Cybersecurity Hub

Search ten layers of public cybersecurity intelligence — ransomware, vulnerabilities, indicators, phishing, malware, supply chain, network context, AI security, news and research. Look up an exact indicator or CVE, follow related records and download exports. The live search needs JavaScript.

How to read the hub

• Collection times show when the hub saw a record, not when an incident happened. A reported event date is shown separately when the source gives one.
• Counts are overlapping observations. The same incident can appear in several records and layers.
• Records that share an indicator or CVE are related by that identifier only. Sharing one does not show who is behind an activity.
• Network context is background information about infrastructure, not a verdict that it is malicious.
• Indicators are shown defanged (example[.]com, hxxp://) and never as links, so they cannot be opened by accident.
• If the hub cannot be reached, the page shows its last saved snapshot and says so. Searches and exports wait for a live connection.

Exports and full dataset downloads

An export holds the first page of up to 200 records for the current search, in JSON, NDJSON, CSV, STIX or MISP format. It is never the complete dataset. Completed copies of the whole dataset are listed with their SHA-256 checksums while the hub is connected.

For programs and AI agents

The same records are available as a read-only API with no account: the OpenAPI description, an llms.txt guide for AI tools, and an MCP server (streamable HTTP, POST requests only) at /api/cyberhub/mcp. Up to 60 requests per minute per connection.

The hub is separate from the ransomware leak-site claims tracked on the rest of this site. For those, see the live tracker and the latest security-threat news.

Explore the tracker

• Live ransomware tracker overview
• Ransomware group directory
• Victim-claim directory
• Ransomware activity by country and sector
• Weekly ransomware signals
• Monthly State of Ransomware reports
• Latest security-threat news stories
• Cybersecurity Hub: search ten layers of public threat intelligence
• Data quality and screening dashboard
• Free vendor check for ransomware claims
• Free email alerts for watched companies
• Methodology and evidence model
• Glossary of tracker terms

Victim records are provider-reported allegations, not independently verified breaches. Published for research, defense, and educational use.