{"uid":"cap_QSK5bI87llW9zualCGhEr","slug":"ot-intel-api-onrender-com-403c5fad","name":"OT Intel API – ICS Threat Actors by Industrial Sector","description":"ICS threat actors by sector. Pass ?sector=energy. Returns all groups targeting that sector from live MITRE ATT&CK ICS STIX data. Covers energy, water, manufacturing, oil-and-gas, chemical, transportation, nuclear.","url":"https://ot-intel-api.onrender.com/ot/actor/sector","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["sector"],"properties":{"sector":{"type":"string","description":"Industry sector e.g. energy, water, manufacturing, oil-and-gas, chemical, transportation, nuclear"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"count":2,"query":{"sector":"energy"},"freshness":"2025-05-22T10:00:00.000Z","data_sources":["MITRE-ATT&CK-ICS","DeepSeek-CTI-Analysis"],"actors_targeting_sector":[{"name":"SANDWORM","attribution":"Russia — GRU Unit 74455","activity_status":"ACTIVE","physical_impact":"CONFIRMED DESTRUCTIVE"},{"name":"VOLTZITE","attribution":"China","activity_status":"ACTIVE","physical_impact":"LIKELY"}]}},"example":{"request":{"input":{"type":"http","method":"GET","queryParams":{"sector":"energy"}}},"response":{"_type":"actor-sector","count":10,"query":{"sector":"energy"},"sector":"energy","freshness":"2026-05-29T04:40:52.190Z","data_sources":["MITRE-ATT&CK-ICS","DeepSeek-CTI-Analysis"],"actors_targeting_sector":[{"name":"Dragonfly","attribution":"Russia","activity_status":"Active","physical_impact":"Disruption of energy operations"},{"name":"HEXANE","attribution":"Iran","activity_status":"Active","physical_impact":"Espionage and disruption"},{"name":"APT33","attribution":"Iran","activity_status":"Active","physical_impact":"Espionage and disruption"},{"name":"ALLANITE","attribution":"Unknown","activity_status":"Active","physical_impact":"Espionage"},{"name":"Sandworm Team","attribution":"Russia","activity_status":"Active","physical_impact":"Disruption of energy operations"},{"name":"Dragonfly 2.0","attribution":"Russia","activity_status":"Active","physical_impact":"Disruption of energy operations"},{"name":"Lazarus Group","attribution":"North Korea","activity_status":"Active","physical_impact":"Espionage and disruption"},{"name":"OilRig","attribution":"Iran","activity_status":"Active","physical_impact":"Espionage"},{"name":"TEMP.Veles","attribution":"Russia","activity_status":"Active","physical_impact":"Disruption of energy operations"},{"name":"CyberAv3ngers","attribution":"Iran","activity_status":"Active","physical_impact":"Disruption of energy operations"}]}},"exampleRequest":{"sector":"energy"},"tags":["x402"],"displayCostAmount":"0.03","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.03/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_VUzOdvkOuFRRNqytjLpeE","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.03","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns all known ICS/SCADA/OT threat actor groups targeting a specified industrial sector, sourced from live MITRE ATT&CK for ICS STIX data.","exampleAgentPrompt":"Can you pull all the known ICS and SCADA threat actor groups that target the energy sector from the MITRE ATT&CK for ICS data?","exampleUseCases":[{"title":"Water utility threat landscape assessment","prompt":"I need to understand which threat actor groups are actively targeting water utilities. Can you pull all the known OT threat actors focusing on the water sector from the latest MITRE ATT&CK for ICS intelligence?"},{"title":"Chemical plant security risk evaluation","prompt":"We're doing a cybersecurity audit for our chemical manufacturing facility. Can you get me a list of all known ICS threat groups that specifically target chemical sector infrastructure?"},{"title":"Oil and gas infrastructure threat modeling","prompt":"For our incident response planning, I need to know what APT groups and SCADA threat actors are known to target oil-and-gas operations. Can you pull that data from MITRE ATT&CK for ICS?"}],"resultDescription":"A structured list of all known ICS/OT threat actor groups that target the specified industrial sector, drawn from live MITRE ATT&CK for ICS STIX data. Each entry typically includes threat group names and associated metadata relevant to that sector.","failureModes":["Missing required 'sector' query parameter — returns 400 or error response","Unsupported or unrecognized sector value — may return empty results or error","Render.com cold-start latency (free tier) — first request may time out after inactivity","MITRE ATT&CK STIX data source unavailable — may return stale or no results","Typo in sector name (e.g. 'oil_gas' instead of 'oil-and-gas') — returns no results"],"whenToPreferThis":"Use this endpoint when you need a sector-scoped list of ICS/OT threat actor groups for threat modeling, risk assessments, or industrial cybersecurity reporting. Prefer this over the full actor profile endpoint (/ot/actor with ?name=) when you want to discover all relevant adversaries for a sector rather than look up a specific named group. Best for generating sector threat reports or populating threat matrices for energy, water, manufacturing, oil-and-gas, chemical, transportation, or nuclear environments.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T12:49:30.064Z","isFirstParty":false}