Report List

Report List

curl --request POST \
  --url https://api.threatbook.io/v3/reports/list \
  --header 'Content-Type: application/json' \
  --data '
{
  "query": "<string>",
  "threat_type_list": [
    "<string>"
  ],
  "severity_list": [
    "<string>"
  ],
  "category_list": [
    "<string>"
  ],
  "threat_actor_list": [
    "<string>"
  ],
  "target_region_list": [
    "<string>"
  ],
  "target_region_code": [
    "<string>"
  ],
  "target_industry_list": [
    "<string>"
  ],
  "target_org_list": [
    "<string>"
  ],
  "target_product_list": [
    "<string>"
  ],
  "industry_of_target_org": [
    "<string>"
  ],
  "hq_region_of_target_org": [
    "<string>"
  ],
  "has_iocs": true,
  "has_cves": true,
  "has_rules": true,
  "published_from": "<string>",
  "published_to": "<string>",
  "from_tb_lab": true,
  "limit": 123,
  "cursor": "<string>"
}
'

import requests

url = "https://api.threatbook.io/v3/reports/list"

payload = {
    "query": "<string>",
    "threat_type_list": ["<string>"],
    "severity_list": ["<string>"],
    "category_list": ["<string>"],
    "threat_actor_list": ["<string>"],
    "target_region_list": ["<string>"],
    "target_region_code": ["<string>"],
    "target_industry_list": ["<string>"],
    "target_org_list": ["<string>"],
    "target_product_list": ["<string>"],
    "industry_of_target_org": ["<string>"],
    "hq_region_of_target_org": ["<string>"],
    "has_iocs": True,
    "has_cves": True,
    "has_rules": True,
    "published_from": "<string>",
    "published_to": "<string>",
    "from_tb_lab": True,
    "limit": 123,
    "cursor": "<string>"
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    query: '<string>',
    threat_type_list: ['<string>'],
    severity_list: ['<string>'],
    category_list: ['<string>'],
    threat_actor_list: ['<string>'],
    target_region_list: ['<string>'],
    target_region_code: ['<string>'],
    target_industry_list: ['<string>'],
    target_org_list: ['<string>'],
    target_product_list: ['<string>'],
    industry_of_target_org: ['<string>'],
    hq_region_of_target_org: ['<string>'],
    has_iocs: true,
    has_cves: true,
    has_rules: true,
    published_from: '<string>',
    published_to: '<string>',
    from_tb_lab: true,
    limit: 123,
    cursor: '<string>'
  })
};

fetch('https://api.threatbook.io/v3/reports/list', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.threatbook.io/v3/reports/list",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'query' => '<string>',
    'threat_type_list' => [
        '<string>'
    ],
    'severity_list' => [
        '<string>'
    ],
    'category_list' => [
        '<string>'
    ],
    'threat_actor_list' => [
        '<string>'
    ],
    'target_region_list' => [
        '<string>'
    ],
    'target_region_code' => [
        '<string>'
    ],
    'target_industry_list' => [
        '<string>'
    ],
    'target_org_list' => [
        '<string>'
    ],
    'target_product_list' => [
        '<string>'
    ],
    'industry_of_target_org' => [
        '<string>'
    ],
    'hq_region_of_target_org' => [
        '<string>'
    ],
    'has_iocs' => true,
    'has_cves' => true,
    'has_rules' => true,
    'published_from' => '<string>',
    'published_to' => '<string>',
    'from_tb_lab' => true,
    'limit' => 123,
    'cursor' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.threatbook.io/v3/reports/list"

