#cyberthreatintel — Public Fediverse posts

The Rhysida ransomware group claims it breached the Cheyenne and Arapaho Tribes, demanding 10 BTC after disrupting education and administrative systems.

Governor Reggie Wassana confirmed refusal to negotiate.

Rhysida has a history of targeting public-sector networks, including state and municipal infrastructure.

Technical considerations:
• Initial access vector? Phishing vs exposed RDP?
• Backup segmentation and immutability
• Insurance-driven IR workflows
• Data exfiltration + double extortion tactics
• Public-sector attack surface mapping
Should smaller governments move toward managed detection and response (MDR) as a baseline requirement?

Source: https://therecord.media/cheyenne-arapaho-ransomware-rhysida

Share your technical insights below.

Follow @technadu for advanced ransomware intelligence.

#Ransomware #ThreatHunting #IncidentResponse #PublicSectorSecurity #CyberResilience #BlueTeam #Infosec #GovTech #DigitalForensics #CyberThreatIntel #DataProtection #SOC #ZeroTrust

According to Dragos, Volt Typhoon continues active operations inside U.S. utilities, shifting toward direct OT interaction and sensor data theft in 2025.

Notable elements:
• Pre-positioning in ICS environments
• Exploitation of Ivanti & Trimble Cityworks vulnerabilities
• GIS data harvesting for infrastructure mapping
• Access broker activity attributed to SYLVANITE
• Long-term persistence objectives
CEO Rob Lee stated some compromised sites may never be identified.

Technical question:
If adversaries maintain low-and-slow OT access, how should defenders adapt detection engineering?
– Network baselining?
– Sensor telemetry validation?
– Asset-level anomaly detection?
– Zero trust for OT?

Drop your technical analysis below.
Follow @technadu for advanced threat coverage.

#ICSsecurity #OTsecurity #ThreatHunting #DetectionEngineering #VoltTyphoon #InfrastructureDefense #CyberResilience #EnergyGrid #WaterUtilities #NationalSecurity #BlueTeam #CyberThreatIntel

⚠️ Smishing alert for Greek citizens. 💳 🚨

Scammers are pushing fake AADE (Independent Authority for Public Revenue) “unpaid taxes” SMS that lead to cloned payment pages designed to steal credit‑card info. If a text suddenly demands urgent payment, treat it like a pop‑up from nowhere—don’t click, don’t trust, don’t pay. Share to protect others.

mycargr[.]com
aadcar[.]com
aadgee[.]com
aadgre[.]com

#CyberThreatIntel #Infoblox #DNS #ThreatResearch #phishing #smishing #Cybercrime #AADE #Greece

⚠️ Smishing alert for Greek citizens. 💳 🚨

Scammers are pushing fake AADE (Independent Authority for Public Revenue) “unpaid taxes” SMS that lead to cloned payment pages designed to steal credit‑card info. If a text suddenly demands urgent payment, treat it like a pop‑up from nowhere—don’t click, don’t trust, don’t pay. Share to protect others.

mycargr[.]com
aadcar[.]com
aadgee[.]com
aadgre[.]com

#CyberThreatIntel #Infoblox #DNS #ThreatResearch #phishing #smishing #Cybercrime #AADE #Greece

Over the past 30 days, our community shared 27,165 new #IOCs on ThreatFox 🦊 — an 18% increase from the previous month.

👏 Huge shoutout to 'juroots', our top contributor with 2,746 IOCs submitted.
💀 The most-shared malware family (or in this case framework)? Clearfake, with 2,817 IOCs reported.

Find the full breakdown here: 👉 https://threatfox.abuse.ch/statistics/

#ThreatFox #CommunityPower #SharingIsCaring #CyberThreatIntel

Over the past 30 days, our community shared 27,165 new #IOCs on ThreatFox 🦊 — an 18% increase from the previous month.

👏 Huge shoutout to 'juroots', our top contributor with 2,746 IOCs submitted.
💀 The most-shared malware family (or in this case framework)? Clearfake, with 2,817 IOCs reported.

