CTI you can verify, claim by claim.
You spend hours pulling facts out of reports — and you still can't tell which claims the source supports. PeriscopeCTI turns cyber threat reports into structured intelligence with the source passage attached to every claim: entities, relationships, and ATT&CK mappings, each marked claimed, inferred, or uncertain. Where the evidence is thin, it abstains. Run it on-prem, or on Intel128's managed endpoint.
- 01Extract entities, relations, ATT&CK mappings
- 02Link every claim to its source span
- 03Abstain — claimed, inferred, uncertain
- 04Run on-prem or managed
NO CREDIT CARD · WE REPLY BY EMAIL TO SCHEDULE
"…the group used a web shell for persistence…"
{
"subject": {"text": "web shell", "type": "tool"},
"relation": "uses",
"evidence": {"quote": "used a web shell"},
"epistemic_status": "explicit",
"confidence": 0.9
}
Named-actor attribution is reported as the source's claim, never as independent confirmation.
A wrong attribution costs more than a missed detection. That's why PeriscopeCTI abstains.
An independent security research lab.
You get intelligence from researchers who watch the surface, deep and dark web — studying how threat actors behave and publishing what defenders need to know. No vendor agenda, no reselling of stolen data: just the intelligence layer, in plain English. Because one unsupported claim can misdirect an entire response.
Threat watch & World watch
Daily reporting on ransomware listings and trending security news, written in controlled English for teams that work in a second language.
Periscope128
The lab's exposure-monitoring product: your domain, watched daily, cross-referenced with the threats the lab records.
Independent findings
Original analysis of the groups, feeds and patterns behind the claims — the intelligence layer, not just the headlines.
Research
Long-form analysis from the lab: how ransomware groups behave, who they hit, and what the patterns mean. Authored, not generated.
- How ransomware groups choose their victims
Three patterns in how ransomware groups select and pressure victims, drawn from the claim feed: seasonal sector targeting, re-shipping as leverage, and the...
Written analysis, published by the Intel128 lab.All research
Threat watch
Every new listing our feed records becomes a short, sourced report - who is named, which group listed them, what is known so far. Published as it lands.
- WHITEARMOR appears as a new ransomware listing
Intel128 Threat Watch has recorded a new ransomware listing for https://x.com/WhiteArmorxd. Attack group: WHITEARMOR. Listed October 25, 2026. What the...
- WHITEARMOR has listed WhiteArmor.cc in its ransomware victim feed
Intel128 Threat Watch has recorded a new ransomware listing for WhiteArmor.cc. Attack group: WHITEARMOR. Listed October 26, 2026. What the listing means and...
- CLOAK has listed dr-****le.de in its ransomware victim feed
Intel128 Threat Watch has recorded a new ransomware listing for dr-****le.de. Attack group: CLOAK. Listed October 25, 2026. What the listing means and what...
New listings are recorded and reported every day.All reports
World watch
What the security world is reporting right now. Every brief is written in controlled English for readers who work in a second language: what happened, why it matters, what to do. Each one credits the outlets that reported it.
- KV cache exposure in GLM-5.3 on Workers AI
A configuration mismatch exposed KV cache pages across requests on GLM-5.3 for Workers AI before Cloudflare applied a fix with SGLang.
- Worm hides large payloads in GitHub repos
A worm placed large payload blobs in GitHub repos to evade code search and limit detection across affected projects now.
- AI reshapes the CISO role
Nvidia security executive says CISOs must help weigh AI risks and assign responsibility for deployment decisions in business settings.
Written in controlled English for readers who work in a second language.All briefs