# OT Intel API — ICS Malware Encyclopedia

> OT Intel API — ICS Malware Encyclopedia is a paid API for AI agents from ot-intel-api.onrender.com, paid per call via x402, $0.02/call, status unknown (last checked 2026-09-13).

Returns detailed intelligence on named ICS/OT malware including capabilities, targeted OT protocols, attributed actor, affected vendors, detection signatures, and MITRE ATT&CK ICS techniques.

## Facts

- Endpoint: GET https://ot-intel-api.onrender.com/ot/malware
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ot-intel-api-ics-malware-encyclopedia-8ea8ee79
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_k5ZX-4bFnVq4O93zYkhvg

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ot-intel-api-ics-malware-encyclopedia-8ea8ee79
```

Example prompt: Can you pull up the full intelligence profile for PIPEDREAM malware — I need its capabilities, which OT protocols it targets, who the attributed actor is, affected vendors, detection signatures, and the MITRE ATT&CK ICS techniques associated with it?

## When to prefer this

Use this endpoint when you need encyclopedic, structured intelligence on a specific named ICS/OT malware family — particularly one of the six covered entries (PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE, FROSTYLOOP, BLACKENERGY). Prefer this over generic CVE or IOC endpoints when the query is about malware behavior, protocol targeting, or actor attribution in industrial control system contexts.

## Known failure modes

- Unknown malware name returns 404 or empty result — only PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE, FROSTYLOOP, and BLACKENERGY are supported
- Missing required 'name' query parameter returns 400 Bad Request
- Payment not processed results in 402 Payment Required
- Service temporarily unavailable on Render cold start causes slow or failed response

## How this service works

ICS malware encyclopedia. Pass ?name=PIPEDREAM. Returns capabilities, targeted OT protocols, attributed actor, affected vendors, detection signatures, and MITRE ATT&CK ICS techniques. Covers PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE, FROSTYLOOP, BLACKENERGY.

## Output

A structured record for the queried ICS malware including: a description of its capabilities, the OT/ICS protocols it targets (e.g. Modbus, OPC-UA, IEC-104), the attributed threat actor or group, a list of affected vendors, detection signatures, and the associated MITRE ATT&CK for ICS technique IDs and names.

## Example request

```json
{
 "input": {
  "type": "http",
  "method": "GET",
  "queryParams": {
   "name": "PIPEDREAM"
  }
 }
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "name"
     ],
     "properties": {
      "name": {
       "type": "string",
       "description": "Malware name e.g. PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE, FROSTYLOOP, BLACKENERGY"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "name": "PIPEDREAM",
  "aliases": [
   "INCONTROLLER"
  ],
  "confidence": "high",
  "first_seen": "2022",
  "capabilities": [
   "discovery",
   "lateral_movement",
   "disruption",
   "destruction"
  ],
  "data_sources": [
   "Dragos-Threat-Intelligence",
   "OT-Intel-DB",
   "MITRE-ATT&CK-ICS",
   "DeepSeek-CTI-Analysis"
  ],
  "affected_vendors": [
   "Schneider Electric",
   "OMRON"
  ],
  "attributed_actor": "CHERNOVITE",
  "mitre_techniques": [
   "T0843",
   "T0821",
   "T0855"
  ],
  "targeted_protocols": [
   "Modbus",
   "OPC UA",
   "CODESYS",
   "IEC 61850"
  ],
  "detection_signatures": [
   "YARA rule: PIPEDREAM_loader",
   "Anomalous CODESYS write commands"
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ot-intel-api-ics-malware-encyclopedia-8ea8ee79/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from ot-intel-api.onrender.com](https://www.zero.xyz/host/ot-intel-api.onrender.com/llms.txt)