# Threat Actor Intelligence

URL: https://www.deepinfo.com/platform/cti/threat-actor-intelligence/

## Know Who Targets Your Sector and What They Use.

Threat Actor Intelligence keeps a structured profile for each actor: who they are, where they operate from, where they are active, whom they target, and which CVEs and tools they use.

Filter by your country, your industry or a CVE on your assets, and the list of actors worth your attention gets short.

[Request demo](https://www.deepinfo.com/request-demo/) · [Threat Actor Search reference](https://docs.deepinfo.com/reference/cti/threat-actor-search/)

### All Actors Share One Structure.

Profiles share one schema, so a question you can ask about one actor you can ask about all of them.

- **Identity**: Name, aliases, first and last seen dates, and whether the actor is active · `name`, `aliases`, `date_first_seen`, `date_last_seen`, `is_active`
- **Profile**: Size, types, sophistication and specializations · `actor_size`, `actor_types`, `actor_sophistication`, `actor_specializations`
- **Intel**: A written description and law enforcement notes · `description`, `law_enforcement`
- **Contact**: Known contact handles, websites and social accounts · `contact_info`, `websites`, `social_media`
- **Origin**: Countries the actor operates from · `origin_countries`
- **Activity**: Leak names, forum and market names, and the actor’s usernames on them · `leak_names`, `forum_names`, `market_names`, `forum_market_usernames`
- **Targets**: Regions, countries, industries and organizations it has targeted · `targeted_regions`, `targeted_countries`, `targeted_industries`, `targeted_organizations`
- **Capabilities**: The CVEs and tools the actor uses · `cves_used`, `tools_used`

Field names as returned by `GET /cti/threat-actors/{id}`. See the [Threat Actor Detail reference](https://docs.deepinfo.com/reference/cti/threat-actor-detail/).

### Start From the Pattern, Not the Name.

Aggregate views summarize all profiles at once. Each is one GET request.

#### Most Used CVEs

The vulnerabilities that appear most often in actors’ capabilities. A short list worth checking against your assets.

#### Most Used Tools

The tools that recur across actors. Useful input for detection engineering.

#### Most Targeted Countries

Where actors aim their activity. The `size` parameter sets how many rows come back.

#### Most Targeted Industries

Which sectors draw the most actors. Read it against your sector.

#### Most Targeted Organizations

The organizations named most often in actors’ targets.

#### Most Actor-Hosting Countries

The countries the most actors operate from.

### Ask Which Actors Use Your CVEs.

The most useful question often starts on your side: a CVE that External Attack Surface Management found on one of your assets.

Profile fields are searchable, including `cves_used`, `tools_used` and each target list, using the filter syntax of the other platform searches.

That CVE ID also opens the full vulnerability record, so your team can weigh the actor, the exploitation signal and your exposure together.

- CVSS base score and vector
- EPSS probability of exploitation
- CISA KEV listing
- CWE, mapped to OWASP Top 10 2021

[Vulnerability Intelligence](https://www.deepinfo.com/platform/dsi/vulnerability-intelligence/)

Actors using a CVE:

```bash
curl -X POST \
  "https://api.deepinfo.com/v1/cti/threat-actors/search?page_size=25" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "filters": {
      "must": [
        { "name": "cves_used", "type": "contains_any", "value": ["CVE-2021-44228"] },
        { "name": "is_active", "type": "eq", "value": true }
      ]
    }
  }'
```

The CVE record:

```bash
curl "https://api.deepinfo.com/v1/discovery/vulnerability-detail?cve=CVE-2021-44228" \
  -H "apikey: YOUR_API_KEY"
```

Most used CVEs:

```bash
curl "https://api.deepinfo.com/v1/cti/threat-actors/stats/most-used-cves" \
  -H "apikey: YOUR_API_KEY"
```

### From a Sector to a Short List.

1. **Scope**

   Filter actors by `targeted_countries` and `targeted_industries`. Start with your own, then add your subsidiaries’ markets.
2. **Check capabilities**

   Read each remaining actor’s CVEs and tools against what your assets run. The overlap is where to look first.
3. **Read the profile**

   Aliases, origin, the forums and markets the actor works from, and the organizations it has already targeted.
4. **Follow the reporting**

   Cybersecurity News tags articles with the actors they name. One filter on `threat_actor` pulls the recent reporting on each actor left on the list.

### Read Actors Next to Your Findings.

- [Cybersecurity News](https://www.deepinfo.com/platform/cti/cybersecurity-news/) (CTI): Articles linked to the CVEs and actors they mention.
- [Dark Web Search](https://www.deepinfo.com/platform/cti/dark-web-search/) (CTI): Search the forums and markets actors use.
- [Vulnerability Intelligence](https://www.deepinfo.com/platform/dsi/vulnerability-intelligence/) (Deep Search & Insights): CVSS, EPSS and CISA KEV for every CVE an actor uses.

### Query This Data Through the API

Credentials and dark web findings stay in the Deepinfo Platform. The domain and vulnerability data around them is open through the API.

- [Vulnerability Search API](https://www.deepinfo.com/data-api/apis/vulnerability-search/)
- [Vulnerability Detail API](https://www.deepinfo.com/data-api/apis/vulnerability-detail/)
- [Domain Detail API](https://www.deepinfo.com/data-api/apis/domain-detail/)
- [WHOIS History API](https://www.deepinfo.com/data-api/apis/whois-history/)

### Questions About Threat Actor Intelligence

**How current is a profile?**

Each profile carries first-seen, last-seen and last-updated dates and an active flag, so your team can judge how current it is before acting on it.

**Do profiles include IP addresses or file hashes?**

No. A profile records who the actor is, where it is active, whom it targets and which CVEs and tools it uses. Indicators such as IP and email addresses found on dark web pages come from [Dark Web Search](https://www.deepinfo.com/platform/cti/dark-web-search/).

**Can we check whether an actor’s CVEs are on our assets?**

Yes. The CVE ID links the two: look for the CVEs in an actor’s `cves_used` among the vulnerabilities External Attack Surface Management has found on your assets.

**How do we access threat actor profiles?**

Profiles and the aggregate views are exposed through the [CTI API](https://docs.deepinfo.com/reference/cti/), with the same `apikey` header and filter syntax as the rest of the platform.

**How does this relate to the rest of CTI?**

The rest of Cyber Threat Intelligence shows what has leaked about your organization. Threat actor profiles show who is active against organizations like yours and with what, so a finding can be weighed against a real adversary.

### See the Actors Active Against Your Sector.

Book a walk-through and we’ll run the actor search against your countries, your industry and the CVEs on your assets.

[Request demo](https://www.deepinfo.com/request-demo/)