you can follow a thread from who to how to which flaw.
Over 900 criminal and state-backed groups: aliases, where they are thought to be from, why they attack and their named campaigns.
Each link between a group and a flaw, sector or technique carries the quote it came from and a source link.
Download any group profile as a PDF to share with your team or your board.
The vulnerabilities each group is reported to use and the industries it goes after.
Pick the sectors you work in and see the threat groups and ransomware gangs linked to them.
Ransomware groups and the victims they claim on their leak sites, by sector and country.
A catalogue of over 700 techniques, grouped by stage of an attack, with a navigator to explore them.
Paste a link to an attack write-up and get back the techniques it describes.
Over 1,700 tests across more than 300 techniques, for checking your defences.
Attack attempts seen by internet sensors, by flaw, vendor and attacker location.
Search over 350,000 known-bad addresses, domains, links and file fingerprints, and over a million malware samples.
Ongoing intelligence on newly observed domains: lookalikes, the themes they use as bait, and campaigns.
Tell us which sectors you work in and the app shows the threat groups linked to them, and the ransomware gangs claiming victims among your peers.
Want a look first? The industry pages need no account: 15 industry groups and the threat groups linked to each.
My industries · Threat groups · Ransomware
Attackers reuse the same moves: getting in with a stolen password, spreading across the network, locking files. We catalogue over 700 of these techniques and show which groups use them.
Techniques · Navigator · Report mapping · Tests
When something looks odd, look it up: an address in a log, a file someone was sent, a flaw in the news. The same library answers all three.
Indicators and malware
Search malicious IP addresses, domains, links and file fingerprints, plus a library of malware samples and blocklists for suspicious certificates and connections.
Over 350,000 indicators · Over a million malware samples
Live exploitation
Attack attempts recorded by internet sensors, by flaw, vendor, attacker location and scanning activity.
Illustrative chart · VPN gateway flaw
Vulnerability library
Over 400,000 CVEs with their risk scores, a list of flaws known to be exploited, weaknesses, and browsing by vendor, product and version.
Search vulnerabilitiesYes. You do not need an analyst to use it. Pick your sector and you see which groups are linked to businesses like yours, how they tend to get in and which flaws they use.
From public reporting on attacks. Each claim in a profile, such as a group using a flaw or targeting a sector, carries the quote it came from and a link to the source, so you can check it yourself.
No. The link means public research has tied that group to your sector. It is a signal of what to prepare for, not evidence that your business is a target.
Our public threat group pages, industry pages and vulnerability search need no account. An account adds your own sectors, full profiles with evidence, the ransomware tracker, indicator search and the technique tools.
Yes. The REST API and our MCP server for AI assistants can look up threat groups, the groups linked to an industry, the flaws a group uses, techniques, indicators and malware.
Choose your sectors and see the groups linked to them, the techniques they use and the ransomware gangs naming victims like you, with the source behind every claim.