	payload := strings.NewReader("{\n  \"query\": \"<string>\",\n  \"threat_type_list\": [\n    \"<string>\"\n  ],\n  \"severity_list\": [\n    \"<string>\"\n  ],\n  \"category_list\": [\n    \"<string>\"\n  ],\n  \"threat_actor_list\": [\n    \"<string>\"\n  ],\n  \"target_region_list\": [\n    \"<string>\"\n  ],\n  \"target_region_code\": [\n    \"<string>\"\n  ],\n  \"target_industry_list\": [\n    \"<string>\"\n  ],\n  \"target_org_list\": [\n    \"<string>\"\n  ],\n  \"target_product_list\": [\n    \"<string>\"\n  ],\n  \"industry_of_target_org\": [\n    \"<string>\"\n  ],\n  \"hq_region_of_target_org\": [\n    \"<string>\"\n  ],\n  \"has_iocs\": true,\n  \"has_cves\": true,\n  \"has_rules\": true,\n  \"published_from\": \"<string>\",\n  \"published_to\": \"<string>\",\n  \"from_tb_lab\": true,\n  \"limit\": 123,\n  \"cursor\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.threatbook.io/v3/reports/list")
  .header("Content-Type", "application/json")
  .body("{\n  \"query\": \"<string>\",\n  \"threat_type_list\": [\n    \"<string>\"\n  ],\n  \"severity_list\": [\n    \"<string>\"\n  ],\n  \"category_list\": [\n    \"<string>\"\n  ],\n  \"threat_actor_list\": [\n    \"<string>\"\n  ],\n  \"target_region_list\": [\n    \"<string>\"\n  ],\n  \"target_region_code\": [\n    \"<string>\"\n  ],\n  \"target_industry_list\": [\n    \"<string>\"\n  ],\n  \"target_org_list\": [\n    \"<string>\"\n  ],\n  \"target_product_list\": [\n    \"<string>\"\n  ],\n  \"industry_of_target_org\": [\n    \"<string>\"\n  ],\n  \"hq_region_of_target_org\": [\n    \"<string>\"\n  ],\n  \"has_iocs\": true,\n  \"has_cves\": true,\n  \"has_rules\": true,\n  \"published_from\": \"<string>\",\n  \"published_to\": \"<string>\",\n  \"from_tb_lab\": true,\n  \"limit\": 123,\n  \"cursor\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.threatbook.io/v3/reports/list")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"query\": \"<string>\",\n  \"threat_type_list\": [\n    \"<string>\"\n  ],\n  \"severity_list\": [\n    \"<string>\"\n  ],\n  \"category_list\": [\n    \"<string>\"\n  ],\n  \"threat_actor_list\": [\n    \"<string>\"\n  ],\n  \"target_region_list\": [\n    \"<string>\"\n  ],\n  \"target_region_code\": [\n    \"<string>\"\n  ],\n  \"target_industry_list\": [\n    \"<string>\"\n  ],\n  \"target_org_list\": [\n    \"<string>\"\n  ],\n  \"target_product_list\": [\n    \"<string>\"\n  ],\n  \"industry_of_target_org\": [\n    \"<string>\"\n  ],\n  \"hq_region_of_target_org\": [\n    \"<string>\"\n  ],\n  \"has_iocs\": true,\n  \"has_cves\": true,\n  \"has_rules\": true,\n  \"published_from\": \"<string>\",\n  \"published_to\": \"<string>\",\n  \"from_tb_lab\": true,\n  \"limit\": 123,\n  \"cursor\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "data": {
    "cursor": "d19ba003fbc998df0d299f2ff41607ad2ce6ecc2a573f5e0a152bedaa8ff2f591ef5329521d6e2ddbd5646a56918d3b33f652e36ab05bde0fd78000e27c7caccd3ecd8903b1914e4c2858f93ffe27a773ed388a338b65e40dcf0b7745e0df41a3ede6a33a561f100d522ce9a00af42103a728e2d0fbdbabced7ea70a4702640e83d03a2d48481e215d635c2292984be2bb6ecb35e5c5a1a7c08b4d8599a74d8efa0ee76153b83c8c985b7df1d6143c18b14a851faf7059a6ce448ecefd801911ff6433d234d4b21368d1297271eeab6bbcbb4b01608756b024779f600b33cd88c3bc08250a29c0125ff9d97f2f103a061b78d9282a080849262ce8718ae7b59f25f26a09213f1cee20110c82651b96341db0f09c0969896b6d9beb3bc7538812",
    "total": 2753,
    "limit": 20,
    "items": [
      {
        "id": "303012",
        "title": "Qilin Ransomware Targets Italian Automotive Leader Pieffe Auto Group",
        "summary": "In 2025, the activities of the ransomware group Qilin significantly increased, launching a series of cyberattacks against enterprises and mid-sized organizations across multiple industries. Qilin employs a double extortion strategy, not only encrypting victims' data but also threatening to publicly disclose sensitive information to exert pressure, resulting in severe financial and reputational losses for businesses. The attack targets span various sectors, including automotive manufacturing, beverage production, medical devices, food industry, and legal services, demonstrating its broad attack range and increasingly sophisticated tactics. Victims include well-known companies such as Pieffe Auto Group in Italy, Asahi Group in Japan, Beta Dyne in the United States, and Volkswagen in France. Security experts recommend that affected organizations strengthen their cybersecurity defenses, including continuous monitoring, incident response plans, backup validation, and employee defense training, to mitigate the risk of future attacks. Qilin's attacks not only disrupt business operations but may also trigger a ripple effect on societal infrastructure, highlighting the urgency of cybersecurity protection.",
