API Reference

CVE Threat Actors

Threat actors reported to have exploited a given CVE, each with the quote that attributes it and the URL that quote came from.

This is the fastest way to answer "is anyone actually using this?" — the question that decides whether a patch jumps the queue. Get CVE embeds the same block, but this endpoint lets you ask the attribution question on its own, and page it, without pulling the full NVD, EPSS, KEV and Shadowserver record each time.

GET

/v1/cve/{cve_id}/actors

Cost: 1 credit per successful call

Path parameters

cve_idstringrequired

CVE identifier, e.g. CVE-2021-44228. Case-insensitive; validated against ^CVE-\d{4}-\d{4,7}$ at the edge.

Query parameters

limitintegeroptional

1–200. Defaults to 50.

Request

curl https://api.precursorintelligence.com/functions/v1/cve/CVE-2021-44228/actors \
  -H "Authorization: Bearer $PRECURSOR_API_KEY"

Response

200 OK

{
  "data": {
    "cve_id": "CVE-2021-44228",
    "count": 18,
    "limit": 50,
    "items": [
      {
        "id": "cc73f8dc-5c35-4ab2-a975-4bb25a2f375e",
        "name": "RansomHub",
        "slug": "ransomhub",
        "actor_type": "ransomware",
        "actor_subtype": "extortion-only",
        "motivation": "financial",
        "relation": "exploited",
        "evidence_quote": "CVE-2021-44228 ( CWE-502 ) Apache Log4j2 contains a deserialization of untrusted data vulnerability...",
        "source_url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-242a",
        "citations": 1
      },
      {
        "id": "163cfb61-5e00-4a66-8577-b6170e09d513",
        "name": "MirrorFace",
        "slug": "mirrorface",
        "actor_type": "apt",
        "suspected_origin_country": "China (PRC-aligned; assessed subgroup of APT10/menuPass)",
        "motivation": "espionage",
        "mitre_attack_id": "G1054",
        "relation": "exploited",
        "evidence_quote": "We observed that vulnerabilities of enterprise products were abused in the wild.",
        "source_url": "https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html",
        "citations": 1
      }
    ],
    "generated_at": "2026-08-04T10:20:34.843Z"
  },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "generated_at": "2026-08-04T10:20:34.843Z",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

Response fields

data.cve_idstringoptional

The normalised (upper-cased) CVE id.

data.countintegeroptional

Number of distinct actors returned.

data.items[].slugstringoptional

Pass to Get Actor for the full dossier.

data.items[].relationstringoptional

exploited, attributed, or uses.

data.items[].evidence_quotestring | nulloptional

The strongest citation attributing this CVE to this actor.

data.items[].source_urlstring | nulloptional

Where that quote was published.

data.items[].citationsintegeroptional

How many independent claims link this actor to this CVE. evidence_quote shows the strongest; a higher citations count means more corroboration.

data.items[].mitre_attack_idstring | nulloptional

MITRE ATT&CK group id when the actor is a named intrusion set.

Ordering

Actors are ordered by strength of attribution, then by name. One row per actor — multiple claims collapse into citations.

Absence is not evidence

An empty items array means no ingested source links a threat actor to this CVE. It does not mean no actor exploits it. Report it that way — "no attribution on record", not "not exploited".

Errors

Status	`error`	When
400	`invalid_cve_id`	The path segment is not a well-formed CVE id. Free — raised before billing.
400	`invalid_limit`	`limit` is non-numeric or outside 1–200.
401	`invalid_authorization`	Missing or malformed `Authorization` header.
401	`unauthorized`	Invalid/revoked key, or IP not allowlisted.
402	`insufficient_credits`	Organisation credit balance is below 1.
404	`not_found`	The path shape is wrong (e.g. `/cve/{id}/something-else`). Free.
405	`method_not_allowed`	Only `GET` and `OPTIONS` are accepted.
500	`internal`	Unexpected server error (credit auto-refunded).

A well-formed CVE id with no attribution returns 200 OK, count: 0, and an empty items array. The credit is charged.

See Errors for the full error reference.