#threat-intelligence — Public Fediverse posts

New.

Symantec: GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses https://www.security.com/threat-intelligence/goddamn-ransomware-beast-rebrand #infosec #threatintel #threatintelligence #ransomware

New.

Symantec: GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses https://www.security.com/threat-intelligence/goddamn-ransomware-beast-rebrand #infosec #threatintel #threatintelligence #ransomware

New.

Microsoft: GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/ #Microsoft #infosec #threatintel #threatintelligence #malware

New.

Microsoft: GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/ #Microsoft #infosec #threatintel #threatintelligence #malware

New.

Group-IB: RedHook Returns with a Dangerous Upgrade https://www.group-ib.com/blog/redhook-android-rat-upgraded/ #infosec #threatintel #threatintelligence #Android #malware

New.

Group-IB: RedHook Returns with a Dangerous Upgrade https://www.group-ib.com/blog/redhook-android-rat-upgraded/ #infosec #threatintel #threatintelligence #Android #malware

AI is widening the cybersecurity skills gap by enabling attacks that require less expertise to execute.
https://www.schneier.com/blog/archives/2026/07/cybersecurity-and-the-gap-between-skill-and-ability.html
#cybersecurity #AI #threatintelligence

AI is widening the cybersecurity skills gap by enabling attacks that require less expertise to execute.
https://www.schneier.com/blog/archives/2026/07/cybersecurity-and-the-gap-between-skill-and-ability.html
#cybersecurity #AI #threatintelligence

🚨New ransom group blog post!🚨

Group name: qilin
Post title: S.J. Louis
Info: https://cti.fyi/groups/qilin.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: qilin
Post title: S.J. Louis
Info: https://cti.fyi/groups/qilin.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

Threat actors are currently deploying highly-obfuscated npm and PyPI packages that impersonate PaySafe and Skrill SDKs to intercept environment variables. https://www.developer-tech.com/news/socket-pypi-and-npm-payment-sdk-malware-compromises-ci-cd/ #devsecops #threatintelligence #infosec #developers #cybersecurity #technology

Threat actors are currently deploying highly-obfuscated npm and PyPI packages that impersonate PaySafe and Skrill SDKs to intercept environment variables. https://www.developer-tech.com/news/socket-pypi-and-npm-payment-sdk-malware-compromises-ci-cd/ #devsecops #threatintelligence #infosec #developers #cybersecurity #technology

🚨New ransom group blog post!🚨

Group name: akira
Post title: Wade's Dairy
Info: https://cti.fyi/groups/akira.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: akira
Post title: Wade's Dairy
Info: https://cti.fyi/groups/akira.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: pear
Post title: Tostrud & Temp, S.C.
Info: https://cti.fyi/groups/pear.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: pear
Post title: Tostrud & Temp, S.C.
Info: https://cti.fyi/groups/pear.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: chaos
Post title: corepharma.com
Info: https://cti.fyi/groups/chaos.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: chaos
Post title: corepharma.com
Info: https://cti.fyi/groups/chaos.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: chaos
Post title: opportune.com
Info: https://cti.fyi/groups/chaos.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: chaos
Post title: opportune.com
Info: https://cti.fyi/groups/chaos.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: medusalocker
Post title: BAKAQAH
Info: https://cti.fyi/groups/medusalocker.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: medusalocker
Post title: BAKAQAH
Info: https://cti.fyi/groups/medusalocker.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: medusalocker
Post title: BAEAEAI
Info: https://cti.fyi/groups/medusalocker.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: medusalocker
Post title: BAEAEAI
Info: https://cti.fyi/groups/medusalocker.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: incransom
Post title: Aesthetic Surgical Images
Info: https://cti.fyi/groups/incransom.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: incransom
Post title: Aesthetic Surgical Images
Info: https://cti.fyi/groups/incransom.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog posts!🚨

Group name: AiLock
Post title: Richmont Graduate University
Info: https://cti.fyi/groups/AiLock.html

Group name: AiLock
Post title: Studio Sardano
Info: https://cti.fyi/groups/AiLock.html

