threat-actors

Clusters and elements to attach to MISP events or attributes (like threat actors)

CTI Blueprints is a free suite of templates and tools that helps Cyber Threat Intelligence analysts create high-quality, actionable reports more consistently and efficiently.

The Threat Actor Profile Guide for CTI Analysts

Threat Hunting queries of multiple platforms

A simple ReST server to lookup threat actors (by name, synonym or UUID) and returning the corresponding MISP galaxy information about the known threat actors.

This program generates cyber attack scenarios for use in cyber training exercises, red team planning, blue team planning, automated attack execution, and cybersecurity policy analysis.

Curated list of APT group trackers, malware family indexes, naming maps, threat actor reporting, and public intelligence sources.

A Threat-Actor explorer (browser-local) from the MISP galaxy dataset

MITRE ATT&CK visualizations

Real-time threat intelligence dashboard aggregating 864+ APT groups from MISP, MITRE ATT&CK, APTnotes & more. Features interactive world map, timeline visualization, and detailed actor dossiers.

Ransomware-groups and their .onion links.

Bulletproof Hosting & Threat Actor Enabler (BPH/TAE) intelligence research — taxonomy, ecosystem mapping, enforcement timeline, analyst playbook, and master provider database

Automated security control prioritization using sector-based threat profiles

Tactics and Techniques used by Iraninan APT groups for MITRE

A threat actor is any person, group, or entity that could harm to the cyber realm

Clusters and elements to attach to MISP events or attributes (like threat actors)

Maps MITRE ATT&CK threat groups to the techniques they use — around 180 tracked adversaries, as CSV.

Claude skill to convert CTI reports into cyber kill chain, Diamond Model views and create a TTP-to-ATT&CK/ATLAS mapping, IOC - IPs, domains, emails, hashes, file paths, registry keys, CVEs, malware, threat actors - extraction.

Source-grounded CTI framework for tracking threat actor use of LLMs beyond phishing across the cyber attack lifecycle.

Structured knowledge base of 20 threat actor groups with MITRE ATT&CK-mapped TTPs, sector tagging, and an interactive CLI for lookup and search