        "source": "Open Source",
        "published_time": "2025-11-25T00:00:00Z",
        "event_time": "2025-09-17",
        "severity": "Critical",
        "organizations": [
          "Volkswagen France",
          "Echo Lake Foods, Inc."
        ],
        "target_orgs": [
          {
            "org_name": "Volkswagen France",
            "website": "volkswagen.fr",
            "org_industry": [
              "Automotive",
              "Manufacturing"
            ],
            "hq_region": [
              "FR"
            ]
          },
          {
            "org_name": "Echo Lake Foods, Inc.",
            "website": "echolakefoods.com",
            "org_industry": [
              "Food & Beverage",
              "Manufacturing"
            ],
            "hq_region": [
              "US"
            ]
          }
        ],
        "regions": [
          "Netherlands",
          "United States",
          "Japan",
          "UAE",
          "Mexico",
          "Italy",
          "France"
        ],
        "industries": [
          "Healthcare",
          "Manufacturing",
          "Government"
        ],
        "products": [],
        "threat_type": [
          "Ransomware"
        ],
        "tags": [
          "Qilin"
        ],
        "cve_stats": 0,
        "reference_link": [
          "https://www.dexpose.io/free-darkweb-report/",
          "https://www.dexpose.io/email-data-breach-scan/",
          "https://cybernews.com/news/bmw-ransomware-attack-everest-claim-everest-luxury-target-jlr-trend/",
          "https://cybernews.com/security/production-process-of-jaguar-land-rover-disrupted-by-cyberattack/",
          "https://cybernews.com/security/jaguar-jlr-cyberattack-claimed-by-salesforce-hackers-scattered-spider-shiny-hunters/",
          "https://cybernews.com/security/massive-salesforce-breach-campaign-started-on-github/",
          "https://cybernews.com/news/marks-spencer-breach-tcs-third-party-vendor-social-engineering-attack/",
          "https://cybernews.com/news/jaguar-land-rover-production-down-for-at-least-another-week-due-to-cyberattack/",
          "https://cybernews.com/security/bridgestone-cyberattack-auto-manufacturer-disrupted-jaguar-link/",
          "https://cybernews.com/ransomlooker/",
          "https://cybernews.com/security/texas-electric-coops-ransomware-attack/",
          "https://cybernews.com/news/asahi-beer-cyberattack-claimed-qilin-ransomware-stolen-data/",
          "https://cybernews.com/news/cal-club-ransomware-attack-california-golf-club-san-franscico-qilin-claims/",
          "https://cybernews.com/news/israel-shamir-medical-center-ransowmare-attack-qilin-8t-patient-data-stolen/",
          "https://cybernews.com/news/nissan-ransomware-attack-creative-box-creative-box-radesign-studio-qilin-group/",
          "https://cybernews.com/news/inotiv-ransomware-attack-qilin-pharma-research-testing-animal-cruelty-fines/",
          "https://cybernews.com/security/singer-associates-ransomware-attack-qilin/",
          "https://cybernews.com/news/sk-group-ransomware-attack-qilin-gang-claims-stolen-data/",
          "https://cybernews.com/security/lee-enterprises-cyberattack-impact/",
          "https://cybernews.com/news/houston-symphony-qilin-ransomware-attack/",
          "https://cybernews.com/security/television-station-detroit-pbs-hacked/",
          "https://cybernews.com/news/yanfeng-ransomware-attack-claimed-qilin/",
          "https://cybernews.com/news/cancer-hospital-breach-is-claimed-by-qilin-gang-in-new-ransomware-low/",
          "https://botcrawl.com/category/data-breaches/"
        ]
      }
    ]
  },
  "response_code": 200,
  "msg": "Success"
}

