Threat Actors

`get_threat_actor`

Full dossier for one threat actor: description, origin, motivation, aliases, ATT&CK techniques, campaigns, related groups, ransomware tradecraft (leak site, RaaS model, initial access, sanctions), and the CVEs it exploits, industries it targets and malware it uses, each with the evidence quote and source URL behind the claim. Accepts a slug ("safepay"), an alias ("Cozy Bear") or a display name ("APT29"). Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Response shape: jsonb

Parameters

namestringrequired

Slug, alias, or display name; all three resolve, in that order. 1–120 characters. Examples: "safepay", "Cozy Bear", "APT29".

Example invocation

Ask your agent:

Give me the EdgeProtect profile for SafePay: how they get in, what they run, and which CVEs they exploit. Cite your sources.

Raw JSON-RPC:

curl -s https://api.edgeprotect.io/functions/v1/mcp \
  -H "Authorization: Bearer $EDGEPROTECT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "get_threat_actor",
      "arguments": { "name": "safepay" }
    }
  }'

Response

Trimmed: techniques, campaigns, industries and malware are arrays of the same shape as the single entries shown.

{
  "name": "SafePay",
  "slug": "safepay",
  "actor_type": "ransomware",
  "suspected_origin_country": "Unknown (Russian-speaking nexus suspected; the encryptor aborts on Cyrillic keyboard layouts)",
  "motivation": "financial",
  "description": "SafePay is a financially motivated ransomware operation first observed in September 2024...",
  "first_seen": "2024-09-01",
  "last_seen": "2025-07-01",
  "targeted_countries": ["US", "DE", "GB", "CA"],
  "tools": ["ShareFinder.ps1", "PsExec", "WinRAR", "FileZilla"],
  "aliases": ["SafePay Ransomware", "safepay"],
  "counts": {
    "techniques": 168, "campaigns": 3, "cves": 2,
    "industries": 8, "malware": 4, "relationships": 3
  },
  "techniques": [
    {
      "technique_id": "T1001.003",
      "technique_name": "Protocol or Service Impersonation",
      "tactic": "Command And Control",
      "is_attack": true,
      "source_url": "https://www.ransomware.live/group/safepay",
      "evidence_quote": "Listed as a known TTP of safepay by ransomware.live"
    }
  ],
  "techniques_truncated": true,
  "relationships": [
    {
      "rel_type": "overlaps_with",
      "target_name": "LockBit",
      "target_slug": "lockbit",
      "source_url": "https://www.bitdefender.com/en-us/blog/businessinsights/safepay-ransomware-attacks-ttps",
      "evidence_quote": "Researchers have documented substantial overlap with the leaked LockBit 3.0 builder."
    }
  ],
  "ransomware": {
    "raas": false,
    "extortion_type": "double",
    "encryption": "AES wrapped in RSA",
    "initial_access": ["Valid accounts on exposed VPN/RDP", "Misconfigured FortiGate without MFA"],
    "sanctioned": false
  },
  "cves": [
    {
      "cve_id": "CVE-2023-27997",
      "relation": "exploited",
      "evidence_quote": "FortiOS SSL VPN Heap Buffer Overflow CVE-2023-27997 Pre-authentication module vulnerability allows remote code execution through heap overflow exploitation",
      "source_url": "https://www.halcyon.ai/threat-group/safepay"
    }
  ],
  "query": "safepay",
  "matched_on": "slug"
}

The full MCP envelope wrapping this payload is documented in Response Format.

Using this well

Cite, don't assert

Every claim carries evidence_quote and source_url. When an agent reports attribution, it should quote and link rather than stating it on its own authority. That is the difference between intelligence and a guess.

techniques is capped at 40

The median actor has 6 techniques; SafePay has 168. This tool returns at most 40 to protect your context window. counts.techniques is always the true total and techniques_truncated tells you the array was cut, so never read a truncated list as complete. For the full set, call get_threat_actor_techniques.

Claims under review are included

Each claim is auto_published or in_review; both are returned, matching what the EdgeProtect web app shows. Rejected claims are never returned, and internal confidence scores are not exposed.

Related tools

list_threat_actor_cves: the CVEs this actor exploits, with CVSS/EPSS/KEV, ordered for a patch queue.
get_threat_actor_techniques: the complete, uncapped technique set.
get_cve_threat_actors: the reverse lookup, from a CVE to its actors.

Errors

Code	Message	When
`-32602`	`invalid_params: name: required_string`	The `name` argument is missing.
`-32602`	`invalid_params: name: length`	Name exceeds 120 characters.
`-32001`	`unauthorized`	Key is invalid or revoked.
`-32002`	`insufficient_credits`	Organisation credit balance is below 1.

An unknown actor is a success, and it is billed

A well-formed name that matches nothing returns a successful response with a payload of { "error": "not_found", "name": "…" }. Because the call succeeded, the credit is not refunded; refunds only fire when the underlying query errors or times out. Check for an error key before reading the dossier.