# CyberPulse Ransomware Intel

> CyberPulse Ransomware Intel is a paid API for AI agents from cyberpulse-six.vercel.app, paid per call via x402, $0.2/call, status unknown (last checked 2026-09-15).

Returns victim patterns, TTPs, ransom economics, defensive playbooks, and CISA KEV-linked entries for 50+ active ransomware groups including LockBit, ALPHV, Cl0p, RansomHub, BlackBasta, and Akira.

## Facts

- Endpoint: GET https://cyberpulse-six.vercel.app/api/cyber/ransomware-intel
- Price: $0.2/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/cyberpulse-ransomware-intel-90bd1021
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_PL1_WlDFMr92gxcizJZ0B

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability cyberpulse-ransomware-intel-90bd1021
```

Example prompt: Pull me the full threat-intel profile for LockBit ransomware — victim patterns, TTPs, ransom economics, and the defensive playbook I should use for incident response, including any related CISA KEV entries.

## When to prefer this

Use this endpoint when an agent needs structured, actionable ransomware threat intelligence — specifically victim patterns, TTPs, ransom economics, or defensive playbooks — for a named ransomware group or sector. Prefer this over generic CVE or OSINT endpoints when the threat context is ransomware-specific and incident response or proactive defense is the goal.

## Known failure modes

- Unknown or unrecognized ransomware group name returns empty or 404 response
- Stale intelligence if a group has recently rebranded or dissolved
- Rate limiting or payment failure returns 402 error
- Overly broad queries may return aggregated rather than group-specific data

## How this service works

Ransomware-group threat brief and tracking — victim patterns, TTPs, ransom economics, and defensive playbooks across LockBit, ALPHV, Cl0p, RansomHub, BlackBasta, Akira, and 50+ active groups, plus CISA KEV ransomware-linked CVEs. Global, for threat-intel and incident-response agents.

## Output

Returns structured threat intelligence for ransomware groups including victim targeting patterns, tactics/techniques/procedures (TTPs), ransom payment economics, defensive countermeasure playbooks, and CISA Known Exploited Vulnerabilities entries linked to the queried ransomware group(s).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "lang": {
       "type": "string",
       "description": "en | es | fr | de | ja | zh | ko | pt | ar | hi (default: en)"
      },
      "group": {
       "type": "string",
       "description": "Ransomware group name — e.g. \"LockBit\" | \"ALPHV\" | \"Cl0p\" | \"RansomHub\" | \"BlackBasta\" | \"Akira\" | \"Play\" | omit for landscape overview"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "errors": {
     "type": "object",
     "description": "Documented error responses, keyed by HTTP status code",
     "additionalProperties": {
      "type": "object",
      "required": [
       "description"
      ],
      "properties": {
       "example": {
        "type": "object"
       },
       "description": {
        "type": "string"
       }
      }
     }
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "query": "LockBit",
  "groups_analyzed": [
   {
    "name": "LockBit",
    "status": "disrupted (Operation Cronos Feb 2024) — partially active under LockBit 3.0",
    "activity_level": "moderate",
    "primary_targets": {
     "sectors": [
      "Finance",
      "Healthcare",
      "Government"
     ],
     "countries": [
      "USA",
      "UK",
      "Germany",
      "Australia"
     ]
    },
    "ransomware_as_a_service": true,
    "typical_ransom_range_usd": "$1,000,000 - $50,000,000"
   }
  ],
  "executive_summary": "LockBit remains one of the most prolific ransomware operations despite law enforcement disruption in Feb 2024. Healthcare and finance are primary targets. Immutable backups and MFA on all remote access are the most effective countermeasures.",
  "global_ransomware_statistics": {
   "average_downtime_days": 21,
   "percentage_paying_ransom": "34%",
   "average_ransom_demand_usd": 1500000
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cyberpulse-ransomware-intel-90bd1021/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from cyberpulse-six.vercel.app](https://www.zero.xyz/host/cyberpulse-six.vercel.app/llms.txt)