# Public Threat Actor & Ransomware Activity Monitor (`eirikhanasand/public-threat-actor-monitor`) Actor Monitor public reporting on 20 APT and ransomware groups. Get structured actor profiles, recent claims, targets, ATT\&CK techniques, freshness, confidence, source coverage, and provenance without raw leak data. - **URL**: https://apify.com/eirikhanasand/public-threat-actor-monitor.md - **Developed by:** [Eirik Hanasand](https://apify.com/eirikhanasand) (community) - **Categories:** News - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing Pay per usage This Actor is paid per platform usage. The Actor is free to use, and you only pay for the Apify platform usage, which gets cheaper the higher subscription plan you have. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-usage ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Public Threat Actor & Ransomware Activity Monitor Track public reporting and metadata about threat actors, ransomware groups, malware names, and campaigns. The Actor monitors a 20-group default watchlist and returns machine-readable rows for: - recent public activity, - clustered incident claims with first/last reporting times, - publisher counts and corroborating source IDs, - optional victim, affected-sector, country, and impact extraction, - likely targets, - observed TTPs, - source provenance and optional coverage metadata, - confidence and corroboration grade, - freshness and actionability flags, - scheduler polling, duplicate-run reuse, retry/backoff, and source-coverage gap state, - review reasons for stale, single-source, partial, contradicted, metadata-only, or actionable rows, - analysis facets for spreadsheet/API filtering by row type, claim type, evidence grade, freshness, source family, and safety boundary, - first/last-seen timestamps. It does not return stolen data, credential values, private messages, payloads, raw leak contents, or protected/private forum material. ### Pricing The Actor is configured for Apify pay-per-event pricing, effective July 4, 2026. Published build `0.6.4` on Actor version `0.6` bills the built-in start event and default dataset item event automatically: - `apify-actor-start` - `apify-default-dataset-item` Rows are priced at `$3.00 / 1,000`; Actor starts are `$0.00005`; platform usage is included for customers; Apify margin is 20%. This keeps customer cost tied to output volume rather than wall-clock runtime. The default dataset remains one row per normalized finding, and every row carries `paidRowDecision`, `paidRowReasonCodes`, `paidRowRemediationActions`, `buyerValueScore`, `billingGuidance`, `graphQualityLift`, `graphQualityLiftReasonCodes`, and `graphQualityLiftEvidence` so buyers can separate sellable findings from caveated leads, held rows, suppressed low-evidence rows, and coverage-gap remediation. The `OUTPUT` key-value-store record includes compact monetization, paid-row quality, `monetizationReadiness`, and dry-run `qualityLiftGate` summaries. A run is blocked for paid-traffic confidence until at least 25% of rows are chargeable findings and average buyer value is at least 0.55. Latest public proof: run `iMQGeezZ8bx7WtlhQ`, dataset `5PLmkE30luBA5Lbgc`, 10 safe APT42 rows, 4s runtime, about `$0.001` platform usage, and about `$0.03` gross row revenue after pricing starts. ### Input ```json { "queries": [ "APT29", "APT28", "APT42", "Lazarus Group", "Volt Typhoon", "Salt Typhoon", "Turla", "Sandworm", "Kimsuky", "MuddyWater", "Charming Kitten", "Scattered Spider", "LockBit", "Clop", "Akira", "Black Basta", "Play", "RansomHub", "ALPHV", "Hunters International" ], "maxRowsPerQuery": 25, "includeActivity": true, "includeTargets": true, "includeTtps": true, "includeSources": true, "includeDatasets": false, "includeCoverageGaps": true } ```` ### Output Row ```json { "query": "APT29", "rowType": "activity", "actor": "APT29", "title": "APT29 targets cloud accounts", "summary": "A dated public report describing an APT29 campaign. Reported by 2 publishers: Security Vendor A, Security Vendor B.", "claimType": "campaign", "affectedSectors": ["Technology and cloud services"], "impact": "Reported credential or account compromise", "publisherCount": 2, "firstReportedAt": "2026-06-19T14:00:00.000Z", "lastReportedAt": "2026-06-20T08:30:00.000Z", "corroboratingSourceIds": ["source:a", "source:b"], "contradictingSourceIds": [], "sourceType": "clear_web", "confidence": 0.64, "collectionMode": "live_search", "sourceCount": 4, "sourceFamilyCount": 2, "activityCount": 3, "freshnessStatus": "current", "schedulerDecision": "reuse_active_run", "pollingHint": "source_gap_review", "nextPollSeconds": 3, "retryAfterSeconds": 3, "duplicateRunReuse": true, "sourceCoverageState": "thin", "sourceCoverageGaps": ["missing_public_channel_evidence"], "relationshipSummary": "APT42 has a campaign row with single_source public support.", "relationshipPivots": ["claim:campaign", "source_family:clear_web"], "whyActionable": ["Single-source row: useful as a lead, not a confirmed fact.", "Run is still polling; keep the row attached to the active run."], "corroborationState": "single_source", "nextSearchPivots": ["APT42 public channel", "APT42 