threatpool
The CTI team dead pool. Each season you draft a roster of threat actors, ransomware crews, victim countries, vendors and sectors. They score points from real activity: leak-site claims, exploited vulnerabilities, critical CVEs and major reports. When one of your picks is taken down, arrested or indicted, you bank the jackpot.
This season
ChristmasCTI LIVE
2026-10-26 → 2027-01-04
Day 4 of 69. The draft is closed; you can join for the next season.
- Players
- 12
- Teams
- 5
Top scorers this season
base points, before multipliers| # | Tier | Entity | Type | Events | Points |
|---|---|---|---|---|---|
| 1 | S | Qilin | Ransomware crew | 33 | 330 |
| 2 | S | Adobe | Vendor | 10 | 230 |
| 3 | S | United States | Victim country | 60 | 150 |
| 4 | A | Booba Project | Ransomware crew | 15 | 150 |
| 5 | A | SilentRansomGroup | Ransomware crew | 12 | 120 |
| 6 | S | IBM | Vendor | 6 | 120 |
| 7 | D | Whitearmor | Ransomware crew | 10 | 100 |
| 8 | A | genesis | Ransomware crew | 10 | 100 |
1
Draft
Fill one slot per entity type. Busy tier-S entities score more, but the multiplier drops when many players pick the same one.
2
Score
Points update on their own from ransomware.live, CISA KEV, NVD and admin-approved reports during the season.
3
Win
Top of the leaderboard wins the season. Teams are ranked by points per player, and seasons add up to a year title.
Player names and rosters are only visible after you log in. The full scoring tables are on the rules page.