Group name: qilin
Post title: COP® Vertriebs-GmbH Zentrale
Info: https://cti.fyi/groups/qilin.html

Group name: qilin
Post title: Lechner Massivhaus GmbH
Info: https://cti.fyi/groups/qilin.html

Group name: qilin
Post title: Next Clinics
Info: https://cti.fyi/groups/qilin.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog posts!🚨

Group name: AiLock
Post title: Richmont Graduate University
Info: https://cti.fyi/groups/AiLock.html

Group name: AiLock
Post title: Studio Sardano
Info: https://cti.fyi/groups/AiLock.html

Group name: qilin
Post title: COP® Vertriebs-GmbH Zentrale
Info: https://cti.fyi/groups/qilin.html

Group name: qilin
Post title: Lechner Massivhaus GmbH
Info: https://cti.fyi/groups/qilin.html

Group name: qilin
Post title: Next Clinics
Info: https://cti.fyi/groups/qilin.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

My new template for cyber threat intelligence reports covers tactical, operational, and strategic aspects of threat activity. A companion brief captures the key takeaways for decision-makers. You can also use it with your AI agent.

https://zeltser.com/cyber-threat-intel-report-template

#threatintelligence #incidentresponse

My new template for cyber threat intelligence reports covers tactical, operational, and strategic aspects of threat activity. A companion brief captures the key takeaways for decision-makers. You can also use it with your AI agent.

https://zeltser.com/cyber-threat-intel-report-template

#threatintelligence #incidentresponse

New.

Mandiant:The ‘Ghost’ in the Database: Recovering Active ADFS Signing Keys via Machine DPAPI https://cloud.google.com/blog/topics/threat-intelligence/recovering-active-adfs-signing-keys-machine-dpapi #infosec #Google #threatintel #threatintelligence

New.

Mandiant:The ‘Ghost’ in the Database: Recovering Active ADFS Signing Keys via Machine DPAPI https://cloud.google.com/blog/topics/threat-intelligence/recovering-active-adfs-signing-keys-machine-dpapi #infosec #Google #threatintel #threatintelligence

New.

Group-IB: Connecting Scattered Spider: Defining A Cybercrime Collective Through Shared TTPs https://www.group-ib.com/blog/connecting-scattered-spider/ #infosec #threatintel #threatintelligence #cybercrime

New.

Group-IB: Connecting Scattered Spider: Defining A Cybercrime Collective Through Shared TTPs https://www.group-ib.com/blog/connecting-scattered-spider/ #infosec #threatintel #threatintelligence #cybercrime

New.

Infoblox: Fake Installers, Fake Reviews, Fake Services - Real Proxies, Real Victims https://www.infoblox.com/blog/threat-intelligence/fake-installers-fake-reviews-fake-services-real-proxies-real-victims/ #infosec #threatintel #threatintelligence #botnets

@briankrebs "Residential proxies are one of the hottest topics in cybersecurity today."

New.

Infoblox: Fake Installers, Fake Reviews, Fake Services - Real Proxies, Real Victims https://www.infoblox.com/blog/threat-intelligence/fake-installers-fake-reviews-fake-services-real-proxies-real-victims/ #infosec #threatintel #threatintelligence #botnets

@briankrebs "Residential proxies are one of the hottest topics in cybersecurity today."

🚨New ransom group blog post!🚨

Group name: interlock
Post title: YMCA of Western North Carolina
Info: https://cti.fyi/groups/interlock.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: interlock
Post title: YMCA of Western North Carolina
Info: https://cti.fyi/groups/interlock.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: akira
Post title: RISE Architecture
Info: https://cti.fyi/groups/akira.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: akira
Post title: RISE Architecture
Info: https://cti.fyi/groups/akira.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

Working on tempolocus, a tool that analyses time-series activity patterns to infer a user’s likely location.

In @ail_project, we work with a large volume of social-network time series. Estimating users’ locations from these patterns is often a manual task.

I prototyped a Python module that combines potential locations with yearly activity signals, such as vacation periods and public holidays. It is still at an early stage, but it is already producing promising results with weekly time series.

Ideas, feedback, and improvements are welcome. tempolocus is planned for integration into AIL Framework 7.1.

