Back to Blog 2026-10-07
Launch Platform LLM Enrichment V3 Threat Intel

Announcing CTI.FYI v3: AI-Powered Victim Enrichment, Threat Actor Dossiers, and Modern Intelligence Console

CTI.FYI Intelligence Team

The Next Evolution of Ransomware Threat Intelligence

Today marks the official release of CTI.FYI v3. What began as a lightweight, automated monitor for ransomware leak blogs has evolved into an analyst-grade cyber threat intelligence (CTI) engine — built specifically for SOC analysts, incident response teams, threat researchers, and security leaders who need immediate, actionable visibility into extortion syndicate campaigns.

As ransomware extortion ecosystems accelerate in complexity — with syndicates rapidly rebranding, sharing affiliate portals, and adopting sophisticated defensive evasion — raw victim names and onion links are no longer sufficient. Security teams need enriched context: What industry does the victim belong to? Where are they located? What are the syndicate's observed tactics, techniques, and procedures (TTPs)?

CTI.FYI v3 solves this with an entirely reimagined platform, built on five foundational pillars:

1. Automated AI Victim Metadata Enrichment

Raw leak site announcements are notoriously inconsistent — threat actors misspell victim names, provide truncated domain names, or drop raw corporate logos without clear entity identification. In v3, our pipeline integrates a specialized Ollama Cloud LLM enrichment engine directly into the scrape loop.

  • Canonical Entity Resolution: Normalizes actor-reported victim names to verified corporate and institutional identities.
  • Industry Sector Classification: Maps victims into standardized sectors (Healthcare, Manufacturing, Financial Services, Technology, Government, Critical Infrastructure, etc.) matching CISA and MITRE taxonomies.
  • Geographic Attribution: Identifies headquarters countries, flag attribution, and primary regional footprints.
  • Analyst Executive Summaries: Generates concise, objective operational summaries of the affected organization without actor rhetoric.

2. Tactical Threat Actor Dossiers & MITRE ATT&CK Integration

Clicking any threat syndicate in CTI.FYI v3 now slides open an interactive Threat Actor Dossier Drawer. Powered by automated feeds from MITRE ATT&CK STIX repositories and MISP threat sharing galaxies, each actor profile features:

  • Known Aliases & Rebrands: Track the lineage and splinter groups of major syndicates (e.g., LockBit, BlackCat/ALPHV, RansomHub, Play).
  • Observed TTPs: Direct MITRE ATT&CK technique tags covering initial access vectors, lateral movement methods, and exfiltration protocols.
  • Active Infrastructure Telemetry: Live health tracking across all known darknet and clearnet mirrors, including Tor circuit status and latency.
  • Historical Campaign Velocity: Attack tempo charts tracking 24-hour, 7-day, 30-day, and multi-year victim disclosure trends.

3. Autonomous Scraper Generation with Antigravity

Ransomware syndicates frequently rotate domain architectures, switch web frameworks, deploy custom CAPTCHAs, or spin up new frontends overnight. Maintaining custom scrapers manually is often a bottleneck in intelligence collection.

With v3, we've pioneered autonomous scraper synthesis using the Google DeepMind Antigravity CLI (agy) and Gemini 3.8 Flash. When refresh_groups.py detects a newly launched syndicate leak blog, our background workers can autonomously analyze site structure, generate a robust BeautifulSoup or Selenium parser module, test it against live Tor endpoints, and register it — dramatically reducing latency between gang emergence and tracking coverage.

4. Reimagined Analyst-Grade Interface

The web frontend has been completely rewritten from the ground up as a zero-dependency, high-density intelligence console:

  • Tactical Dark Zinc Palette: Designed for long shifts in SOC environments, featuring crisp typography with Inter and JetBrains Mono.
  • Universal Command Palette (⌘K / Ctrl+K): Instantly search across thousands of victims, threat groups, aliases, sectors, and MITRE techniques from anywhere on the platform.
  • Live Telemetry Polling: The interface polls background telemetry every 60 seconds, streaming new victim intercepts into your view without page reloads.
  • Keyboard Navigation: Quick single-key shortcuts (D for Dashboard, F for Feed, G for Threat Groups, B for Blog, A for API) for ultra-fast triaging.
  • High-Contrast & Mobile Accessibility: Full compliance with WCAG AA contrast standards, plus a responsive mobile layout designed for on-call duty.

5. Privacy-First, Zero-Maintenance Architecture

CTI.FYI remains committed to uncompromising analyst privacy:

  • No Tracking Cookies: No GA4, no invasive tracking scripts, and no advertising networks. First-party anonymous telemetry only.
  • Edge Delivery via Cloudflare R2 & Vercel: Static dataset feeds and high-resolution darknet screenshots are cached globally at the edge for sub-100ms response times worldwide.
  • Public REST API & Feeds: Rate-limited REST API endpoints (/api/v1/posts, /api/v1/groups), RSS feeds, and OPML exports remain completely free for research and defensive integration.

What This Means for You

Whether you are managing enterprise exposure, conducting threat hunting, or researching ransomware economics, CTI.FYI v3 provides clean, structured, noise-free telemetry right when incidents break. You can filter the live feed by your organization's industry sector, track which gangs are actively targeting your geographic region, or plug our JSON feeds directly into your SIEM, SOAR, or TIP.

Explore the live feed, search the threat actor directory, and let us know what you think!