clear_web"], "evidenceGrade": "corroborated", "isActionable": true, "reviewReasons": ["freshness:current", "evidence:corroborated", "actionable:monitor_or_triage"], "analysisFacets": ["claim:campaign", "evidence:corroborated", "freshness:current", "row:activity", "safety:metadata_only"], "hasDarknetMetadata": false, "hasPublicChannelCoverage": false, "firstSeen": "2026-06-20T02:29:22.559Z", "lastSeen": "2026-06-20T02:29:22.559Z", "rawContentIncluded": false, "safety": { "metadataOnly": true, "credentialsIncluded": false, "stolenFilesIncluded": false, "privateContentIncluded": false, "actorInteraction": false }, "provenanceHash": "..." } ``` ### Public Proof Contract `GET /v1/contracts` exposes `apifyStoreReadiness`, which mirrors the Actor default input, published build `0.6.4`, public proof run/dataset, pricing hooks, conversion metric handoff, and safe sample output DTOs for `APT29`, `Volt Typhoon`, `Scattered Spider`, and `LockBit`. Each public proof DTO includes: - `runId`, `buildVersion`, and `datasetId`, - query, row count, freshness, and source families, - the `safe_metadata_only.v1` safety contract, - a no-leak proof showing raw content, credentials, private content, and actor interaction are absent. Run these before publication or after changing the listing contract: ```bash bun run check bun run check:api-regression bun run check:apify-threat-actor-monitor bun run smoke:apify-threat-actor-monitor bun run check:apify-publication TI_SEARCH_READINESS_QUERY=APT29 bun run check:scraper-native-search TI_SEARCH_READINESS_QUERY='Volt Typhoon' bun run check:scraper-native-search TI_SEARCH_READINESS_QUERY='Scattered Spider' bun run check:scraper-native-search TI_SEARCH_READINESS_QUERY=LockBit bun run check:scraper-native-search ``` ### Safety Boundary The Actor emits public metadata and summaries only. These fields are excluded: - no credential values, - no leaked database rows, - no malware payloads, - no private/invite-only content, - no authentication or CAPTCHA bypass, - no threat actor interaction, - no raw darkweb URLs in public output. ### Using the results Each run writes one normalized dataset. Related reports are conservatively clustered into one activity row when their topic strongly overlaps within a three-day window. Filter `isActionable=true` for current findings with adequate confidence and at least one supporting source. Use `relationshipSummary`, `relationshipPivots`, `whyActionable`, `corroborationState`, and `nextSearchPivots` to see the actor-to-victim/sector/country/TTP/source-family pivots that make a row worth investigating. Use `reviewReasons`, `analysisFacets`, `evidenceGrade`, `publisherCount`, and the source ID arrays to distinguish actionable rows from stale, partial, single-source, contradicted, or metadata-only claims. Use `schedulerDecision`, `pollingHint`, `nextPollSeconds`, `retryAfterSeconds`, `duplicateRunReuse`, and `sourceCoverageGaps` to decide whether downstream monitoring should poll again, wait for backoff, or treat the row as a source-coverage follow-up. Retain `provenanceHash` when merging repeated runs. For paid monitoring workflows, start with `paidRowDecision=sellable`, then inspect `included_with_caveat` rows as leads. Profile, target, and TTP rows can be sellable when they are fresh or recent, actionable, and supported by multiple public sources even if a source-family gap remains visible; single-source activity rows, stale rows, contradicted rows, and no-evidence rows are not promoted. Treat `coverage_gap_only` rows as source-expansion work, `hold` rows as not ready for promotion, and `suppress` rows as capability or context rows that should not be counted as paid findings until remediation adds evidence. Use `graphQualityLiftEvidence` to inspect relationship readiness, source corroboration, contradiction holds, freshness lift, no-leak state, and export-review eligibility for each paid-row decision. The run-level `paidRowQuality` object gives the same counts without scanning the whole dataset. The run-level `monetizationReadiness` object states whether the dataset is ready for paid traffic, the target sellable row floor, current sellable and useful row counts, blockers, and the next revenue action. The run-level `qualityLiftGate` compares accepted and rejected repair examples against proof run `iMQGeezZ8bx7WtlhQ` and the 20-group daily shape, reporting accepted/rejected counts, sellable/fresh/useful rows added, cost-per-useful-row delta, projected row revenue delta, and owner handoffs. It is dry-run only: it does not mutate sources, start collection, or count repairs unless buyer-visible paid-row output improves. The default watchlist contains 20 long-running state-linked and financially motivated groups. Custom queries can monitor up to 25 actor, malware, ransomware, or campaign names in one run. Schedule the Actor to maintain a rolling feed; downstream systems can consume dataset items through the Apify API. Dataset coverage rows are disabled by default so ordinary runs contain intelligence rows rather than product-roadmap rows. Coverage-gap rows remain enabled by default because they explain why an answer may still be partial. Claims remain claims until corroborated. Confidence and evidence fields expose that distinction instead of presenting every public mention as confirmed activity. # Actor input Schema ## `queries` (type: `array`): Threat actor, ransomware group, malware, or campaign names to monitor. ## `query` (type: `string`): Optional single query. Used when queries is empty. ## `maxRowsPerQuery` (type: `integer`): Maximum normalized dataset rows returned per query. ## `includeActivity` (type: `boolean`): Return rows for recent public mentions, claims, and