#cybersecurity #threatintelligence #threatintel #opensource

:github: https://github.com/ail-project/tempolocus

Working on tempolocus, a tool that analyses time-series activity patterns to infer a user’s likely location.

In @ail_project, we work with a large volume of social-network time series. Estimating users’ locations from these patterns is often a manual task.

I prototyped a Python module that combines potential locations with yearly activity signals, such as vacation periods and public holidays. It is still at an early stage, but it is already producing promising results with weekly time series.

Ideas, feedback, and improvements are welcome. tempolocus is planned for integration into AIL Framework 7.1.

#cybersecurity #threatintelligence #threatintel #opensource

:github: https://github.com/ail-project/tempolocus

🚨New ransom group blog posts!🚨

Group name: akira
Post title: Chisholm Persson & Ball
Info: https://cti.fyi/groups/akira.html

Group name: qilin
Post title: Accelirate
Info: https://cti.fyi/groups/qilin.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog posts!🚨

Group name: akira
Post title: Chisholm Persson & Ball
Info: https://cti.fyi/groups/akira.html

Group name: qilin
Post title: Accelirate
Info: https://cti.fyi/groups/qilin.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog posts!🚨

Group name: akira
Post title: Excalibur Rentals
Info: https://cti.fyi/groups/akira.html

Group name: akira
Post title: Edge Solutionsayments
Info: https://cti.fyi/groups/akira.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog posts!🚨

Group name: akira
Post title: Excalibur Rentals
Info: https://cti.fyi/groups/akira.html

Group name: akira
Post title: Edge Solutionsayments
Info: https://cti.fyi/groups/akira.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: bravox
Post title: PB Fiduciaire SA 🇨🇭
Info: https://cti.fyi/groups/bravox.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: bravox
Post title: PB Fiduciaire SA 🇨🇭
Info: https://cti.fyi/groups/bravox.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog posts!🚨

Group name: dragonforce
Post title: amplesurveyor.com
Info: https://cti.fyi/groups/dragonforce.html

Group name: dragonforce
Post title: hive360.com
Info: https://cti.fyi/groups/dragonforce.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog posts!🚨

Group name: dragonforce
Post title: amplesurveyor.com
Info: https://cti.fyi/groups/dragonforce.html

Group name: dragonforce
Post title: hive360.com
Info: https://cti.fyi/groups/dragonforce.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: spacebears
Post title: Fitcrunch
Info: https://cti.fyi/groups/spacebears.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: spacebears
Post title: Fitcrunch
Info: https://cti.fyi/groups/spacebears.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog posts!🚨

Group name: incransom
Post title: samberger24.de
Info: https://cti.fyi/groups/incransom.html

Group name: incransom
Post title: tecnocurva.com.br
Info: https://cti.fyi/groups/incransom.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog posts!🚨

Group name: incransom
Post title: samberger24.de
Info: https://cti.fyi/groups/incransom.html

Group name: incransom
Post title: tecnocurva.com.br
Info: https://cti.fyi/groups/incransom.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog posts!🚨

Group name: safepay
Post title: shw-fr.de
Info: https://cti.fyi/groups/safepay.html

Group name: safepay
Post title: lh-wohnverbund-wohnen-nrw.de
Info: https://cti.fyi/groups/safepay.html

Group name: safepay
Post title: stedwardscatholicfirstschool.co.uk
Info: https://cti.fyi/groups/safepay.html

Group name: safepay
Post title: rtngmbh.de
Info: https://cti.fyi/groups/safepay.html

Group name: safepay
Post title: knobel-bau.de
Info: https://cti.fyi/groups/safepay.html

Group name: safepay
Post title: caritas-koblenz.de
Info: https://cti.fyi/groups/safepay.html

Group name: safepay
Post title: bmiprojects.de
Info: https://cti.fyi/groups/safepay.html

Group name: safepay
Post title: matrixwebagency.com
Info: https://cti.fyi/groups/safepay.html

Group name: safepay
Post title: hahn-airport.de
Info: https://cti.fyi/groups/safepay.html

#ransomware #cti #threatintelligence #cybersecurity #infosec