Find the full breakdown here: 👉 https://threatfox.abuse.ch/statistics/

#ThreatFox #CommunityPower #SharingIsCaring #CyberThreatIntel

When your "privacy browser" comes with a built-in surveillance suite, it's probably not about privacy.  Our latest research, in collaboration with UNODC, exposes Vault Viper. You might recognize them as "Baoying Group". They are running one of Asia's largest iGaming networks, BBIN, servicing scam centres and cyber-enabled fraud networks across the region.

At the center is the Universe Browser, promoted as a "privacy" and "anti-censorship" tool for illegal online gambling. In reality, it's a high-risk surveillance and exploitation platform designed to bypass detections, proxy access, and maintain persistent access across what we estimate to be millions of devices.

DNS analysis from Infoblox reveals tens of thousands of domains tied to Vault Viper's vast infrastructure, exposing a unique DNS fingerprint and operational control over their own corner of the internet.

But the story does not end here:  BBIN is linked to dozens of commercial ventures - they even had their own airline !  

👉 Read the full report here : https://blogs.infoblox.com/threat-intelligence/vault-viper-high-stakes-hidden-threats/

👉 We spoke to Wired to explain how cybercrime evolved : https://www.wired.com/story/universe-browser-malware-gambling-networks/

#CyberThreatIntel #Infoblox #DNS #VaultViper #riskware #Cybercrime #SoutheastAsia #threatintel #threatintelligence #cybersecurity #infosec #infobloxthreatintel #scam #tds #shazhupan #pigbutchering #malware

When your "privacy browser" comes with a built-in surveillance suite, it's probably not about privacy.  Our latest research, in collaboration with UNODC, exposes Vault Viper. You might recognize them as "Baoying Group". They are running one of Asia's largest iGaming networks, BBIN, servicing scam centres and cyber-enabled fraud networks across the region.

At the center is the Universe Browser, promoted as a "privacy" and "anti-censorship" tool for illegal online gambling. In reality, it's a high-risk surveillance and exploitation platform designed to bypass detections, proxy access, and maintain persistent access across what we estimate to be millions of devices.

DNS analysis from Infoblox reveals tens of thousands of domains tied to Vault Viper's vast infrastructure, exposing a unique DNS fingerprint and operational control over their own corner of the internet.

But the story does not end here:  BBIN is linked to dozens of commercial ventures - they even had their own airline !  

👉 Read the full report here : https://blogs.infoblox.com/threat-intelligence/vault-viper-high-stakes-hidden-threats/

👉 We spoke to Wired to explain how cybercrime evolved : https://www.wired.com/story/universe-browser-malware-gambling-networks/

#CyberThreatIntel #Infoblox #DNS #VaultViper #riskware #Cybercrime #SoutheastAsia #threatintel #threatintelligence #cybersecurity #infosec #infobloxthreatintel #scam #tds #shazhupan #pigbutchering #malware

@darfplatypus #CyberThreatIntel requirements gathering is a real emotional roller coaster. Sympathy with the customer, agreeing it would be great knowing the answers to those questions, knowing they cannot be answered with science / known algorithms / one universe worth of energy ... 🙇🏻‍♀️🤦🏻‍♀️

@darfplatypus #CyberThreatIntel requirements gathering is a real emotional roller coaster. Sympathy with the customer, agreeing it would be great knowing the answers to those questions, knowing they cannot be answered with science / known algorithms / one universe worth of energy ... 🙇🏻‍♀️🤦🏻‍♀️

🦊 ThreatFox Update | We're now expiring IOCs older than 6 months. IOCs don’t last forever and internet infrastructure often gets re-used, therefore we're implementing a 6-month expiry policy to reduce false positives.

As a result, expired IOCs will no longer appear in ThreatFox exports or be available via the ThreatFox APIs. Thanks for your continued support! 🙏

#ThreatFox #IOC #CyberThreatIntel

🦊 ThreatFox Update | We're now expiring IOCs older than 6 months. IOCs don’t last forever and internet infrastructure often gets re-used, therefore we're implementing a 6-month expiry policy to reduce false positives.

