Multi-source ransomware threat intelligence aggregator with MITRE ATT&CK, BTC payment, and operational enrichment.
Elementary CTI collects victim and cyberattack data from ransomware tracking sources, enriches it with MITRE ATT&CK TTPs, Ransomwhere BTC payment intelligence, and deepdarkCTI operational data, then surfaces it through a web UI for analyst investigation. Watchlists fuzzy-match new victims against your asset perimeter and dispatch alerts via log or webhook.
Legacy code name: the project was originally known as Pestilentia. The Python package is still
pestilentia/— only the product brand and the repository have been renamed.
Grouped by the release that introduced them — see CHANGELOG.md for the full history.
- Multi-source ingestion — ransomware.live as primary source, extensible to additional ransomware feeds
- MITRE ATT&CK enrichment — automatic alias matching, TTP import, software-to-technique mapping, country attribution
- Ransomwhere BTC enrichment — Bitcoin payment transactions linked to ransomware families
- deepdarkCTI operational enrichment — onion URLs, communication channels (Tox, Telegram, email) for tracked gangs
- Web UI — dashboard, victims, adversaries, cyberattacks, geographic map, BTC explorer, watchlist, pipeline status, multi-tab guide
- Watchlist fuzzy matching — compare new victims against an internal asset list and dispatch alerts
- Notifications — log channel and webhook channel (SSRF-guarded; Telegram bot channel planned)
- REST API — read-only
/api/v1/*endpoints for third-party tools - Relational storage — SQLAlchemy 2.0 ORM with SQLite (dev) and PostgreSQL (prod) support, Alembic migrations
- Scheduled collection — configurable polling per source with exponential backoff and structured JSON logging
- Source health monitoring — automated HTTP and format checks with status dots on the Pipeline page
- Production deployment — Docker + PostgreSQL stack with a hardening pass (XSS-safe feed URLs, constant-time auth, loopback-bound database)
- Noir dark mode and design system — elementary OS palette, theme toggle, font-size controls
- Multi-source adversary profiles — ransomware.live description plus the full MITRE ATT&CK profile, with version history and evidence preservation
- Fully self-hosted front end — every library and font vendored; no remote request at runtime
- Accessibility pass — ARIA tabs with keyboard navigation, visible focus, corrected contrast
- Schema hardening — timezone-aware datetimes, unique cyberattack constraint, CASCADE on alerts
- CTI article pipeline — 12 curated vendor and government feeds polled on the scheduler, canonical-URL and near-duplicate dedup, full-text extraction, read-only article view with source/TLP filters
- Priority Intelligence Requirements — the active watchlist doubles as the PIR set; articles matching it are flagged and filterable
- Campaign grouping — articles describing the same incident across outlets read as one story
- ATT&CK coverage matrix — techniques by tactic in kill-chain order, intensity by how many tracked adversaries use each
- STIX 2.1 export — per-adversary bundles (intrusion-set, attack-pattern, tool,
uses) pushable into MISP or OpenCTI - Triaged alerts — three severity levels plus an "actioned" flag to measure decision impact
- First time series — victims per month with range selector and per-adversary sparklines
- Conditional feed caching — etag / last-modified handling and a versioned User-Agent
- Campaign clustering on local embeddings — model2vec (256 dim, ~30 MB, no torch, no network at request time), with a recurring-series guard so a publisher's weekly column is not mistaken for a campaign
- LLM router, live — provider-agnostic routing behind a fail-closed TLP gate and hard budget ceilings; first real calls run on NVIDIA NIM's free tier, every call logged with cost and token counts
- TLP handling with an audited override — content above the configured cloud ceiling never reaches a third-party LLM; an analyst can release it deliberately, and every crossing records who, why, and where it went
- Weekly API contract sentinel — fingerprints the shape of every upstream contract against committed baselines and reports drift before it breaks ingestion
- Multi-user authentication — server-side accounts with argon2id hashing and three roles (
userread-only,analystadds the analysis surfaces,adminadds management); signed session cookies with rotation, expiry, CSRF protection and sign-in backoff - Public TLP:CLEAR storefront — anonymous visitors get a 30-day overview built only from public-source data, with a sidebar sign-in and a public FAQ; everything deeper requires an account
- Activity audit log — every authenticated action and every failed access attempt recorded with client address, retained for a configurable window
- Security response headers — CSP, frame denial, referrer policy, permissions policy on every response
- Runtime on Python 3.14 — Docker image and CI aligned
- Settings page — self-service password change and theme; admin tabs for user management (with last-admin guard), the activity log viewer, source enable/disable, and write-only service API keys with env-over-DB precedence
- Company enrichment — DB schema in place for GLEIF, Wikidata, OpenCorporates and country registries; client integrations not yet implemented
- Telegram notification channel
┌────────────────────┐ ┌──────────────────┐ ┌────────────────────┐
│ Data Sources │ │ Elementary CTI │ │ Enrichment │
│ │ │ │ │ │
│ ransomware.live ──┼────▶│ API Client │ │ MITRE ATT&CK │
│ │ │ Normalizer │────▶│ Ransomwhere (BTC) │
│ 12 curated RSS ───┼────▶│ Article ingest │ │ deepdarkCTI │
│ feeds (vendor, │ │ + dedup │ │ (operational) │
│ government) │ │ DB Store │ │ │
│ │ │ Scheduler │ │ │
│ │ │ Health Monitor │ │ │
│ │ │ Fuzzy Matcher │ │ │
└────────────────────┘ └──────────────────┘ └────────────────────┘
│
▼
┌──────────────────┐
│ SQLite / Postgres│
└──────────────────┘
│
┌─────────────────┼─────────────────┐
▼ ▼
┌──────────────────────┐ ┌──────────────────────┐
│ AI layer (ADR-006) │ │ Web UI + REST │
│ │ │ │
│ Local embeddings ──▶│ campaigns │ dashboard, victims, │
│ TLP gate │ │ adversaries, ATT&CK │
│ LLM router ────────┼──▶ cloud │ matrix, articles, │
│ Budget guard │ or local│ campaigns, STIX │
└──────────────────────┘ └──────────────────────┘
Embeddings, the TLP gate and the LLM router all run today — the router makes
real calls on NVIDIA NIM's free tier. See CHANGELOG.md for release history.
