Threat Actors

`get_threat_actor`

Full dossier for one threat actor: description, origin, motivation, aliases, ATT&CK techniques, campaigns, related groups, ransomware tradecraft (leak site, RaaS model, initial access, sanctions), and the CVEs it exploits, industries it targets and malware it uses — each with the evidence quote and source URL behind the claim. Accepts a slug ("safepay"), an alias ("Cozy Bear") or a display name ("APT29"). Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Response shape: jsonb

Parameters

namestringrequired

Slug, alias, or display name — all three resolve, in that order. 1–120 characters. Examples: "safepay", "Cozy Bear", "APT29".

Example invocation

Ask your agent:

Give me the Precursor profile for SafePay — how they get in, what they run, and which CVEs they exploit. Cite your sources.

Raw JSON-RPC:

curl -s https://api.precursorintelligence.com/functions/v1/mcp \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "get_threat_actor",
      "arguments": { "name": "safepay" }
    }
  }'

Response

Trimmed — techniques, campaigns, industries and malware are arrays of the same shape as the single entries shown.

result.content[0].text (parsed)

{
  "name": "SafePay",
  "slug": "safepay",
  "actor_type": "ransomware",
  "suspected_origin_country": "Unknown (Russian-speaking nexus suspected; the encryptor aborts on Cyrillic keyboard layouts)",
  "motivation": "financial",
  "description": "SafePay is a financially motivated ransomware operation first observed in September 2024...",
  "first_seen": "2024-09-01",
  "last_seen": "2025-07-01",
  "targeted_countries": ["US", "DE", "GB", "CA"],
  "tools": ["ShareFinder.ps1", "PsExec", "WinRAR", "FileZilla"],
  "aliases": ["SafePay Ransomware", "safepay"],
  "counts": {
    "techniques": 168, "campaigns": 3, "cves": 2,
    "industries": 8, "malware": 4, "relationships": 3
  },
  "techniques": [
    {
      "technique_id": "T1001.003",
      "technique_name": "Protocol or Service Impersonation",
      "tactic": "Command And Control",
      "is_attack": true,
      "source_url": "https://www.ransomware.live/group/safepay",
      "evidence_quote": "Listed as a known TTP of safepay by ransomware.live"
    }
  ],
  "techniques_truncated": true,
  "relationships": [
    {
      "rel_type": "overlaps_with",
      "target_name": "LockBit",
      "target_slug": "lockbit",
      "source_url": "https://www.bitdefender.com/en-us/blog/businessinsights/safepay-ransomware-attacks-ttps",
      "evidence_quote": "Researchers have documented substantial overlap with the leaked LockBit 3.0 builder."
    }
  ],
  "ransomware": {
    "raas": false,
    "extortion_type": "double",
    "encryption": "AES wrapped in RSA",
    "initial_access": ["Valid accounts on exposed VPN/RDP", "Misconfigured FortiGate without MFA"],
    "sanctioned": false
  },
  "cves": [
    {
      "cve_id": "CVE-2023-27997",
      "relation": "exploited",
      "evidence_quote": "FortiOS SSL VPN Heap Buffer Overflow CVE-2023-27997 Pre-authentication module vulnerability allows remote code execution through heap overflow exploitation",
      "source_url": "https://www.halcyon.ai/threat-group/safepay"
    }
  ],
  "query": "safepay",
  "matched_on": "slug"
}

The full MCP envelope wrapping this payload is documented in Response Format.

Using this well

Cite, don't assert

Every claim carries evidence_quote and source_url. When an agent reports attribution, it should quote and link rather than stating it on its own authority — that is the difference between intelligence and a guess.

techniques is capped at 40

The median actor has 6 techniques; SafePay has 168. This tool returns at most 40 to protect your context window. counts.techniques is always the true total and techniques_truncated tells you the array was cut — never read a truncated list as complete. For the full set, call get_threat_actor_techniques.

Claims under review are included

Each claim is auto_published or in_review; both are returned, matching what the Precursor Intelligence web app shows. Rejected claims are never returned, and internal confidence scores are not exposed.

list_threat_actor_cves — the CVEs this actor exploits, with CVSS/EPSS/KEV, ordered for a patch queue.
get_threat_actor_techniques — the complete, uncapped technique set.
get_cve_threat_actors — the reverse lookup, from a CVE to its actors.

Errors

Code	Message	When
`-32602`	`invalid_params: name: required_string`	The `name` argument is missing.
`-32602`	`invalid_params: name: length`	Name exceeds 120 characters.
`-32001`	`unauthorized`	Key is invalid or revoked.
`-32002`	`insufficient_credits`	Organisation credit balance is below 1.

An unknown actor is a success, and it is billed

A well-formed name that matches nothing returns a successful response with a payload of { "error": "not_found", "name": "…" }. Because the call succeeded, the credit is not refunded — refunds only fire when the underlying query errors or times out. Check for an error key before reading the dossier.