v1

latestOpenAPI 3.0.0Proprietary - Commercial Use Only2026-08-06172139621.6 KB

Risk Intelligence

Get details of a threat actor.

Get details of a threat actor by its Id.

get/api/v2/riskintelligence/threat-actors/{threatActorId}

Path parameters

threatActorIdinteger required

Example:123

The threat actor Id.

Response

Success

Idinteger

The Threat Actor Id

Namestring

The Threat Actor Name

Descriptionstring

The Threat Actor Description

Type'APT' | 'Ransomware'

The Threat Actor type.

CurrentExposureinteger

It is the company count exposed by vulnerability currently.

FirstSeeninteger

The date on which the threat actor was first appeared.

LastSeeninteger

The date on which the threat actor was last appeared.

ExploitedVulnerabilitiesstring[]

The list of CVE IDs of exploited vulnerabilities.

Motivationstring[]

The list of threat actor's motivations.

OriginCountrystring

The name of the individual country.

Example response

{
  "Id": 2453,
  "Name": "Qilin",
  "Description": "Advanced persistent threat group known for ransomware activities",
  "Type": "APT",
  "CurrentExposure": 9,
  "FirstSeen": 2010,
  "LastSeen": 2024,
  "ExploitedVulnerabilities": [
    "CVE-2024-55956",
    "CVE-2024-12345"
  ],
  "TargetCountries": [
    {
      "Code": "US",
      "Name": "United States"
    },
    {
      "Code": "GB",
      "Name": "United Kingdom"
    },
    {
      "Code": "DE",
      "Name": "Germany"
    }
  ],
  "TargetIndustries": [
    {
      "Code": 61,
      "Name": "Finance"
    },
    {
      "Code": 42,
      "Name": "Healthcare"
    },
    {
      "Code": 15,
      "Name": "Energy"
    }
  ],
  "Motivation": [
    "Espionage",
    "Information Theft",
    "Intelligence Gathering"
  ],
  "OriginCountry": "China",
  "TTPs": [
    {
      "Code": "T1560.001",
      "Name": "Archive via Utility"
    },
    {
      "Code": "T1047",
      "Name": "Windows Management Instrumentation"
    }
  ]
}