This response has no body data.

{
  "msg": "Required:{resource/apikey}",
  "response_code": 400
}

{
  "msg": "Invalid account status",
  "response_code": 401
}

{
  "msg": "Invalid API method",
  "response_code": 405
}

{
  "msg": "Request rate limitation",
  "response_code": 429
}

{
  "msg": "System error",
  "response_code": 500
}

POST

reports

list

Report List

curl --request POST \
  --url https://api.threatbook.io/v3/reports/list \
  --header 'Content-Type: application/json' \
  --data '
{
  "query": "<string>",
  "threat_type_list": [
    "<string>"
  ],
  "severity_list": [
    "<string>"
  ],
  "category_list": [
    "<string>"
  ],
  "threat_actor_list": [
    "<string>"
  ],
  "target_region_list": [
    "<string>"
  ],
  "target_region_code": [
    "<string>"
  ],
  "target_industry_list": [
    "<string>"
  ],
  "target_org_list": [
    "<string>"
  ],
  "target_product_list": [
    "<string>"
  ],
  "industry_of_target_org": [
    "<string>"
  ],
  "hq_region_of_target_org": [
    "<string>"
  ],
  "has_iocs": true,
  "has_cves": true,
  "has_rules": true,
  "published_from": "<string>",
  "published_to": "<string>",
  "from_tb_lab": true,
  "limit": 123,
  "cursor": "<string>"
}
'

import requests

url = "https://api.threatbook.io/v3/reports/list"

payload = {
    "query": "<string>",
    "threat_type_list": ["<string>"],
    "severity_list": ["<string>"],
    "category_list": ["<string>"],
    "threat_actor_list": ["<string>"],
    "target_region_list": ["<string>"],
    "target_region_code": ["<string>"],
    "target_industry_list": ["<string>"],
    "target_org_list": ["<string>"],
    "target_product_list": ["<string>"],
    "industry_of_target_org": ["<string>"],
    "hq_region_of_target_org": ["<string>"],
    "has_iocs": True,
    "has_cves": True,
    "has_rules": True,
    "published_from": "<string>",
    "published_to": "<string>",
    "from_tb_lab": True,
    "limit": 123,
    "cursor": "<string>"
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    query: '<string>',
    threat_type_list: ['<string>'],
    severity_list: ['<string>'],
    category_list: ['<string>'],
    threat_actor_list: ['<string>'],
    target_region_list: ['<string>'],
    target_region_code: ['<string>'],
    target_industry_list: ['<string>'],
    target_org_list: ['<string>'],
    target_product_list: ['<string>'],
    industry_of_target_org: ['<string>'],
    hq_region_of_target_org: ['<string>'],
    has_iocs: true,
    has_cves: true,
    has_rules: true,
    published_from: '<string>',
    published_to: '<string>',
    from_tb_lab: true,
    limit: 123,
    cursor: '<string>'
  })
};

fetch('https://api.threatbook.io/v3/reports/list', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.threatbook.io/v3/reports/list",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'query' => '<string>',
    'threat_type_list' => [
        '<string>'
    ],
    'severity_list' => [
        '<string>'
    ],
    'category_list' => [
        '<string>'
    ],
    'threat_actor_list' => [
        '<string>'
    ],
    'target_region_list' => [
        '<string>'
    ],
    'target_region_code' => [
        '<string>'
    ],
    'target_industry_list' => [
        '<string>'
    ],
    'target_org_list' => [
        '<string>'
    ],
    'target_product_list' => [
        '<string>'
    ],
    'industry_of_target_org' => [
        '<string>'
    ],
    'hq_region_of_target_org' => [
        '<string>'
    ],
    'has_iocs' => true,
    'has_cves' => true,
    'has_rules' => true,
    'published_from' => '<string>',
    'published_to' => '<string>',
    'from_tb_lab' => true,
    'limit' => 123,
    'cursor' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.threatbook.io/v3/reports/list"

