CTI you can verify, claim by claim.
You spend hours pulling facts out of reports — and you still can't tell which claims the source supports. PeriscopeCTI turns cyber threat reports into structured intelligence with the source passage attached to every claim: entities, relationships, and ATT&CK mappings, each marked claimed, inferred, or uncertain. Where the evidence is thin, it abstains. Run it on-prem, or on Intel128's managed endpoint.
- 01Extract entities, relations, ATT&CK mappings
- 02Link every claim to its source span
- 03Abstain — claimed, inferred, uncertain
- 04Run on-prem or managed
NO CREDIT CARD · WE REPLY BY EMAIL TO SCHEDULE
"…the group used a web shell for persistence…"
{
"subject": {"text": "web shell", "type": "tool"},
"relation": "uses",
"evidence": {"quote": "used a web shell"},
"epistemic_status": "explicit",
"confidence": 0.9
}
Named-actor attribution is reported as the source's claim, never as independent confirmation.
A wrong attribution costs more than a missed detection. That's why PeriscopeCTI abstains.
An independent security research lab.
You get intelligence from researchers who watch the surface, deep and dark web — studying how threat actors behave and publishing what defenders need to know. No vendor agenda, no reselling of stolen data: just the intelligence layer, in plain English. Because one unsupported claim can misdirect an entire response.
Threat watch & World watch
Daily reporting on ransomware listings and trending security news, written in controlled English for teams that work in a second language.
Periscope128
The lab's exposure-monitoring product: your domain, watched daily, cross-referenced with the threats the lab records.
Independent findings
Original analysis of the groups, feeds and patterns behind the claims — the intelligence layer, not just the headlines.
Research
Long-form analysis from the lab: how ransomware groups behave, who they hit, and what the patterns mean. Authored, not generated.
- How ransomware groups choose their victims
Three patterns in how ransomware groups select and pressure victims, drawn from the claim feed: seasonal sector targeting, re-shipping as leverage, and the...
Written analysis, published by the Intel128 lab.All research
Threat watch
Every new listing our feed records becomes a short, sourced report - who is named, which group listed them, what is known so far. Published as it lands.
- SCARLETTGROUP has listed fittleworth.com in its ransomware victim feed
Intel128 Threat Watch has recorded a new ransomware listing for fittleworth.com. Attack group: SCARLETTGROUP. Listed November 14, 2026. What the listing...
- PIXELLEAKS appears as a new ransomware listing
Intel128 Threat Watch has recorded a new ransomware listing for PT. Fiber Networks Indonesia (AltosDLP surveillance platform, fiber.net.id). Attack group...
- LOCKBIT5 has listed pah.com.my in its ransomware victim feed
Intel128 Threat Watch has recorded a new ransomware listing for pah.com.my. Attack group: LOCKBIT5. Listed November 15, 2026. What the listing means and what...
New listings are recorded and reported every day.All reports
World watch
What the security world is reporting right now. Every brief is written in controlled English for readers who work in a second language: what happened, why it matters, what to do. Each one credits the outlets that reported it.
- Incransom has just published a new victim : Sarimelati Kencana Tbk PT
The report comes from Ransomware.live. 1 outlet reported this event inside 18 hours. Here is what happened, why it matters, and what to do next.
- Qilin has just published a new victim : Oregon Linen
The report comes from Ransomware.live. 1 outlet reported this event inside 18 hours. Here is what happened, why it matters, and what to do next.
- (Kimsuky) R&D 2025
The report comes from Malware News. 1 outlet reported this event inside 18 hours. Here is what happened, why it matters, and what to do next.
Written in controlled English for readers who work in a second language.All briefs