Request demo

Threat Actor Intelligence

Know Who Targets Your Sector and What They Use.

Threat Actor Intelligence keeps a structured profile for each actor: who they are, where they operate from, where they are active, whom they target, and which CVEs and tools they use.

Filter by your country, your industry or a CVE on your assets, and the list of actors worth your attention gets short.

Request demoThreat Actor Search reference

Query

  1. filter targeted_countries contains_any [your country]
  2. filter targeted_industries contains_any [your sector]
  3. filter cves_used contains_any ["CVE-2021-44228"]
  4. filter is_active eq true

  • Actor A

  • Actor B

  • Actor C

  • Actor D

  • Actor E

  • Actor F

  • Actor G

  • Actor H

ProfileActor C

  • Targetsyour country · your sector
  • CapabilitiesCVE-2021-44228 · 4 tools
  • Activityactive · last seen 2026-09
  • Originone country, named on the profile

All Actors Share One Structure.

Profiles share one schema, so a question you can ask about one actor you can ask about all of them.

IdentityName, aliases, first and last seen dates, and whether the actor is active · name, aliases, date_first_seen, date_last_seen, is_active
ProfileSize, types, sophistication and specializations · actor_size, actor_types, actor_sophistication, actor_specializations
IntelA written description and law enforcement notes · description, law_enforcement
ContactKnown contact handles, websites and social accounts · contact_info, websites, social_media
OriginCountries the actor operates from · origin_countries
ActivityLeak names, forum and market names, and the actor’s usernames on them · leak_names, forum_names, market_names, forum_market_usernames
TargetsRegions, countries, industries and organizations it has targeted · targeted_regions, targeted_countries, targeted_industries, targeted_organizations
CapabilitiesThe CVEs and tools the actor uses · cves_used, tools_used

Field names as returned by GET /cti/threat-actors/{id}. See the Threat Actor Detail reference.

Start From the Pattern, Not the Name.

Aggregate views summarize all profiles at once. Each is one GET request.

Most Used CVEs

The vulnerabilities that appear most often in actors’ capabilities. A short list worth checking against your assets.

Most Used Tools

The tools that recur across actors. Useful input for detection engineering.

Most Targeted Countries

Where actors aim their activity. The size parameter sets how many rows come back.

Most Targeted Industries

Which sectors draw the most actors. Read it against your sector.

Most Targeted Organizations

The organizations named most often in actors’ targets.

Most Actor-Hosting Countries

The countries the most actors operate from.

Ask Which Actors Use Your CVEs.

The most useful question often starts on your side: a CVE that External Attack Surface Management found on one of your assets.

Profile fields are searchable, including cves_used, tools_used and each target list, using the filter syntax of the other platform searches.

That CVE ID also opens the full vulnerability record, so your team can weigh the actor, the exploitation signal and your exposure together.

  • CVSS base score and vector
  • EPSS probability of exploitation
  • CISA KEV listing
  • CWE, mapped to OWASP Top 10 2021
Vulnerability Intelligence
curl -X POST \
  "https://api.deepinfo.com/v1/cti/threat-actors/search?page_size=25" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "filters": {
      "must": [
        { "name": "cves_used", "type": "contains_any", "value": ["CVE-2021-44228"] },
        { "name": "is_active", "type": "eq", "value": true }
      ]
    }
  }'

From a Sector to a Short List.

  1. 01

    Scope

    Filter actors by targeted_countries and targeted_industries. Start with your own, then add your subsidiaries’ markets.

  2. 02

    Check capabilities

    Read each remaining actor’s CVEs and tools against what your assets run. The overlap is where to look first.

  3. 03

    Read the profile

    Aliases, origin, the forums and markets the actor works from, and the organizations it has already targeted.

  4. 04

    Follow the reporting

    Cybersecurity News tags articles with the actors they name. One filter on threat_actor pulls the recent reporting on each actor left on the list.

Read Actors Next to Your Findings.

CTI Cybersecurity News Articles linked to the CVEs and actors they mention. Read CTI Dark Web Search Search the forums and markets actors use. Read Deep Search & Insights Vulnerability Intelligence CVSS, EPSS and CISA KEV for every CVE an actor uses. Read

Query This Data Through the API

Credentials and dark web findings stay in the platform. The domain and vulnerability data around them is open through the API.

Questions About Threat Actor Intelligence

How current is a profile?

Each profile carries first-seen, last-seen and last-updated dates and an active flag, so your team can judge how current it is before acting on it.

Do profiles include IP addresses or file hashes?

No. A profile records who the actor is, where it is active, whom it targets and which CVEs and tools it uses. Indicators such as IP and email addresses found on dark web pages come from Dark Web Search.

Can we check whether an actor’s CVEs are on our assets?

Yes. The CVE ID links the two: look for the CVEs in an actor’s cves_used among the vulnerabilities External Attack Surface Management has found on your assets.

How do we access threat actor profiles?

Profiles and the aggregate views are exposed through the CTI API, with the same apikey header and filter syntax as the rest of the platform.

How does this relate to the rest of CTI?

The rest of Cyber Threat Intelligence shows what has leaked about your organization. Threat actor profiles show who is active against organizations like yours and with what, so a finding can be weighed against a real adversary.

See the Actors Active Against Your Sector.

Book a walk-through and we’ll run the actor search against your countries, your industry and the CVEs on your assets.

Request demo