TAIP Threat Actor Intelligence Platform

Overview

This dashboard aggregates open-source threat intelligence from CISA and Ransomware.live to provide a real-time risk heat index for the world's most active threat actors. Threat scores are computed from activity recency, impact severity, victim targeting breadth, and geopolitical attribution confidence. Data is refreshed automatically every six hours.

Intelligence Sources

• CISA Known Exploited Vulnerabilities (KEV) — Live feed of CVEs actively exploited in the wild
• Ransomware.live API — Real-time ransomware victim tracking across active groups
• Ransomware.live Ransom Notes — Actual ransom note text for each active group, viewable in the actor detail panel
• MITRE ATT&CK — Adversary technique and tactic mapping
• CISA Advisories — Joint advisories naming specific threat groups and TTPs
• FBI / NSA Joint Advisories — Nation-state attribution reports
• Mandiant / Google Threat Intelligence — APT group profiles

📝 Ransom Notes

Clicking any ransomware actor card opens a detail panel that includes the group's actual ransom notes sourced from ransomware.live. Notes load on demand in a tabbed view — one tab per known note variant. Available for LockBit 3.0, ALPHV/BlackCat, RansomHub, Clop, Akira, and Play Ransomware.

Scoring Methodology

Risk scores (0–100) are weighted composites of: recent confirmed activity (40%), estimated impact and victim count (30%), targeting breadth across sectors (20%), and attribution confidence (10%). Scores above 80 indicate current active campaigns with broad impact potential.

Threat Intelligence Network

Explore the World Ransomware Map for aggregate ransomware victim claims by reported country, alongside FYI Cyber’s threat actor intelligence by target industry. A reported country is not necessarily the location of an attack, and victim listings may be unverified.

About Antibody Cyber Technology

Antibody Cyber Technology, LLC builds practical cybersecurity tools for defenders. Tools include URLCybersecurity.com (USS), SPAT, JExtScanner, To8CA, and SOCSOUTHEAST.

State-Sponsored APT Groups Left Panel

Actor cards summarize state-sponsored groups, including their score, type, country, active-since date, description and associated tactics. Cards are ordered by risk score.

Select a card to open its detail view, with primary targets, MITRE ATT&CK techniques and references where available.

Global Threat Actor Risk Heatmap Center Panel

The two heatmaps separate state-sponsored actors from ransomware and criminal actors. Each cell shows an actor's name, score and type. Select a cell to open the actor detail view.

The displayed score combines activity, impact and targeting breadth. Use the legend to interpret the bands:

• Critical: 80–100
• High: 60–79
• Elevated: 40–59
• Moderate: 20–39

Use the plus, minus and reset controls, or hold Ctrl while scrolling over the heatmap, to adjust its zoom.

Trends, Healthcare Context & Tactics Center Panel

Below the heatmaps, Primary Tactics & Trends summarizes current patterns. The healthcare section provides medical-device and healthcare-specific threat context. The MITRE ATT&CK Tactic Frequency table lists tactics, top associated actors and prevalence.

Ransomware & Criminal Actors Right Panel

Review critical and high-severity counts, active actors, actor cards and recent activity. Selecting an actor opens its threat overview, targets, key tactics, ATT&CK techniques and references. Ransom notes appear in the detail view when available.

World Ransomware Map

Explore recent Ransomware.live victim claims summarized by the country reported for each organization. The map shows country-level counts only, not attack locations; victim listings are claims and may be unverified.

Open the World Ransomware Map →

Sources & Refresh

Dashboard data is drawn from CISA, MITRE ATT&CK, RansomWatch, OTX AlienVault and other open sources. The Updated label shows the data-file timestamp. The page reloads automatically every 10 minutes.