{"uid":"cap_52oFOEaN2truCDcwsNqBT","slug":"dragons-eye-ransomware-group-intel-lookup-cca2b4a5","name":"Dragons Eye Ransomware Group Intel Lookup","description":"Get intel on a ransomware group: activity trend, tools, malware, ATT&CK and CVEs. $0.05 USDC on Base per call. Returns leak-site listing counts with a momentum status (30-day vs lifetime), reported tools, co-mentioned malware, campaigns, ATT&CK techniques and CVEs (not attribution), headlines and D3FEND defenses. Don't use this for attribution; co-mentions are not proof.","url":"https://api.ransomware-tracker.com/v1/group-intel?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["name"],"properties":{"name":{"type":"string","maxLength":60,"minLength":2,"description":"Group name, e.g. akira, qilin, lockbit5"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"group":"akira","momentum":{"ratio":1.49,"status":"rising","claims_last_30d":60,"avg_claims_per_30d_lifetime":40.2},"leak_site":{"label":"unverified claim from a criminal leak site","active":true,"first_listing":"2023-04-12T00:00:00+00:00","total_listings":1644,"recent_listings":[{"sector":"Manufacturing","victim":"Example Co","listed_at":"2026-10-15T13:24:36Z"}]},"reporting":{"headlines":[{"url":"https://example.com/a","title":"Example headline","publisher":"example.com","published_at":"2026-10-13T14:16:09Z"}]},"tools_reported":["Mimikatz","AnyDesk"],"co_mentioned_in_reporting":{"malware":[{"name":"Cobalt Strike","count":7}],"attack_techniques":[{"name":"T1486 - Data Encrypted for Impact","count":12}]}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.05","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.05/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_GZm379m_mxThkCojks4GE","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.05","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns comprehensive ransomware group intelligence including leak-site activity, momentum status, reported tools, co-mentioned malware/techniques/CVEs, recent headlines, and D3FEND defenses for a named group.","exampleAgentPrompt":"Pull the full threat intel profile for the Akira ransomware group — I want their leak-site momentum, reported tools, ATT&CK techniques, recent victim headlines, and any suggested D3FEND defenses.","exampleUseCases":[{"title":"SOC triage for active ransomware threat","prompt":"We just got an alert that Qilin ransomware may be targeting our sector — can you pull their current leak-site momentum, what tools they use, and what ATT&CK techniques they're known for so we can brief the team?"},{"title":"Ransomware defense posture review","prompt":"I'm building a defense playbook against LockBit 5 — look them up and give me their reported tools, co-mentioned CVEs, and any D3FEND countermeasures I should be implementing."},{"title":"Threat intelligence report on rising group","prompt":"I need a quick intelligence summary on RansomHub: are they rising or declining in activity, how many victims have they claimed recently, and what malware families show up alongside them in public reporting?"}],"resultDescription":"A JSON object containing: the group name, momentum metrics (30-day claim count, lifetime average, ratio, and status like 'rising'/'falling'), leak-site metadata (active status, first listing date, total listings, recent victim entries with sector and timestamp), recent news headlines with publisher and URL, a list of reported tools (e.g. Mimikatz, AnyDesk), and co-mentioned entities from public reporting including malware families, ATT&CK technique IDs, campaigns, and CVEs — each with occurrence counts. Also includes suggested D3FEND defensive countermeasures.","failureModes":["Group not yet cached — returns a non-200 or partial response indicating the group needs to be queued for processing","Unknown or misspelled group name returns empty or error response","Group name too short (under 2 chars) or too long (over 60 chars) triggers schema validation failure","Groups with very little public reporting may return sparse co-mention fields","Rate limiting or payment failure returns 402 or 429 status"],"whenToPreferThis":"Choose this endpoint when you need a comprehensive, single-call intelligence bundle for one specific ransomware group — covering leak-site activity, momentum trend, tooling, ATT&CK mapping, and defensive guidance. Prefer this over the group-profile endpoint (which only covers aliases and first-seen) or the recent-claims endpoint (which is time-based, not group-centric). Best for threat briefings, defense playbook creation, or SOC triage on a named threat actor.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-27T12:57:12.408Z","isFirstParty":false,"canonicalSlug":"dragons-eye-ransomware-group-intel-lookup-cca2b4a5"}