# Threat intelligence for SMEs | Precursor Intelligence

**Know who is coming for businesses like yours. And how they get in.**

> Threat intelligence tells you who is behind attacks on businesses like yours: the criminal and state-backed groups, the industries they go after, how they get in and which flaws they use. Every claim carries the quote and the link it came from. It is for owners, IT teams and security leads deciding what to defend first.

Canonical page: https://www.precursorintelligence.com/features/threat-intelligence
Breadcrumb: [Home](https://www.precursorintelligence.com/) > [Features](https://www.precursorintelligence.com/features) > Threat intelligence
Start free: https://www.precursorintelligence.com/register · Book a demo: https://www.precursorintelligence.com/contact

Over 900 groups profiled. Every claim sourced. Over 700 attacker techniques.

Example data on this page uses the fictional company Acme. Threat group names, profile figures and ransomware counts are real, read in October 2026.

## Contents

1. [What is in the library?](#what-is-in-the-library)
2. [Who targets businesses like yours?](#who-targets-businesses-like-yours)
3. [How do they work?](#how-do-they-work)
4. [What else can you check?](#what-else-can-you-check)
5. [Questions](#questions)
6. [Related features](#related-features)

## Example: a threat group profile

Akira: ransomware, financially motivated, attributed to Russia (suspected), first seen March 2023, also known as Howling Scorpius and Storm-1567. The profile links it to 36 techniques, 9 vulnerabilities, 7 targeted sectors and 6 malware families. Flaws it is reported to use include CVE-2024-40766 (a firewall access control flaw), CVE-2023-27532 (a backup server flaw) and CVE-2023-20269 (a VPN sign-in flaw), each shown with the quote it came from and a source link. The profile exports as a PDF dossier.

## What is in the library?

Start from a group, a sector, a technique or a single suspicious address. Everything links together, so you can follow a thread from who to how to which flaw.

1. **Threat group profiles.** Over 900 criminal and state-backed groups: aliases, where they are thought to be from, why they attack and their named campaigns.
2. **Evidence on every claim.** Each link between a group and a flaw, sector or technique carries the quote it came from and a source link.
3. **PDF dossiers.** Download any group profile as a PDF to share with your team or your board.
4. **Linked flaws and sectors.** The vulnerabilities each group is reported to use and the industries it goes after.
5. **Your industry.** Pick the sectors you work in and see the threat groups and ransomware gangs linked to them.
6. **Ransomware tracker.** Ransomware groups and the victims they claim on their leak sites, by sector and country. See [ransomware monitoring](https://www.precursorintelligence.com/features/ransomware-monitoring).
7. **Attacker techniques.** A catalogue of over 700 techniques, grouped by stage of an attack, with a navigator to explore them.
8. **Map a threat report.** Paste a link to an attack write-up and get back the techniques it describes.
9. **Technique tests.** Over 1,700 tests across more than 300 techniques, for checking your defences.
10. **Live exploitation.** Attack attempts seen by internet sensors, by flaw, vendor and attacker location.
11. **Indicators and malware.** Search over 350,000 known-bad addresses, domains, links and file fingerprints, and over a million malware samples.
12. **New domain monitoring.** Ongoing intelligence on newly observed domains: lookalikes, the themes they use as bait, and campaigns.

## Who targets businesses like yours?

**My industry.** Tell us which sectors you work in and the app shows the threat groups linked to them, and the ransomware gangs claiming victims among your peers.

- Threat groups linked to your sector, each opening a full profile with where they are thought to be from and why they attack.
- Ransomware claims against your sector, and which gangs are making them.
- Evidence, not guesses: a link between a group and a sector shows the reporting it came from.

Links between a sector and a group come from public research. They do not mean a group is targeting you.

Example (Acme tracks manufacturing and industrial): linked groups include Akira (ransomware, Russia, suspected), Blue Termite (espionage, China, suspected), APT37 (espionage, North Korea), BRONZE BUTLER (espionage, China) and Dalbit (espionage and extortion). In the 30 days to mid-October 2026 there were 127 ransomware claims against manufacturers, from 43 groups.

Want a look first? The [industry pages](https://www.precursorintelligence.com/industries) need no account: 15 industry groups and the threat groups linked to each.

## How do they work?

**Attacker techniques.** Attackers reuse the same moves: getting in with a stolen password, spreading across the network, locking files. We catalogue over 700 of these techniques and show which groups use them.

- Every group's techniques, grouped by stage, from getting in to doing damage.
- Paste a link to an attack write-up and get back the techniques it describes, laid out on a grid you can explore.
- A library of tests, over 1,700 of them across more than 300 techniques, for checking your defences against what a group does.

## What else can you check?

When something looks odd, look it up: an address in a log, a file someone was sent, a flaw in the news. The same library answers all three.

- **Indicators and malware.** Search malicious IP addresses, domains, links and file fingerprints, plus a library of malware samples and blocklists for suspicious certificates and connections. Over 350,000 indicators and over a million malware samples.
- **Live exploitation.** Attack attempts recorded by internet sensors, by flaw, vendor, attacker location and scanning activity.
- **Vulnerability library.** Over 400,000 CVEs with their risk scores, a list of flaws known to be exploited, weaknesses, and browsing by vendor, product and version. For example CVE-2024-3400 (a VPN gateway flaw, known exploited) scores 89, Critical. [Search vulnerabilities](https://www.precursorintelligence.com/cve-search).

## Questions

### Is this useful for a small business?

Yes. You do not need an analyst to use it. Pick your sector and you see which groups are linked to businesses like yours, how they tend to get in and which flaws they use.

### Where does the information come from?

From public reporting on attacks. Each claim in a profile, such as a group using a flaw or targeting a sector, carries the quote it came from and a link to the source, so you can check it yourself.

### Does a group appearing for my sector mean it is targeting us?

No. The link means public research has tied that group to your sector. It is a signal of what to prepare for, not evidence that your business is a target.

### What can I see without an account?

Our public threat group pages, industry pages and vulnerability search need no account. An account adds your own sectors, full profiles with evidence, the ransomware tracker, indicator search and the technique tools.

### Can I use it from my own tools?

Yes. The REST API and our MCP server for AI assistants can look up threat groups, the groups linked to an industry, the flaws a group uses, techniques, indicators and malware.

## Related features

- [Ransomware monitoring](https://www.precursorintelligence.com/features/ransomware-monitoring): ransomware groups and the victims they claim on leak sites, by sector and country.
- [Risk-based prioritisation](https://www.precursorintelligence.com/features/risk-based-prioritisation): every known flaw scored from 0 to 100 and kept up to date, so you fix the riskiest first.
- [Vulnerability management](https://www.precursorintelligence.com/features/vulnerability-management): tell us the software you run and see only the known flaws that affect it.
- [MCP server](https://www.precursorintelligence.com/features/mcp-server): ask Claude, Cursor or any MCP assistant about your own estate and current threats, with real data behind the answer.
- [All features](https://www.precursorintelligence.com/features)

## Get started

Know who you are up against, and how they get in. Choose your sectors and see the groups linked to them, the techniques they use and the ransomware gangs naming victims like you, with the source behind every claim.

- Start free: https://www.precursorintelligence.com/register
- Book a demo: https://www.precursorintelligence.com/contact
- Nothing to install · Unlimited team members · Data stored in London · Two-factor sign-in for everyone