reporting when available. ## `includeTargets` (type: `boolean`): Return rows for likely sectors, countries, or regions associated with the query. ## `includeTtps` (type: `boolean`): Return rows for observed techniques, tactics, tools, and mapped ATT\&CK identifiers when available. ## `includeSources` (type: `boolean`): Return source provenance rows used to support the result. ## `includeDatasets` (type: `boolean`): Add service coverage rows. Leave disabled when you only need actor intelligence and evidence. ## `includeCoverageGaps` (type: `boolean`): Add rows that explain thin, stale, or missing source coverage and the recommended collection action. ## Actor input object example ```json { "queries": [ "APT29", "APT28", "APT42", "Lazarus Group", "Volt Typhoon", "Salt Typhoon", "Turla", "Sandworm", "Kimsuky", "MuddyWater", "Charming Kitten", "Scattered Spider", "LockBit", "Clop", "Akira", "Black Basta", "Play", "RansomHub", "ALPHV", "Hunters International" ], "maxRowsPerQuery": 25, "includeActivity": true, "includeTargets": true, "includeTtps": true, "includeSources": true, "includeDatasets": false, "includeCoverageGaps": true } ``` # Actor output Schema ## `dataset` (type: `string`): The default dataset containing normalized public-intelligence rows. ## `summary` (type: `string`): The complete normalized output array stored as the OUTPUT record. # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "queries": [ "APT29", "APT28", "APT42", "Lazarus Group", "Volt Typhoon", "Salt Typhoon", "Turla", "Sandworm", "Kimsuky", "MuddyWater", "Charming Kitten", "Scattered Spider", "LockBit", "Clop", "Akira", "Black Basta", "Play", "RansomHub", "ALPHV", "Hunters International" ] }; // Run the Actor and wait for it to finish const run = await client.actor("eirikhanasand/public-threat-actor-monitor").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "queries": [ "APT29", "APT28", "APT42", "Lazarus Group", "Volt Typhoon", "Salt Typhoon", "Turla", "Sandworm", "Kimsuky", "MuddyWater", "Charming Kitten", "Scattered Spider", "LockBit", "Clop", "Akira", "Black Basta", "Play", "RansomHub", "ALPHV", "Hunters International", ] } # Run the Actor and wait for it to finish run = client.actor("eirikhanasand/public-threat-actor-monitor").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "queries": [ "APT29", "APT28", "APT42", "Lazarus Group", "Volt Typhoon", "Salt Typhoon", "Turla", "Sandworm", "Kimsuky", "MuddyWater", "Charming Kitten", "Scattered Spider", "LockBit", "Clop", "Akira", "Black Basta", "Play", "RansomHub", "ALPHV", "Hunters International" ] }' | apify call eirikhanasand/public-threat-actor-monitor --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=eirikhanasand/public-threat-actor-monitor", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Public Threat Actor & Ransomware Activity Monitor", "description": "Monitor public reporting on 20 APT and ransomware groups. Get structured actor profiles, recent claims, targets, ATT&CK techniques, freshness, confidence, source coverage, and provenance without raw leak data.", "version": "0.6", "x-build-id": "L7LtCqLsKT6Luq04R" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/eirikhanasand~public-threat-actor-monitor/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-eirikhanasand-public-threat-actor-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/eirikhanasand~public-threat-actor-monitor/runs": { "post": { "operationId": "runs-sync-eirikhanasand-public-threat-actor-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/eirikhanasand~public-threat-actor-monitor/run-sync": { "post": { "operationId": "run-sync-eirikhanasand-public-threat-actor-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "queries": { "title": "Actors or groups", "type": "array", "description": "Threat actor, ransomware group, malware, or campaign names to monitor.", "items": { "type": "string" } }, "query": { "title": "Single actor or group", "type": "string", "description": "Optional single query. Used when queries is empty." }, "maxRowsPerQuery": { "title": "Max rows per query", "minimum": 1, "maximum": 100, "type": "integer", "description": "Maximum normalized dataset rows returned per query.", "default": 25 }, "includeActivity": { "title": "Include recent activity", "type": "boolean", "description": "Return rows for recent public mentions, claims, and reporting when available.", "default": true }, "includeTargets": { "title": "Include targeting", "type": "boolean", "description": "Return rows for likely sectors, countries, or regions associated with the query.", "default": true }, "includeTtps": { "title": "Include TTPs", "type": "boolean", "description": "Return rows for observed techniques, tactics, tools, and mapped ATT&CK identifiers when available.", "default": true }, "includeSources": { "title": "Include source coverage", "type": "boolean", "description": "Return source provenance rows used to support the result.", "default": true }, "includeDatasets": { "title": "Include dataset coverage", "type": "boolean", "description": "Add service coverage rows. Leave disabled when you only need actor intelligence and evidence.", "default": false }, "includeCoverageGaps": { "title": "Include coverage gaps", "type": "boolean", "description": "Add rows that explain thin, stale, or missing source coverage and the recommended collection action.", "default": true } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```