NEEDS ATTENTION NOW
THREATHUB · GLOBAL CYBER THREAT INTELLIGENCE
See the threat. Understand the context. Act on evidence.
An evidence-led analyst workspace for ransomware, exploited vulnerabilities, threat actors, malware, IOCs and emerging cyber activity. Every assessment preserves source provenance, confidence and collection context.
ANALYST WORKSPACE
PUBLIC CYBER THREAT INTELLIGENCE · THREATHUB 2.0
Global Cyber Situation Picture
ThreatHub provides a public, evidence-led view of ransomware claims, exploited vulnerabilities, threat actors, malware, indicators of compromise and emerging cyber signals. Explore current intelligence, historical ransomware trends and ASEAN country context without treating third-party claims as confirmed incidents.
THREATHUB COMMAND CENTRE
Global cyber situation picture
Evidence-backed priority, exploitation, ransomware, Pulse and collection health in one operational view.
LIVEWaiting for intelligence…
EXTERNAL THREAT POSTURE
Evidence confidence —CALCULATING
—/100
CTI ANALYST ASSESSMENT
CALCULATING
Key judgement, confidence & intelligence gaps
Separates source-backed facts from analytical judgement and collection limitationsBuilding assessment from current source snapshots…
Waiting for correlated intelligence.
Confidence basis—
ASSESSMENT ≠ FACT Analytical judgements are derived from the loaded source set.CONFIDENCE ≠ PROBABILITY Confidence reflects evidence quality and collection coverage.
GLOBAL THREAT LANDSCAPE
Geolocated threat activity & live intelligence
Building global intelligence view…AUTO60s sync
Highest activityElevatedObservedActor / ransomware lensLatest ≤24h
Waiting for first render…
LIVE INTELLIGENCE
Latest intelligence
All signals · 30DLIVE—
Published ransomware snapshot checked every 60s · full intelligence refresh every 6 hours
INTELLIGENCE FUSION
TRACEABLEEvidence-backed relationship chains
Only relationships supported by the currently loaded source set are shownTOP RANSOMWARE GROUPS
30DActor concentration
—claims
VULNERABILITY WATCH
LIVEExploit pressure
Known Exploited—
EPSS > 50%—
Ransomware KEV—
Total KEVs—
TOP TARGETED COUNTRIES
30DRansomware claim geography
THREAT ACTOR ACTIVITY
7DMost active groups
ORGANIZATION INTELLIGENCE
30DEnrichment coverage
—enriched
—ransomware claims matched to seeded organization intelligenceLoading organization seed…
Domains—
Industries—
ZoomInfo IDs—
TOP TARGETED INDUSTRIES
30DEnriched victim sectors
Seed-backed classification only · no inferred industries
ORGANIZATION SIZE
ENRICHMENTEmployee exposure
Populates when employee-size fields are available from an approved enrichment source
ECONOMIC EXPOSURE
ENRICHMENTRevenue profile
Populates when revenue fields are available from an approved enrichment source
INTELLIGENCE ENGINE
— sourcesPulse —Ransomware —KEV —
THREATHUB INVESTIGATION · ENTITY CORRELATION
EVIDENCE-FIRST
Follow the evidence across entities.
Search loaded CTI for a CVE, ATT&CK technique, campaign, ransomware group, victim, country, malware family or IOC. Direct evidence is separated from contextual relationships.
SEARCH EXAMPLES
Investigation workspace ready
Enter an entity above or use the global search. ThreatHub will show source-backed matches, direct relationships, contextual links and collection gaps.
MITRE ATT&CK MAPPING
ATT&CK —Observed adversary behavior
Technique and tactic relationships come from the official Enterprise ATT&CK dataset or an explicit ATT&CK ID in loaded source evidence.RELATIONSHIP MAP
0 LINKSCorrelated intelligence
Solid links are directly present in loaded source data. Dashed/context labels indicate analyst context, not incident attribution.EVIDENCE
0 RECORDSSource-backed observations
INTELLIGENCE · CAMPAIGN CORRELATION
Campaign Intelligence
Separate the official ATT&CK campaign profile from the latest ThreatHub observations. Direct ATT&CK relationships remain distinct from contextual Pulse evidence, with visible freshness and provenance.
