{"uid":"cap_1esf70GuqXVljnfFBjOQ3","slug":"ot-intel-api-active-ics-campaign-tracker-af6242f1","name":"OT Intel API — Active ICS Campaign Tracker","description":"Active ICS campaign tracker. Pass ?sector=electric&status=active. Returns campaigns currently targeting a sector with actor attribution, start date, targeted geography, TTPs in use, and CVEs being exploited. No free equivalent for live campaign status.","url":"https://ot-intel-api.onrender.com/ot/campaign","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["sector"],"properties":{"sector":{"type":"string","description":"Industrial sector e.g. energy, water, electric, manufacturing, oil-and-gas, nuclear, chemical"},"status":{"type":"string","description":"active (default) | all"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"sector":"electric","status":"active","campaigns":[{"name":"VOLTZITE Pre-Positioning Campaign","actor":"VOLTZITE","status":"active","confidence":"high","start_date":"2023-Q1","ttps_in_use":["T0859","T0812","T0885"],"exploited_cves":["CVE-2023-38380"],"targeted_geography":["United States","Pacific Islands"]}],"freshness":"2026-06-13T10:00:00Z","data_sources":["MITRE-ATT&CK-ICS","CISA-ICS-CERT","OT-Intel-DB","DeepSeek-CTI-Analysis"],"campaign_count":2}},"example":{"request":{"input":{"type":"http","method":"GET","queryParams":{"sector":"energy","status":"active"}},"output":{"type":"object"}},"response":{"sector":"energy","status":"active","campaigns":[{"name":"Industroyer","actor":"Sandworm Team","status":"active","confidence":"high","start_date":"2016","ttps_in_use":["T0812","T0831","T0836","T0842","T0853","T0888","T0890"],"exploited_cves":[],"targeted_geography":["Ukraine"]},{"name":"Iranian APT Activity During Geopolitical Escalation","actor":"APT33","status":"active","confidence":"medium","start_date":"2026","ttps_in_use":["T0812","T0842","T0853","T0888","T0890"],"exploited_cves":[],"targeted_geography":["Middle East","Europe","Asia","North America","Gulf Arab states","Israel","United States"]},{"name":"Dragonfly 2.0","actor":"Dragonfly","status":"active","confidence":"high","start_date":"2023","ttps_in_use":["T0812","T0842","T0853","T0888","T0890"],"exploited_cves":[],"targeted_geography":["United States"]}],"freshness":"2026-06-16T17:39:44.114Z","data_sources":["MITRE-ATT&CK-ICS","OT-Intel-DB","DeepSeek-CTI-Analysis"],"campaign_count":3}},"exampleRequest":{"sector":"energy","status":"active"},"tags":["x402"],"displayCostAmount":"0.05","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.05/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_ZYJ7dZMRCxn3UshB17_x8","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.05","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns currently active (or all) threat campaigns targeting a specified industrial sector, with actor attribution, start dates, geographies, TTPs, and exploited CVEs.","exampleAgentPrompt":"What active threat campaigns are targeting the electric sector right now — I need actor attribution, the TTPs they're using, and any CVEs being exploited?","exampleUseCases":[{"title":"Monitor critical infrastructure for active threats","prompt":"Check what threat campaigns are actively targeting our water utility operations right now, and flag any nation-state actors we should be worried about."},{"title":"Track exploited vulnerabilities in manufacturing","prompt":"Show me all the CVEs being actively exploited in ICS campaigns against manufacturing plants so we can prioritize our patching strategy."},{"title":"Alert on emerging tactics in oil and gas","prompt":"What new TTPs are threat actors using in live campaigns against oil and gas infrastructure, and where are these attacks concentrated geographically?"}],"resultDescription":"A list of active (or all) threat campaigns targeting the requested industrial sector, each with: threat actor attribution, campaign start date, targeted geographic regions, TTPs in use (likely MITRE ATT&CK for ICS), and CVE identifiers being actively exploited in that campaign.","failureModes":["Missing required query parameters (sector or status) returns a 400 or error response","Unknown or unsupported sector value may return empty results or an error","Service may be unavailable or return 500 if the upstream data source is down","Render cold-start latency may cause slow first response after inactivity","No results returned if no campaigns match the requested sector/status combination"],"whenToPreferThis":"Use this endpoint when you need a live, structured view of active threat campaigns targeting a specific ICS/OT sector, including actor attribution, TTPs, and exploited CVEs. Prefer this over generic CTI feeds when the focus is specifically on operational technology or industrial control system environments. Choose this over the sector threat-actor listing endpoint when you need campaign-level granularity (start dates, geographies, CVEs in play) rather than just actor profiles.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-13T12:30:47.672Z","isFirstParty":false}