As a result, expired IOCs will no longer appear in ThreatFox exports or be available via the ThreatFox APIs. Thanks for your continued support! 🙏

#ThreatFox #IOC #CyberThreatIntel

🌟 Special Guest Speaker: Lea Cure 🌟
We are thrilled to have Lea Cure, the esteemed leader of the Cyber Threat Intelligence team at Citizens Bank, join us to share her expertise. With a master's degree in digital forensics, cybersecurity, and intelligence, Lea brings a wealth of knowledge and experience to the table. Her background includes valuable contributions as a former member of Recorded Future's research division, the Insikt Group. Lea is also a passionate advocate for promoting women in cybersecurity and intelligence fields.

#CyberThreatIntel #OSINT

🌟 Special Guest Speaker: Lea Cure 🌟
We are thrilled to have Lea Cure, the esteemed leader of the Cyber Threat Intelligence team at Citizens Bank, join us to share her expertise. With a master's degree in digital forensics, cybersecurity, and intelligence, Lea brings a wealth of knowledge and experience to the table. Her background includes valuable contributions as a former member of Recorded Future's research division, the Insikt Group. Lea is also a passionate advocate for promoting women in cybersecurity and intelligence fields.

#CyberThreatIntel #OSINT

Here is my blog about customizing your own scenarios for the #IntrusionAnalysis game #kc7 by @KC7cyber. Customize the company, actors and #malware. Thanks again to Simeon Kakpovi and the others that spent their time developing this.

#threatintel #cti #threathunting #threatintelligence #securityanalysis #cyberthreatintel #cybersecuritytraining #cybersecurity

https://cybersheepdog.wordpress.com/2023/02/08/kc7-intrusion-analysis-data-customization/

Intro to Cyber Threat Intel - I have just completed this room! Check it out: https://tryhackme.com/room/cyberthreatintel #tryhackme #security #cti #blue-team #intel #cyberthreatintel via @RealTryHackMe

This project has been created to serve the needs of the international Cyber Threat Intelligence community for a library of their collective past achievements in the realm of CTI reporting. Over time, the goal is to collect a complete corpus of all publicly released CTI reports to be used as a reference in scientific research and CTI reporting.

#CTI #CyberThreatIntel #Research #Scientific #Community #Reporting
https://orkl.eu/about

This project has been created to serve the needs of the international Cyber Threat Intelligence community for a library of their collective past achievements in the realm of CTI reporting. Over time, the goal is to collect a complete corpus of all publicly released CTI reports to be used as a reference in scientific research and CTI reporting.

#CTI #CyberThreatIntel #Research #Scientific #Community #Reporting
https://orkl.eu/about

I guess I should do an #introduction.

👋​ I'm Scott, I've been doing this security thing focused on threat intelligence, incident response, software development, and general security operations & (dare I say) leadership.

Along the way I worked at Mandiant, GitHub, Apple, and Splunk. Now I'm looking for my next challenge.

Along the way I wrote a book 📖​, taught SANS 578 👨‍🏫​, and spoke a bunch of places 🗣️​. I was also early on Birdsite and built an amazing community. I'm hopeful Mastodon can bring back some of that magic again.

Find more here: https://sroberts.io

#cyberthreatintel #python #secops #security #securitytools #hireme

I guess I should do an #introduction.

👋​ I'm Scott, I've been doing this security thing focused on threat intelligence, incident response, software development, and general security operations & (dare I say) leadership.

Along the way I worked at Mandiant, GitHub, Apple, and Splunk. Now I'm looking for my next challenge.

Along the way I wrote a book 📖​, taught SANS 578 👨‍🏫​, and spoke a bunch of places 🗣️​. I was also early on Birdsite and built an amazing community. I'm hopeful Mastodon can bring back some of that magic again.

Find more here: https://sroberts.io

#cyberthreatintel #python #secops #security #securitytools #hireme