ATT&CK —
CAMPAIGN DIRECTORY
Structured adversary operations
Waiting for MITRE ATT&CK…Run the MITRE ATT&CK collector to populate campaign intelligence.
EXECUTIVE INTELLIGENCE
Management situation brief
A concise, evidence-based summary generated from the five live intelligence sources.
CURRENT SITUATION
Generating briefing…
Waiting for correlated intelligence.
What changed
LATEST SIGNALSWhat to watch
NEXT ACTIONTop KEV watchlist
CLICK TO DRILL DOWNRegional picture
Source confidence
—MALAYSIA & ASEAN
REGIONAL LENSRegional Threat Intelligence
Malaysia-focused cyber signals with ASEAN ransomware activity from the last 30 days of the loaded public intelligence feed.
MALAYSIA FOCUS
ASSESSINGNational cyber signal picture
MY
DASHBOARD SIGNAL SCORE—
Waiting for Malaysia intelligence.
Derived OSINT signal. Not an official national threat level.≤24h—
≤7d—
≤30d—
Top group—
ASEAN PULSE
11 MEMBERSRegional ransomware activity
—claims in last 30 days
≤24h—
≤7d—
Active countries—
Top country—
HISTORICAL BASELINE
ALL RETAINED HISTORYReported victim claims over time
Cumulative unique public ransomware claims grouped by reported attack date when available.
TOTAL REPORTED—unique victim claims
MALAYSIA—reported victim claims
ASEAN—reported victim claims
TOTAL · ASEAN · MALAYSIAWaiting for historical summary.
HISTORICAL ASEAN DISTRIBUTION
All retained history · click a country for detailReported claims by country
REGIONAL CLAIM TOTALS
All retained historyASEAN historical claim totals
REGIONAL INVESTIGATION
ANALYST FILTERFocus a country or sector
Filter retained public claims to examine regional exposure without treating claim volume as confirmed incident volume.
Loading regional scope…
TOP GROUPSWithin selected scope
TOP SECTORSWithin selected scope
LATEST CLAIMSPublic OSINT observations
Regional threat groups
—Targeted sectors
OSINTOFFICIAL COVERAGE NETWORK
CERT & national advisories
All registered official advisory streamsMONITORED
OFFICIAL STREAMS—
RECORDS AVAILABLE—
ACTIVE COVERAGE—
WHY IT MATTERS
National CERTs provide authoritative context around regional vulnerability and incident activity.
STREAM DIRECTORY
Click any record to verify at sourceOfficial intelligence channels
THREATHUB PULSE · CYBER SIGNAL DISCOVERY
See what is gaining momentum across the cyber world.
ThreatHub Pulse correlates ransomware, vulnerabilities, malware, breaches, IOCs and threat research from trusted public sources, then ranks what is trending, emerging and corroborated.
LIVE RANKINGDISCOVER · INVESTIGATE · VERIFY
Discover important signals earlier.Pulse measures momentum, source diversity, credibility and cross-source corroboration so you can prioritize what deserves attention, investigate the relationships and verify every finding against its original evidence.
TRENDING NOW
Highest-significance web Pulse topics
Building ranking…DISCOVERY PRIORITY
Ranked discovery queue
Includes CISA KEV priority vulnerabilities, ransomware and web Pulse signals— topics
| Rank | Topic | Category | Score | Momentum | Signals | Latest | Actions |
|---|
WORLD MAP
Waiting for render…Geolocated threat activity
Highest activityElevatedObservedActor / ransomware lensLatest ≤24h
RANSOMWARE INTELLIGENCE
Victims, Groups, Targeting & Evidence
Investigate public ransomware and extortion claims across the retained historical archive, from global activity and actor concentration down to victim, country, sector and source traceability.
