Fresh Threat Actor & Ransomware Activity Monitor

Monitor public ransomware victim-claim metadata, recent public NVD CVE vulnerability-disclosure metadata, and fresh public threat actor activity in a clean dataset. The default run uses a 277-group ransomware.live preset plus recent NVD public CVE metadata for broad safe coverage, while paid-traffic readiness requires 100,000 recent, live-backed, payworthy, non-test rows from current public sources.

What You Get

• Victim-claim archive rows for groups such as LockBit, Qilin, Akira, Play, Clop, RansomHub, ALPHV, DragonForce, BianLian, Black Basta, Medusa, SafePay, 8Base, Lynx, Everest, Conti, Rhysida, Cactus, Royal, and Hive.
• Recent public NVD CVE vulnerability-disclosure metadata rows with CVE IDs, publication dates, CVSS/CWE summary context, and NVD detail links.
• Fresh/current rows where recent public claims exist, plus historical rows clearly marked by freshnessStatus and excluded from strict paid-traffic readiness.
• Fields for actor, victimName, affectedSectors, countries, claimedDate, sourceUrl, confidence, paidRowDecision, buyerValueScore, whyWorthPayingFor, and nextSearchPivots.
• Safe metadata only: no credential values, stolen files, malware payloads, private messages, raw leak contents, authentication bypass, CAPTCHA bypass, or threat-actor interaction.

Default Input

The default preset is tuned for broad ransomware monitoring and archive search:

{
  "maxRowsPerQuery": 6000,
  "includeActivity": true,
  "includeTargets": true,
  "includeTtps": true,
  "includeSources": true,
  "includeDatasets": false,
  "includeCoverageGaps": false,
  "includeHeldRows": false
}

Custom runs can replace queries with actor, ransomware, malware, campaign, sector, or brand terms.

Pricing

The Actor uses Apify pay-per-event pricing.

• Dataset rows: $3.00 / 1,000 rows
• Actor start: $0.00005
• Platform usage: included for customers

Rows are priced by output volume, so buyers can estimate cost before scheduling a run.

Good Uses

• SOC teams can filter freshnessStatus=current or recent for daily triage.
• CTI teams can search historical victim claims by actor, victim, sector, country, date, or recent public CVE ID.
• Brand monitoring teams can check whether an organization appears in public ransomware victim metadata.
• Incident response teams can pivot from victim claims into public corroboration and defensive follow-up.

Sample Row

{
  "query": "Qilin",
  "rowType": "activity",
  "actor": "Qilin",
  "title": "Qilin victim claim: Example Corp",
  "claimType": "victim_claim",
  "victimName": "Example Corp",
  "affectedSectors": ["Healthcare"],
  "countries": ["US"],
  "claimedDate": "2026-06-20T00:00:00.000Z",
  "sourceType": "clear_web",
  "collectionMode": "ransomware_live_group_page",
  "freshnessStatus": "current",
  "paidRowDecision": "sellable",
  "billingGuidance": "charge",
  "whyWorthPayingFor": "specific public intelligence row ready for analyst triage",
  "rawContentIncluded": false,
  "safety": {
    "metadataOnly": true,
    "credentialsIncluded": false,
    "stolenFilesIncluded": false,
    "privateContentIncluded": false,
    "actorInteraction": false
  }
}

Notes

Claims are public claims, not confirmed breaches. Use confidence, freshnessStatus, sourceUrl, corroborationState, and nextSearchPivots to decide what needs follow-up.