NEEDS ATTENTION NOW
THREATHUB · GLOBAL CYBER THREAT INTELLIGENCE
See the threat. Understand the context. Act on evidence.
An evidence-led analyst workspace for ransomware, exploited vulnerabilities, threat actors, malware, IOCs and emerging cyber activity. Every assessment preserves source provenance, confidence and collection context.
ANALYST WORKSPACE
THREATHUB COMMAND CENTRE
Global cyber situation picture
Evidence-backed priority, exploitation, ransomware, Pulse and collection health in one operational view.
LIVEWaiting for intelligence…
EXTERNAL THREAT POSTURE
Evidence confidence —CALCULATING
—/100
CTI ANALYST ASSESSMENT
CALCULATING
Key judgement, confidence & intelligence gaps
Separates source-backed facts from analytical judgement and collection limitationsBuilding assessment from current source snapshots…
Waiting for correlated intelligence.
Confidence basis—
ASSESSMENT ≠ FACT Analytical judgements are derived from the loaded source set.CONFIDENCE ≠ PROBABILITY Confidence reflects evidence quality and collection coverage.
GLOBAL THREAT LANDSCAPE
Geolocated threat activity & live intelligence
Building global intelligence view…AUTO60s sync
Highest activityElevatedObservedActor / ransomware lensLatest ≤24h
Waiting for first render…
LIVE INTELLIGENCE
Latest intelligence
All signals · 30DLIVE—
Published ransomware snapshot checked every 60s · full intelligence refresh every 6 hours
INTELLIGENCE FUSION
TRACEABLEEvidence-backed relationship chains
Only relationships supported by the currently loaded source set are shownTOP RANSOMWARE GROUPS
30DActor concentration
—claims
VULNERABILITY WATCH
LIVEExploit pressure
Known Exploited—
EPSS > 50%—
Ransomware KEV—
Total KEVs—
TOP TARGETED COUNTRIES
30DRansomware claim geography
THREAT ACTOR ACTIVITY
7DMost active groups
ORGANIZATION INTELLIGENCE
30DEnrichment coverage
—enriched
—ransomware claims matched to seeded organization intelligenceLoading organization seed…
Domains—
Industries—
ZoomInfo IDs—
TOP TARGETED INDUSTRIES
30DEnriched victim sectors
Seed-backed classification only · no inferred industries
ORGANIZATION SIZE
ENRICHMENTEmployee exposure
Populates when employee-size fields are available from an approved enrichment source
ECONOMIC EXPOSURE
ENRICHMENTRevenue profile
Populates when revenue fields are available from an approved enrichment source
INTELLIGENCE ENGINE
— sourcesPulse —Ransomware —KEV —
THREATHUB INVESTIGATION · ENTITY CORRELATION
EVIDENCE-FIRST
Follow the evidence across entities.
Search loaded CTI for a CVE, ATT&CK technique, campaign, ransomware group, victim, country, malware family or IOC. Direct evidence is separated from contextual relationships.
SEARCH EXAMPLES
Investigation workspace ready
Enter an entity above or use the global search. ThreatHub will show source-backed matches, direct relationships, contextual links and collection gaps.
MITRE ATT&CK MAPPING
ATT&CK —Observed adversary behavior
Technique and tactic relationships come from the official Enterprise ATT&CK dataset or an explicit ATT&CK ID in loaded source evidence.RELATIONSHIP MAP
0 LINKSCorrelated intelligence
Solid links are directly present in loaded source data. Dashed/context labels indicate analyst context, not incident attribution.EVIDENCE
0 RECORDSSource-backed observations
INTELLIGENCE · CAMPAIGN CORRELATION
Campaign Intelligence
Separate the official ATT&CK campaign profile from the latest ThreatHub observations. Direct ATT&CK relationships remain distinct from contextual Pulse evidence, with visible freshness and provenance.
ATT&CK —
CAMPAIGN DIRECTORY
Structured adversary operations
Waiting for MITRE ATT&CK…Run the MITRE ATT&CK collector to populate campaign intelligence.
EXECUTIVE INTELLIGENCE
Management situation brief
A concise, evidence-based summary generated from the five live intelligence sources.
CURRENT SITUATION
Generating briefing…
Waiting for correlated intelligence.
What changed
LATEST SIGNALSWhat to watch
NEXT ACTIONTop KEV watchlist
CLICK TO DRILL DOWNRegional picture
Source confidence
—MALAYSIA & ASEAN
REGIONAL LENSRegional Threat Intelligence
Malaysia-focused cyber signals with ASEAN ransomware activity from the currently loaded public intelligence feed.
MALAYSIA FOCUS
ASSESSINGNational cyber signal picture
MY
DASHBOARD SIGNAL SCORE—
Waiting for Malaysia intelligence.
