# CyberPulse Ransomware Intelligence API

> CyberPulse Ransomware Intelligence API is a paid API for AI agents from cyberpulse.theaslangroupllc.com, paid per call via x402, $0.2/call, status unknown (last checked 2026-09-16).

Returns structured threat intelligence briefs on ransomware groups including victim patterns, TTPs, ransom economics, defensive playbooks, and CISA KEV-linked CVEs for 50+ active groups.

## Facts

- Endpoint: GET https://cyberpulse.theaslangroupllc.com/api/cyber/ransomware-intel
- Price: $0.2/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-16
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/cyberpulse-ransomware-intelligence-api-d3796471
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_p2uzxqMddh8vHccnSSw4X

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability cyberpulse-ransomware-intelligence-api-d3796471
```

Example prompt: Give me a full threat intel brief on the LockBit ransomware group — victim patterns, known TTPs, ransom economics, any CISA KEV CVEs they exploit, and a defensive playbook I can hand to our incident response team.

## When to prefer this

Choose this endpoint when you need structured, aggregated ransomware-specific threat intelligence including TTPs, victim profiling, and defensive guidance for a named group (LockBit, ALPHV, Cl0p, RansomHub, BlackBasta, Akira, and 50+ others). Prefer this over generic threat-intel endpoints when the query is explicitly ransomware-focused or involves incident response planning against a specific ransomware actor.

## Known failure modes

- Unknown or misspelled ransomware group name returns empty or partial results
- Group no longer active may return stale data
- Rate limiting or payment failure (402) if USDC balance insufficient
- Network timeout if upstream threat-intel aggregation is slow
- Very new ransomware groups may not yet be indexed

## How this service works

Ransomware-group threat brief and tracking — victim patterns, TTPs, ransom economics, and defensive playbooks across LockBit, ALPHV, Cl0p, RansomHub, BlackBasta, Akira, and 50+ active groups, plus CISA KEV ransomware-linked CVEs. Global, for threat-intel and incident-response agents.

## Output

A structured ransomware threat brief covering victim targeting patterns, tactics/techniques/procedures (TTPs), ransom demand economics, defensive and mitigation playbooks, and associated CISA KEV-listed CVEs for the queried ransomware group or across all tracked active groups.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "lang": {
       "type": "string",
       "description": "en | es | fr | de | ja | zh | ko | pt | ar | hi (default: en)"
      },
      "group": {
       "type": "string",
       "description": "Ransomware group name — e.g. \"LockBit\" | \"ALPHV\" | \"Cl0p\" | \"RansomHub\" | \"BlackBasta\" | \"Akira\" | \"Play\" | omit for landscape overview"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "errors": {
     "type": "object",
     "description": "Documented error responses, keyed by HTTP status code",
     "additionalProperties": {
      "type": "object",
      "required": [
       "description"
      ],
      "properties": {
       "example": {
        "type": "object"
       },
       "description": {
        "type": "string"
       }
      }
     }
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "query": "LockBit",
  "groups_analyzed": [
   {
    "name": "LockBit",
    "status": "disrupted (Operation Cronos Feb 2024) — partially active under LockBit 3.0",
    "activity_level": "moderate",
    "primary_targets": {
     "sectors": [
      "Finance",
      "Healthcare",
      "Government"
     ],
     "countries": [
      "USA",
      "UK",
      "Germany",
      "Australia"
     ]
    },
    "ransomware_as_a_service": true,
    "typical_ransom_range_usd": "$1,000,000 - $50,000,000"
   }
  ],
  "executive_summary": "LockBit remains one of the most prolific ransomware operations despite law enforcement disruption in Feb 2024. Healthcare and finance are primary targets. Immutable backups and MFA on all remote access are the most effective countermeasures.",
  "global_ransomware_statistics": {
   "average_downtime_days": 21,
   "percentage_paying_ransom": "34%",
   "average_ransom_demand_usd": 1500000
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cyberpulse-ransomware-intelligence-api-d3796471/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from cyberpulse.theaslangroupllc.com](https://www.zero.xyz/host/cyberpulse.theaslangroupllc.com/llms.txt)