	payload := strings.NewReader("{\n  \"query\": \"<string>\",\n  \"threat_type_list\": [\n    \"<string>\"\n  ],\n  \"severity_list\": [\n    \"<string>\"\n  ],\n  \"category_list\": [\n    \"<string>\"\n  ],\n  \"threat_actor_list\": [\n    \"<string>\"\n  ],\n  \"target_region_list\": [\n    \"<string>\"\n  ],\n  \"target_region_code\": [\n    \"<string>\"\n  ],\n  \"target_industry_list\": [\n    \"<string>\"\n  ],\n  \"target_org_list\": [\n    \"<string>\"\n  ],\n  \"target_product_list\": [\n    \"<string>\"\n  ],\n  \"industry_of_target_org\": [\n    \"<string>\"\n  ],\n  \"hq_region_of_target_org\": [\n    \"<string>\"\n  ],\n  \"has_iocs\": true,\n  \"has_cves\": true,\n  \"has_rules\": true,\n  \"published_from\": \"<string>\",\n  \"published_to\": \"<string>\",\n  \"from_tb_lab\": true,\n  \"limit\": 123,\n  \"cursor\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.threatbook.io/v3/reports/list")
  .header("Content-Type", "application/json")
  .body("{\n  \"query\": \"<string>\",\n  \"threat_type_list\": [\n    \"<string>\"\n  ],\n  \"severity_list\": [\n    \"<string>\"\n  ],\n  \"category_list\": [\n    \"<string>\"\n  ],\n  \"threat_actor_list\": [\n    \"<string>\"\n  ],\n  \"target_region_list\": [\n    \"<string>\"\n  ],\n  \"target_region_code\": [\n    \"<string>\"\n  ],\n  \"target_industry_list\": [\n    \"<string>\"\n  ],\n  \"target_org_list\": [\n    \"<string>\"\n  ],\n  \"target_product_list\": [\n    \"<string>\"\n  ],\n  \"industry_of_target_org\": [\n    \"<string>\"\n  ],\n  \"hq_region_of_target_org\": [\n    \"<string>\"\n  ],\n  \"has_iocs\": true,\n  \"has_cves\": true,\n  \"has_rules\": true,\n  \"published_from\": \"<string>\",\n  \"published_to\": \"<string>\",\n  \"from_tb_lab\": true,\n  \"limit\": 123,\n  \"cursor\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.threatbook.io/v3/reports/list")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"query\": \"<string>\",\n  \"threat_type_list\": [\n    \"<string>\"\n  ],\n  \"severity_list\": [\n    \"<string>\"\n  ],\n  \"category_list\": [\n    \"<string>\"\n  ],\n  \"threat_actor_list\": [\n    \"<string>\"\n  ],\n  \"target_region_list\": [\n    \"<string>\"\n  ],\n  \"target_region_code\": [\n    \"<string>\"\n  ],\n  \"target_industry_list\": [\n    \"<string>\"\n  ],\n  \"target_org_list\": [\n    \"<string>\"\n  ],\n  \"target_product_list\": [\n    \"<string>\"\n  ],\n  \"industry_of_target_org\": [\n    \"<string>\"\n  ],\n  \"hq_region_of_target_org\": [\n    \"<string>\"\n  ],\n  \"has_iocs\": true,\n  \"has_cves\": true,\n  \"has_rules\": true,\n  \"published_from\": \"<string>\",\n  \"published_to\": \"<string>\",\n  \"from_tb_lab\": true,\n  \"limit\": 123,\n  \"cursor\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "data": {
    "cursor": "d19ba003fbc998df0d299f2ff41607ad2ce6ecc2a573f5e0a152bedaa8ff2f591ef5329521d6e2ddbd5646a56918d3b33f652e36ab05bde0fd78000e27c7caccd3ecd8903b1914e4c2858f93ffe27a773ed388a338b65e40dcf0b7745e0df41a3ede6a33a561f100d522ce9a00af42103a728e2d0fbdbabced7ea70a4702640e83d03a2d48481e215d635c2292984be2bb6ecb35e5c5a1a7c08b4d8599a74d8efa0ee76153b83c8c985b7df1d6143c18b14a851faf7059a6ce448ecefd801911ff6433d234d4b21368d1297271eeab6bbcbb4b01608756b024779f600b33cd88c3bc08250a29c0125ff9d97f2f103a061b78d9282a080849262ce8718ae7b59f25f26a09213f1cee20110c82651b96341db0f09c0969896b6d9beb3bc7538812",
    "total": 2753,
    "limit": 20,
    "items": [
      {
        "id": "303012",
        "title": "Qilin Ransomware Targets Italian Automotive Leader Pieffe Auto Group",
        "summary": "In 2025, the activities of the ransomware group Qilin significantly increased, launching a series of cyberattacks against enterprises and mid-sized organizations across multiple industries. Qilin employs a double extortion strategy, not only encrypting victims' data but also threatening to publicly disclose sensitive information to exert pressure, resulting in severe financial and reputational losses for businesses. The attack targets span various sectors, including automotive manufacturing, beverage production, medical devices, food industry, and legal services, demonstrating its broad attack range and increasingly sophisticated tactics. Victims include well-known companies such as Pieffe Auto Group in Italy, Asahi Group in Japan, Beta Dyne in the United States, and Volkswagen in France. Security experts recommend that affected organizations strengthen their cybersecurity defenses, including continuous monitoring, incident response plans, backup validation, and employee defense training, to mitigate the risk of future attacks. Qilin's attacks not only disrupt business operations but may also trigger a ripple effect on societal infrastructure, highlighting the urgency of cybersecurity protection.",