Derived OSINT signal. Not an official national threat level.≤24h—
≤7d—
≤30d—
Top group—
ASEAN PULSE
11 MEMBERSRegional ransomware activity
—claims in loaded feed
≤24h—
≤7d—
Active countries—
Top country—
REGIONAL HEAT MATRIX
Latest-feed sampleASEAN claim concentration
Regional threat groups
—Targeted sectors
OSINTLatest MyCERT advisories
National advisory feedTHREATHUB PULSE · CYBER SIGNAL DISCOVERY
See what is gaining momentum across the cyber world.
ThreatHub Pulse correlates ransomware, vulnerabilities, malware, breaches, IOCs and threat research from trusted public sources, then ranks what is trending, emerging and corroborated.
LIVE RANKINGDISCOVER · INVESTIGATE · VERIFY
Discover important signals earlier.Pulse measures momentum, source diversity, credibility and cross-source corroboration so you can prioritize what deserves attention, investigate the relationships and verify every finding against its original evidence.
TRENDING NOW
Highest-significance cyber topics
Building ranking…DISCOVERY PRIORITY
Ranked discovery queue
Priority ordered by signal score, momentum, credibility, evidence and recency— topics
| Rank | Topic | Category | Score | Momentum | Signals | Latest | Actions |
|---|
WORLD MAP
Waiting for render…Geolocated threat activity
Highest activityElevatedObservedActor / ransomware lensLatest ≤24h
RANSOMWARE INTELLIGENCE
Victims, Groups, Targeting & Evidence
Investigate public ransomware and extortion claims across the retained historical archive, from global activity and actor concentration down to victim, country, sector and source traceability.
FEED STATUSCHECKINGSelecting freshest public feed…
LAST COLLECTOR CHECK—GitHub Actions
LATEST SOURCE CLAIM—Waiting for source data
NEW THIS CHECK—Compared with previous collection
LIVE RANSOMWARE PULSEVictim-claim intelligence · browser auto-sync every 60 seconds · source collector every 6 hours
LATEST CLAIM—Waiting for source data
CLAIMS ≤24H—Current live window
COUNTRIES ≤24H—Mapped countries
ACTIVE GROUPS ≤24H—Observed groups
MALAYSIA ≤24H—Malaysia focus
Retained archive—Rolling history
Claims · 90D—Selected window
Claims ≤24h—Latest activity
Active groups—In current view
Countries—With mapped claims
INVESTIGATION WORKBENCH
Find and narrow ransomware intelligence
Search victim, domain, ransomware group, country or sector. Filters update the map, analytics and claim explorer together.No investigation filters applied
Loading intelligence…GLOBAL LIVE TARGETING
Where ransomware claims are appearing now
LIVE · last 24 hoursLowHighLatest ≤24hAUTO SYNC · 60s
Colourful base map = visual geography. Bright heat colours = claim volume in the selected window. Pulsing markers = latest claims discovered within 24 hours.Mapping retained claims…
ACTIVITY MOMENTUM
LIVEClaim trend
Selected history windowACTOR CONCENTRATION
DRILL-DOWNMost active groups
Click a group for profileTargeted countries
Click to inspect claimsTargeted sectors
Selected windowRecent victim claims
Click for evidence viewVICTIM CLAIM EXPLORER
— MATCHES
Investigate retained ransomware claims
Every row preserves the victim → group → country → sector → discovery time → source-evidence path.| Victim | Group | Country | Sector | Discovered | Verification | Evidence |
|---|---|---|---|---|---|---|
Loading retained ransomware intelligence… | ||||||
THREAT ACTOR EXPLORER
— GROUPSRansomware group profiles
Activity, countries, sectors and any TTP/CVE/tool metadata exposed by the public source.ACTIVE GROUPS · 30D—Groups with observed victim claims
ACTIVE GROUPS · 7D—Recent operational activity
STRONG EVIDENCE—Evidence completeness — not attribution probability
PULSE OBSERVED—Explicit ransomware-group topic entities
ASEAN RELEVANT—Observed ASEAN claims ≤90D
MOST ACTIVE · 30D—Waiting for data
ACTOR SPOTLIGHT
Most active actor
Building actor profile from retained claims…—THREAT ACTOR
30D CLAIMS—
7D ACTIVITY—
TOP COUNTRY—
TOP SECTOR—
Actor activity is derived from source-backed ransomware victim claims; ThreatHub does not infer attribution beyond the loaded source metadata.