FEED STATUSCHECKINGSelecting freshest public feed…
LAST COLLECTOR CHECK—GitHub Actions
LATEST SOURCE CLAIM—Waiting for source data
NEW THIS CHECK—Compared with previous collection
LIVE RANSOMWARE PULSEVictim-claim intelligence · browser auto-sync every 60 seconds · source collector every 6 hours
LATEST CLAIM—Waiting for source data
CLAIMS ≤24H—Current live window
COUNTRIES ≤24H—Mapped countries
ACTIVE GROUPS ≤24H—Observed groups
MALAYSIA ≤24H—Malaysia focus
Retained archive—Rolling history
Claims · 90D—Selected window
Claims ≤24h—Latest activity
Active groups—In current view
Countries—With mapped claims
INVESTIGATION WORKBENCH
Find and narrow ransomware intelligence
Search victim, domain, ransomware group, country or sector. Filters update the map, analytics and claim explorer together.No investigation filters applied
Loading intelligence…GLOBAL LIVE TARGETING
Where ransomware claims are appearing now
LIVE · last 24 hoursLowHighLatest ≤24hAUTO SYNC · 60s
Colourful base map = visual geography. Bright heat colours = claim volume in the selected window. Pulsing markers = latest claims discovered within 24 hours.Mapping retained claims…
ACTIVITY MOMENTUM
LIVEClaim trend
Selected history windowACTOR CONCENTRATION
DRILL-DOWNMost active groups
Click a group for profileTargeted countries
Click to inspect claimsTargeted sectors
Selected windowRecent victim claims
Click for evidence viewVICTIM CLAIM EXPLORER
— MATCHES
Investigate retained ransomware claims
Every row preserves the victim → group → country → sector → discovery time → source-evidence path.| Victim | Group | Country | Sector | Discovered | Verification | Evidence |
|---|---|---|---|---|---|---|
Loading retained ransomware intelligence… | ||||||
THREAT ACTOR EXPLORER
— GROUPSRansomware group profiles
Activity, countries, sectors and any TTP/CVE/tool metadata exposed by the public source.ACTIVE GROUPS · 30D—Groups with observed victim claims
ACTIVE GROUPS · 7D—Recent operational activity
STRONG EVIDENCE—Evidence completeness — not attribution probability
PULSE OBSERVED—Explicit ransomware-group topic entities
ASEAN RELEVANT—Observed ASEAN claims ≤90D
MOST ACTIVE · 30D—Waiting for data
ACTOR SPOTLIGHT
Most active actor
Building actor profile from retained claims…—THREAT ACTOR
30D CLAIMS—
7D ACTIVITY—
TOP COUNTRY—
TOP SECTOR—
Actor activity is derived from source-backed ransomware victim claims; ThreatHub does not infer attribution beyond the loaded source metadata.
ACTOR MOMENTUM
30DMost active groups
30-day claim volume with 7-day activity contextACTOR DIRECTORY
— ACTORSObserved ransomware & extortion groups
Search, compare and investigate current actor activity.ACTOR / EVIDENCE30D7DMOMENTUMINTELLIGENCEASEANTOP TARGET
TARGET COUNTRIES
Geographic concentration
Countries appearing most often across 30-day actor claimsTARGET SECTORS
Sector concentration
Industries with the highest observed claim volumeLATEST ACTOR ACTIVITY
Recent victim claims
Newest retained ransomware disclosuresTOP INFOSTEALER ACTIVITY
SOURCE-BACKEDPriority family watch
Building family intelligence…FAMILY DIRECTORY
— FAMILIESObserved infostealer families
Derived from loaded MalwareBazaar, ThreatFox and other source-backed Pulse records.| Family | Activity | Momentum | Samples | Unique IOCs | Sources | First seen | Last seen |
|---|
LATEST EVIDENCE
Recent infostealer observations
EVIDENCE RULE
What this workspace means
ThreatHub Infostealer Intelligence V1 shows malware-family, sample, IOC and research evidence already present in the loaded intelligence. It does not claim stolen credentials, compromised organizations or account exposure unless a future approved exposure source explicitly supports that relationship.