        "source": "Open Source",
        "published_time": "2025-11-25T00:00:00Z",
        "event_time": "2025-09-17",
        "severity": "Critical",
        "organizations": [
          "Volkswagen France",
          "Echo Lake Foods, Inc."
        ],
        "target_orgs": [
          {
            "org_name": "Volkswagen France",
            "website": "volkswagen.fr",
            "org_industry": [
              "Automotive",
              "Manufacturing"
            ],
            "hq_region": [
              "FR"
            ]
          },
          {
            "org_name": "Echo Lake Foods, Inc.",
            "website": "echolakefoods.com",
            "org_industry": [
              "Food & Beverage",
              "Manufacturing"
            ],
            "hq_region": [
              "US"
            ]
          }
        ],
        "regions": [
          "Netherlands",
          "United States",
          "Japan",
          "UAE",
          "Mexico",
          "Italy",
          "France"
        ],
        "industries": [
          "Healthcare",
          "Manufacturing",
          "Government"
        ],
        "products": [],
        "threat_type": [
          "Ransomware"
        ],
        "tags": [
          "Qilin"
        ],
        "cve_stats": 0,
        "reference_link": [
          "https://www.dexpose.io/free-darkweb-report/",
          "https://www.dexpose.io/email-data-breach-scan/",
          "https://cybernews.com/news/bmw-ransomware-attack-everest-claim-everest-luxury-target-jlr-trend/",
          "https://cybernews.com/security/production-process-of-jaguar-land-rover-disrupted-by-cyberattack/",
          "https://cybernews.com/security/jaguar-jlr-cyberattack-claimed-by-salesforce-hackers-scattered-spider-shiny-hunters/",
          "https://cybernews.com/security/massive-salesforce-breach-campaign-started-on-github/",
          "https://cybernews.com/news/marks-spencer-breach-tcs-third-party-vendor-social-engineering-attack/",
          "https://cybernews.com/news/jaguar-land-rover-production-down-for-at-least-another-week-due-to-cyberattack/",
          "https://cybernews.com/security/bridgestone-cyberattack-auto-manufacturer-disrupted-jaguar-link/",
          "https://cybernews.com/ransomlooker/",
          "https://cybernews.com/security/texas-electric-coops-ransomware-attack/",
          "https://cybernews.com/news/asahi-beer-cyberattack-claimed-qilin-ransomware-stolen-data/",
          "https://cybernews.com/news/cal-club-ransomware-attack-california-golf-club-san-franscico-qilin-claims/",
          "https://cybernews.com/news/israel-shamir-medical-center-ransowmare-attack-qilin-8t-patient-data-stolen/",
          "https://cybernews.com/news/nissan-ransomware-attack-creative-box-creative-box-radesign-studio-qilin-group/",
          "https://cybernews.com/news/inotiv-ransomware-attack-qilin-pharma-research-testing-animal-cruelty-fines/",
          "https://cybernews.com/security/singer-associates-ransomware-attack-qilin/",
          "https://cybernews.com/news/sk-group-ransomware-attack-qilin-gang-claims-stolen-data/",
          "https://cybernews.com/security/lee-enterprises-cyberattack-impact/",
          "https://cybernews.com/news/houston-symphony-qilin-ransomware-attack/",
          "https://cybernews.com/security/television-station-detroit-pbs-hacked/",
          "https://cybernews.com/news/yanfeng-ransomware-attack-claimed-qilin/",
          "https://cybernews.com/news/cancer-hospital-breach-is-claimed-by-qilin-gang-in-new-ransomware-low/",
          "https://botcrawl.com/category/data-breaches/"
        ]
      }
    ]
  },
  "response_code": 200,
  "msg": "Success"
}

