Click-and-Run Limited (Native Maltego Hub):
- Maltego Enterprise Users: 100 free Transform Runs / month.
- Maltego Pro Users: 10 free Transform Runs / month.
MaltegoVysion Transforms
Query darknet intelligence and ransomware history directly in Maltego.
Uncompromised Underground Visibility
Access years of indexed darknet chatter, clandestine messaging feeds, and extortion archives directly within your investigation canvas—with zero black-box scoring or hidden filters.
From Underground Noise to Structured Entity Graphs
Turn clandestine data into structured intelligence in seconds. Vysion ingests raw noise from +5,700 Telegram channels, darknets, and extortion sites, translating it into connected Maltego entities. Explore the integration below and discover how to map complex cybercriminal relationships with 100% source transparency and zero black-box scoring.
Integrated Threat Intelligence Scope
Vysion Transforms provide direct, transparent querying across darknet networks, clandestine messaging platforms, and ransomware archives without applying hidden scoring algorithms or network filters.
Darknet & Indexed Deep Web
Unfiltered indexing across Tor (.onion) and deep web networks. Query documents, URLs, domains, email addresses, phone numbers, threat actor handles/aliases, malware families, and targeted terms.
Telegram Ecosystem
Direct visibility into underground chatter—extracting messages, channels, groups, user profiles, associated domains, emails, and linked cryptocurrency wallets.
Discord Intelligence
Targeted monitoring of user profiles, message mentions, email exposures, and associated cryptocurrency wallet addresses.
Ransomware & Victimology
Comprehensive extortion tracking covering victim entities, affected domains, educational institutions, NAICS sector classifications, and active ransomware groups.
Multi-Asset Cryptocurrency Wallets
Extraction and correlation of detected wallet addresses across 8 major chains: BTC, ETH, XRP, DOT, XMR, ZEC, BNB, and DASH.
Capabilities in Maltego
Engineered specifically for threat hunters, CTI analysts, and incident responders to query, pivot, and expand complex underground relationships in real time—delivering granular context directly on the Maltego canvas.
Entity Enrichment
Turn Vysion findings into Maltego entities, including domains, emails, wallets, threat actors, ransomware victims and more.
Cross-Source Pivoting
Pivot from domains, emails, wallets, and identities across darknet documents, Telegram, Discord and ransomware victim records.
Historical Context
Add dated darknet, IM, and ransomware findings to your Maltego graph to support timeline and investigation context.
Execution Modes & API Access
Evaluate Vysion immediately using native monthly quotas in the Maltego Hub, or plug in your enterprise BYOK key for high-throughput, unlimited team queries.
Bring Your Own Key (BYOK):
Connect your enterprise Vysion API Key for high-throughput, unlimited queries across all available Transforms.
Core Use Cases
Accelerate threat hunting, incident response, and cybercrime investigations across four high-impact operational scenarios with source-verifiable intelligence.
Threat Actor & Alias Profiling
Consolidate fragmented threat actor identities into a unified visual graph. Connect darknet forum handles, Telegram and Discord user profiles, and multi-chain cryptocurrency wallets (BTC, XMR, ETH, XRP, ZEC) to expose the operational footprints of cybercriminal groups.
Clandestine Chat Investigation
Uncover hidden activity across closed messaging networks without manual crawling. Instantly pivot from an organizational domain, executive email, or alias to reveal specific message mentions and channel posts within monitored Telegram and Discord communities.
Ransomware Victimology & Sector Analysis
Analyze extortion campaigns with granular, evidence-based context. Map active ransomware group claims, affected corporate domains, and NAICS industry sector classifications to identify targeting trends and benchmark organizational exposure.
Supply Chain & Darknet Exposure Investigation
Identify third-party risk and vendor exposures across indexed darknet documents and monitored communication channels before they escalate into incidents.
Start Querying Underground Intelligence in Maltego
Install Vysion directly from the Maltego Transform Hub to run native transforms, or plug in your BYOK API key for full enterprise capacity.