INDICATOR DIRECTORY
— MATCHESEnforced IOC lifecycle queue
Expired and revoked indicators remain auditable but are excluded from the default operational view and current-risk relationships.| Indicator | Type | Confidence | Lifecycle | Sightings | Sources | Last seen / expiry | Context |
|---|
Page —
LATEST SIGHTINGS
SOURCE-BACKEDRecent source observations
Click an observation to inspect the IOC, evidence chain and related entities.
VULNERABILITY INTELLIGENCE
Exploit Intelligence 3.0
Turn CISA KEV seeds into enriched exploit intelligence by correlating NVD, FIRST EPSS, Pulse observations, MyCERT regional advisories and explicit IOC relationships — without inventing actor attribution.
—PRESSURE
CURRENT VULNERABILITY PRESSURE
Assessing exploit signals
ASSESSINGCorrelating actively exploited KEVs, CVSS severity, EPSS probability and ransomware association.
CVSS Coverage—NVD enriched
EPSS Coverage—FIRST scored
ENRICHMENT LAYER
LOADING ENRICHMENT
What the KEV seed tells us beyond severity
Cross-source observation, regional relevance and evidence completeness are kept separate from the existing ThreatHub priority score.Cross-source CVEs—Pulse evidence
MyCERT relevance—Malaysia advisory references
Strong evidence—Evidence completeness · not probability
Fresh evidence · 7D—Latest source-backed observation
IOC-linked CVEs—Explicit source relationships only
Building a stable enrichment snapshot from the loaded intelligence sources…
EXPLOIT INTELLIGENCE WORKBENCH
Filter, prioritise and verify known exploited vulnerabilities
CISA KEV confirms exploitation. ThreatHub enriches each seed with technical severity, exploit probability, cross-source observations, regional advisories, IOC relationships and evidence strength.CISA KEV · EXPLOITATION CONFIRMED
No investigation filters applied
Loading correlated vulnerability intelligence…PRIORITY WATCHLIST
Ranked by CTI priority, KEV recency and live Pulse activity · click a card for enriched evidence and authoritative sources.
Top vulnerabilities to watch now
EXPLOIT RISK MATRIX
CVSS × EPSS × CTI Priority
Upper-right means severe + highly likely exploitation. Click a point for evidence.CriticalHighMedium
RISK COMPOSITION
—Severity & exploit probability
—scored
Critical —High —Medium —Low —
FIRST EPSS probability bands—
Coverage——
EPSS ≥10%—
Top 1%—
90-DAY MOMENTUM
LIVE DATANew exploited vulnerabilities
CISA KEV additions vs ransomware-associated additionsKEV additionsRansomware-related
TECHNOLOGY CONCENTRATION
—Most represented vendors
Click a vendor to filter the live KEV tableLIVE ENRICHED RECORDS
KEV-seeded exploit intelligence
Loading…| CVE | Vendor / Product | CVSS | EPSS | Ransomware | CTI | Intelligence | Evidence |
|---|
Page 1
UNIFIED INTELLIGENCE
Live operational feed
A focused triage timeline of the newest source-backed intelligence. Open any row for full context, evidence and source links.
LIVEUpdated
OPERATIONAL TIMELINE
Newest correlated intelligence
Building signals…Collection freshnessCollector recency and source healthView details ↓
Data caveat: ransomware victim entries are public claims and not automatically independently verified incidents. Ransomware map and ASEAN counts use the retained Ransomware.live historical mirror when available and fall back to recent public-claim data; they are OSINT claims, not complete national incident totals. The Malaysia signal score is dashboard-derived OSINT. EPSS is provided by FIRST. This product uses NVD data but is not endorsed or certified by NVD.