This response has no body data.

{
  "msg": "Required:{resource/apikey}",
  "response_code": 400
}

{
  "msg": "Invalid account status",
  "response_code": 401
}

{
  "msg": "Invalid API method",
  "response_code": 405
}

{
  "msg": "Request rate limitation",
  "response_code": 429
}

{
  "msg": "System error",
  "response_code": 500
}

Query Parameters

apikey

string

required

Your API key. For details on how to obtain and manage your API key, please refer to the Authentication page.

Kindly note:

Please check if you have bound your access IP to the key and have the authority quotas to access this API before you interact with it.

Body

application/json

query

string

Keyword search parameter that matches across multiple indexed fields, including report title, summary, tags, IOCs, CVE identifiers and names, target products, target organizations, and other relevant attributes.

threat_type_list

string[]

Specifies one or more threat event types to filter reports. Multiple values should be passed as a JSON array of strings (String[]).For the list of supported threat event types, please refer to the Threat Report Glossaries.

Note: This parameter is only applicable to reports belonging to the Incident Analysis category.

severity_list

string[]

Specifies one or more severity levels to filter reports. Multiple values should be passed as a JSON array of strings (String[]). Supported levels include:

critical
high
low

If not provided, reports of all severity levels will be returned.

Specifies one or more report content categories to filter results. Multiple values should be passed as a JSON array of strings (String[]). Supported categories include:

Incident Analysis
Malware Analysis
Vulnerability Analysis
Summary Report
Security News
Incident Response

threat_actor_list

string[]

Specifies one or more threat actors to filter reports. Multiple values should be passed as a JSON array of strings (String[]).

Example values include names of known threat groups such as Lazarus, APT41, etc.

target_region_list

string[]

Specifies one or more target countries to filter reports. Multiple values should be passed as a JSON array of strings (String[]).

target_region_code

string[]

Specifies one or more target countries to filter reports using ISO 3166-1 alpha-2 country codes (e.g., US, CN, GB). Multiple values should be passed as a JSON array of strings (String[]). For a full list of codes, refer to the ISO Online Browsing Platform.

target_industry_list

string[]

Specifies one or more target industries to filter reports. Multiple values should be passed as a JSON array of strings (String[]). Industry names follow the STIX II industry taxonomy (e.g., financial-services, government, technology, etc.). For the list of supported industries, please refer to the Reports Glossaries.

target_org_list

string[]

Specifies one or more targeted organizations referenced in the reports. Multiple values should be passed as a JSON array of strings (String[]).

target_product_list

string[]

Specifies one or more targeted products referenced in the reports. Multiple values should be passed as a JSON array of strings (String[]). Examples include product names such as OpenSSH, Exchange Server.

industry_of_target_org

string[]

Specifies one or more targeted organizations' industries to filter reports. Multiple values should be passed as a JSON array of strings (String[]). Industry names follow the STIX II industry taxonomy (e.g., financial-services, government, technology, etc.). For the list of supported industries, please refer to the Reports Glossaries.

hq_region_of_target_org

string[]

Specifies one or more targeted organizations' headquarters regions using ISO 3166-1 alpha-2 country codes (e.g., US, CN, GB). Multiple values should be passed as a JSON array of strings (String[]). For a full list of codes, refer to the ISO Online Browsing Platform.

