---
title: "Ransomware group profile"
method: GET
path: "/ransomware/group-profile"
tags: ["ransomware"]
---

# Ransomware group profile

`GET /ransomware/group-profile`

One threat actor, aggregated from the cached ransomware.live datasets:
`{name, description, firstSeen, lastSeen, victimCount, attacksThisYear,
countries[], sectors[], tools, onionSites, recentVictims[],
totalVictimsFetched, negotiations, yaraRules, pressEntries}`. Nullable
where a dataset has nothing on the group; 404 when neither TTPs nor
victims are known. `pressEntries` is newest first: entries attributed to
the group (or, for `lockbit`, to a numbered release), and unattributed
ones whose title names it as a ransomware; an entry dated more than a day
ahead is dropped. Costs one request of the monthly quota.

## Query parameters

- `group` string

## Response `200`

`{name, description, firstSeen, lastSeen, victimCount, attacksThisYear, countries, sectors, tools, onionSites, recentVictims, totalVictimsFetched, negotiations, yaraRules, pressEntries}`

- object

## Other responses

- `400` — Missing `group`
- `401` — Unauthorized - Missing or invalid API key
- `404` — Unknown group
- `429` — Too many requests - Rate limit exceeded

## Changes

- **2026-09-23** `edb544398108` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/ransomware/group-profile/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) · [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/fe46a64acc79?raw)