ACTOR MOMENTUM
30DMost active groups
30-day claim volume with 7-day activity contextACTOR DIRECTORY
— ACTORSObserved ransomware & extortion groups
Search, compare and investigate current actor activity.ACTOR / EVIDENCE30D7DMOMENTUMINTELLIGENCEASEANTOP TARGET
TARGET COUNTRIES
Geographic concentration
Countries appearing most often across 30-day actor claimsTARGET SECTORS
Sector concentration
Industries with the highest observed claim volumeLATEST ACTOR ACTIVITY
Recent victim claims
Newest retained ransomware disclosuresTOP INFOSTEALER ACTIVITY
SOURCE-BACKEDFamily activity watch
Building family intelligence…FAMILY DIRECTORY
— FAMILIESObserved infostealer families
Derived from loaded MalwareBazaar, ThreatFox and other source-backed Pulse records.| Family | Activity | Momentum | Samples | IOCs | Sources | First seen | Last seen |
|---|
LATEST EVIDENCE
Recent infostealer observations
EVIDENCE RULE
What this workspace means
ThreatHub Infostealer Intelligence V1 shows malware-family, sample, IOC and research evidence already present in the loaded intelligence. It does not claim stolen credentials, compromised organizations or account exposure unless a future approved exposure source explicitly supports that relationship.
INDICATOR DIRECTORY
— MATCHESEnforced IOC lifecycle queue
Expired and revoked indicators remain auditable but are excluded from the default operational view and current-risk relationships.| Indicator | Type | Confidence | Lifecycle | Sightings | Sources | Last seen / expiry | Context |
|---|
Page —
LATEST SIGHTINGS
SOURCE-BACKEDRecent source observations
Click an observation to inspect the IOC, evidence chain and related entities.
VULNERABILITY INTELLIGENCE
Exploit Intelligence 3.0
Turn CISA KEV seeds into enriched exploit intelligence by correlating NVD, FIRST EPSS, Pulse observations, MyCERT regional advisories and explicit IOC relationships — without inventing actor attribution.
—PRESSURE
CURRENT VULNERABILITY PRESSURE
Assessing exploit signals
ASSESSINGCorrelating actively exploited KEVs, CVSS severity, EPSS probability and ransomware association.
CVSS Coverage—NVD enriched
EPSS Coverage—FIRST scored
ENRICHMENT LAYER
LOADING ENRICHMENT
What the KEV seed tells us beyond severity
Cross-source observation, regional relevance and evidence completeness are kept separate from the existing ThreatHub priority score.Cross-source CVEs—Pulse evidence
MyCERT relevance—Malaysia advisory references
Strong evidence—Evidence completeness · not probability
Fresh evidence · 7D—Latest source-backed observation
IOC-linked CVEs—Explicit source relationships only
Building a stable enrichment snapshot from the loaded intelligence sources…
EXPLOIT INTELLIGENCE WORKBENCH
Filter, prioritise and verify known exploited vulnerabilities
CISA KEV confirms exploitation. ThreatHub enriches each seed with technical severity, exploit probability, cross-source observations, regional advisories, IOC relationships and evidence strength.CISA KEV · EXPLOITATION CONFIRMED
No investigation filters applied
Loading correlated vulnerability intelligence…PRIORITY WATCHLIST
Click a card to open enriched evidence, Pulse observations, regional relevance and authoritative source links.
Top vulnerabilities to watch now
EXPLOIT RISK MATRIX
CVSS × EPSS × CTI Priority
Upper-right means severe + highly likely exploitation. Click a point for evidence.CriticalHighMedium
RISK COMPOSITION
—Severity & exploit probability
—scored
Critical —High —Medium —Low —
FIRST EPSS probability bands—
Coverage——
EPSS ≥10%—
Top 1%—
90-DAY MOMENTUM
LIVE DATANew exploited vulnerabilities
CISA KEV additions vs ransomware-associated additionsKEV additionsRansomware-related
TECHNOLOGY CONCENTRATION
—Most represented vendors
Click a vendor to filter the live KEV tableLIVE ENRICHED RECORDS
KEV-seeded exploit intelligence
Loading…| CVE | Vendor / Product | CVSS | EPSS | Ransomware | CTI | Intelligence | Evidence |
|---|
Page 1
UNIFIED INTELLIGENCE
Live operational feed
A focused triage timeline of the newest source-backed intelligence. Open any row for full context, evidence and source links.
LIVEUpdated
OPERATIONAL TIMELINE
Newest correlated intelligence
Building signals…Collection freshnessCollector recency and source healthView details ↓
Data caveat: ransomware victim entries are public claims and not automatically independently verified incidents. Ransomware map and ASEAN counts use the retained Ransomware.live historical mirror when available and fall back to recent public-claim data; they are OSINT claims, not complete national incident totals. The Malaysia signal score is dashboard-derived OSINT. EPSS is provided by FIRST. This product uses NVD data but is not endorsed or certified by NVD.