| Document | Description |
|---|---|
docs/FAQ.md |
Frequently asked questions (also rendered live at /faq) |
DEPLOY.md |
Single-host Docker + Postgres deployment runbook (incl. SQLite→Postgres migration and the weekly API sentinel) |
CONTRIBUTING.md |
Clone-to-green setup, the gates a change must pass, and conventions |
DEPENDENCIES.md |
Every dependency with version, contract and rationale |
UI-SPEC.md |
Design system, palette tokens, dark mode, the no-remote-assets rule |
CHANGELOG.md |
Release history (Keep a Changelog) |
| Database schema | src/pestilentia/models/tables.py + alembic/ (source of truth) |
| HTTP API reference | Generated by FastAPI at /docs (Swagger) and /redoc on any running instance |
| Component | Choice |
|---|---|
| Language | Python 3.11+ |
| Web framework | FastAPI + Jinja2 + Tailwind + HTMX (all front-end assets self-hosted, see UI-SPEC.md) |
| HTTP client | httpx |
| ORM | SQLAlchemy 2.0 |
| Database | SQLite (dev) / PostgreSQL (prod) |
| Scheduler | APScheduler |
| Fuzzy matching | thefuzz + python-Levenshtein |
| Linter/formatter | Ruff |
| Tests | pytest + pytest-httpx + pytest-anyio |
| Feed parsing | feedparser |
| Full-text extraction | trafilatura |
| Local embeddings | model2vec (static vectors, CPU-only — no torch) |
| Package manager | uv |
| Containerisation | Docker + docker-compose |
The architectural rationale (ADR series) is kept in the working repository.
| Source | Status | Type | Notes |
|---|---|---|---|
| ransomware.live | Active | REST API | Primary source — victims, groups, cyberattacks |
| MITRE ATT&CK | Active | STIX 2.1 bundle | Enrichment — TTPs, software, aliases, country |
| Ransomwhere | Active | JSON feed | Enrichment — Bitcoin payment tracking (29/136 families matched) |
| deepdarkCTI | Active | Markdown files | Enrichment — onion URLs, comms channels (244/442 gangs matched) |
| RansomLook | Planned (v1.1) | REST API | 566+ groups, posts, actors, crypto |
| Dropped | Project archived March 2026, data stale | ||
| Malpedia | Future (v2.0) | REST API | Enrichment — malware families, YARA rules |
12 curated sources, all live-probed before being added. Vendor research (Unit 42, Cisco Talos, Microsoft, SentinelLABS, Check Point, Trend Micro, Securelist, WeLiveSecurity), incident write-ups (The DFIR Report), news (BleepingComputer, The Record) and government advisories (CISA). Onion leak sites and Telegram channels are deliberately excluded as article sources — prompt-injection risk into any downstream LLM step.
DB schema is in place (Organization, OrganizationIdentifier, VictimOrganization, EnrichmentReview); no client integrations are wired up yet.
| Source | Coverage | Cost | Priority |
|---|---|---|---|
| GLEIF | 3.3M worldwide | Free (CC0) | P1 |
| Wikidata | Notable companies | Free | P1 |
| UK Companies House | 5M UK | Free | P2 |
| France SIRENE | 31M France | Free | P2 |
| OpenCorporates | 210M worldwide | 200 req/month free | P2 |
| SEC EDGAR | 800K+ US public | Free | P2 |
See CONTRIBUTING.md.
GNU Affero General Public License v3.0
- Exploratores — OSINT toolkit with 50+ company registry integrations
- RansomLook — Ransomware leak site monitor
- ransomwatch — Ransomware leak site scraper
- OpenCTI — Full CTI platform