has_iocs

boolean

Indicates whether to return only reports that contain IOC information.

true, only reports with IOC data will be returned.
false or omitted, all reports will be included by default.

has_cves

boolean

Indicates whether to return only reports that contain CVE information.

true, only reports with CVE data will be returned.
false or omitted, all reports will be included by default.

has_rules

boolean

Indicates whether to return only reports that contain detection rules.

true, only reports with detection rule data will be returned.
false or omitted, all reports will be included by default.

published_from

string

Specifies the start of the report publication time range (inclusive). Supports ISO8601 datetime format, e.g., 2024-09-01T00:00:00Z.

published_to

string

Specifies the end of the report publication time range (inclusive). Supports ISO8601 datetime format, e.g., 2024-10-01T00:00:00Z.

from_tb_lab

boolean

Indicates whether to return only ThreatBook Lab exclusive reports.

true, only ThreatBook Lab–originated reports will be returned.
false or omitted, all reports (including open-source intelligence) will be included by default.

limit

integer

Specifies the number of records to return per page. The default value is 20, and the maximum allowed value is 100.

cursor

string

Specifies the pagination cursor used to retrieve the next page of results.
If omitted, the first page of results will be returned.

Response

data

object

required

Hide child attributes

data.cursor

string

required

Cursor value used to retrieve the next page of results.
If empty, it indicates that no additional data is available.

data.total

integer

required

Total number of records that match the query filters.

data.limit

integer

required

Number of records returned in the current page.

data.items

object[]

required

Hide child attributes

data.items.id

string

required

Unique identifier of the report. Used to query report details.

data.items.title

string

required

Title of the threat intelligence report.

data.items.summary

string

required

A summary describing the highlights of the report.

data.items.source

string

required

Indicates the origin of the report.
Values include ThreatBook Lab (exclusive content) or Open Source.

data.items.published_time

string

required

Publication time of the report in ISO8601 format.

data.items.event_time

string

required

Time of the associated incident or threat activity.
May be aggregated to day, month, or year depending on source data.

data.items.severity

string

required

Severity level of the report (e.g., low, high, critical).

data.items.organizations

string[]

required

List of affected organizations referenced in the report.

data.items.target_orgs

object[]

required

Detailed list of targeted organizations containing rich entity attributes.

Hide child attributes

data.items.target_orgs.org_name

string

required

The name of the targeted organization.

data.items.target_orgs.website

string

The official website domain of the targeted organization.

data.items.target_orgs.org_industry

string[]

List of industries the targeted organization belongs to based on STIX II taxonomy (e.g., financial-services, government, technology, etc.). For the list of supported industries, please refer to the Reports Glossaries.

data.items.target_orgs.hq_region

string[]

List of headquarters regions or countries of the targeted organization using ISO 3166-1 alpha-2 country codes (e.g., US, CN, GB). For a full list of codes, refer to the ISO Online Browsing Platform.

data.items.regions

string[]

required

List of affected regions or countries referenced in the report.

data.items.industries

string[]

required

List of affected industries based on STIX II industry taxonomy. For the list of supported industries, please refer to the Reports Glossaries.

data.items.products

string[]

required

List of affected products referenced in the report.

data.items.threat_type

string[]

required

One or more threat event types associated with the report.

data.items.tags

string[]

required

Set of extracted intelligence tags associated with the report. Currently supported tag categories include:

Threat Actors
Malware Families
Attack Tools

data.items.cve_stats

integer

required

Total number of CVE identifiers referenced in the report.

data.items.reference_link

string[]

required

One or more external source URLs related to the report.

data.items.ioc_stats

object

required

Statistics of IOCs contained in the report, including the count of IPs, domains, hashes and URLs.

Hide child attributes

data.items.ioc_stats.ip

integer

required

data.items.ioc_stats.domain

integer

required

data.items.ioc_stats.hash

integer

required

data.items.ioc_stats.url

integer

required

response_code

integer

required

msg

string

required

Allowed value: "Success"

Vulnerability Intelligence Report Detail

API Documentation

Enrichment

Vulnerabilities

Reports

Feeds

Integration

Query Parameters

Body

Response