#threat-intelligence — Public Fediverse posts

New.

This quote is just the tip of the iceberg:

"AI has crossed from development aid to live attack operator. It now does the hands-on work inside live intrusions, from China-nexus espionage campaigns to a criminal breach of multiple Mexican government agencies and has spread from nation states to ordinary cyber criminals."

Check Point: AI Security Report 2026 https://research.checkpoint.com/2026/ai-security-report-2026/

Also:

Rapid7:

CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (FIXED) https://www.rapid7.com/blog/post/ve-cve-2026-55040-microsoft-sharepoint-jwt-token-authentication-bypass-fixed/ @Rapid7Official

Vulncheck:

Monsta FTP: An SSRF Blocklist That Forgot IPv6 Exists https://www.vulncheck.com/blog/monsta-ftp-ssrf-ipv6-blocklist-bypass @vulncheck

Any.Run: ​​Kratos PhaaS Targets US and EU: How to Reduce Microsoft 365 Account Takeover Risk​ https://any.run/cybersecurity-blog/kratos-phaas-account-takeover/ @anyrun_app

Scam alert:

Group-IB:

The Scam Will Go On: Beware of Fake Offers for Celine Dion Concert Tickets https://www.group-ib.com/blog/fake-concert-ticket-scam-celine-dion/ #phishing #scam #infosec #threatresearch #cybercrime #Microsoft #vulnerability #threatintel #threatintelligence #Microsoft #malware

New.

This quote is just the tip of the iceberg:

"AI has crossed from development aid to live attack operator. It now does the hands-on work inside live intrusions, from China-nexus espionage campaigns to a criminal breach of multiple Mexican government agencies and has spread from nation states to ordinary cyber criminals."

Check Point: AI Security Report 2026 https://research.checkpoint.com/2026/ai-security-report-2026/

Also:

Rapid7:

CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (FIXED) https://www.rapid7.com/blog/post/ve-cve-2026-55040-microsoft-sharepoint-jwt-token-authentication-bypass-fixed/ @Rapid7Official

Vulncheck:

Monsta FTP: An SSRF Blocklist That Forgot IPv6 Exists https://www.vulncheck.com/blog/monsta-ftp-ssrf-ipv6-blocklist-bypass @vulncheck

Any.Run: ​​Kratos PhaaS Targets US and EU: How to Reduce Microsoft 365 Account Takeover Risk​ https://any.run/cybersecurity-blog/kratos-phaas-account-takeover/ @anyrun_app

Scam alert:

Group-IB:

The Scam Will Go On: Beware of Fake Offers for Celine Dion Concert Tickets https://www.group-ib.com/blog/fake-concert-ticket-scam-celine-dion/ #phishing #scam #infosec #threatresearch #cybercrime #Microsoft #vulnerability #threatintel #threatintelligence #Microsoft #malware

Scattered Spider is dominating headlines. But focusing only on one threat actor misses the bigger picture.

AI x Cyber Advisories = Shift that matters

Read the full analysis here: https://daminisoni.substack.com/p/beyond-scattered-spider-ai-trust

#CyberSecurity #AI #ThreatIntelligence #ScatteredSpider #InfoSec

Scattered Spider is dominating headlines. But focusing only on one threat actor misses the bigger picture.

AI x Cyber Advisories = Shift that matters

Read the full analysis here: https://daminisoni.substack.com/p/beyond-scattered-spider-ai-trust

#CyberSecurity #AI #ThreatIntelligence #ScatteredSpider #InfoSec

🚨 60-second scam investigation.
Before you click, reply, or send money, run a quick check with Listcrime AI Investigator. Analyze suspicious emails, websites, phone numbers, usernames, IPs, and more—in about a minute.

🔗 https://listcrime.com

#CyberSecurity #ScamPrevention #FraudPrevention #OSINT #ThreatIntelligence #CyberCrime #AI #DigitalSafety #Listcrime #ScamAwareness

🚨 60-second scam investigation.
Before you click, reply, or send money, run a quick check with Listcrime AI Investigator. Analyze suspicious emails, websites, phone numbers, usernames, IPs, and more—in about a minute.

🔗 https://listcrime.com

#CyberSecurity #ScamPrevention #FraudPrevention #OSINT #ThreatIntelligence #CyberCrime #AI #DigitalSafety #Listcrime #ScamAwareness

The Ransomware That Ran Itself
https://youtu.be/1ZJ2RheJENg CyberSecurity #Ransomware #AgenticAI #ArtificialIntelligence #ThreatIntelligence #InfoSec #JadePuffer

The Ransomware That Ran Itself
https://youtu.be/1ZJ2RheJENg CyberSecurity #Ransomware #AgenticAI #ArtificialIntelligence #ThreatIntelligence #InfoSec #JadePuffer

The first version of tempolocus, v1.0.0, is out.

tempolocus analyses time-series activity patterns to infer likely locations.

I’ve been experimenting with this idea for years, but AI-assisted development now makes it much easier to collect and maintain country-specific holidays and their many exceptions.

#threatintel #threatintelligence #opensource #osint

:github: https://github.com/ail-project/tempolocus

The first version of tempolocus, v1.0.0, is out.

tempolocus analyses time-series activity patterns to infer likely locations.

I’ve been experimenting with this idea for years, but AI-assisted development now makes it much easier to collect and maintain country-specific holidays and their many exceptions.

#threatintel #threatintelligence #opensource #osint

:github: https://github.com/ail-project/tempolocus

How can you use your AI agent to transform raw threat notes into a well-sourced CTI report draft? Use my MCP server with my new CTI report template and writing guidance. Your sensitive data stays local.

https://zeltser.com/cyber-threat-intel-report-template

#threatintelligence #incidentresponse

How can you use your AI agent to transform raw threat notes into a well-sourced CTI report draft? Use my MCP server with my new CTI report template and writing guidance. Your sensitive data stays local.

https://zeltser.com/cyber-threat-intel-report-template

#threatintelligence #incidentresponse

New.

Symantec: GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses https://www.security.com/threat-intelligence/goddamn-ransomware-beast-rebrand #infosec #threatintel #threatintelligence #ransomware

New.

Symantec: GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses https://www.security.com/threat-intelligence/goddamn-ransomware-beast-rebrand #infosec #threatintel #threatintelligence #ransomware

New.

Microsoft: GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/ #Microsoft #infosec #threatintel #threatintelligence #malware

New.

Microsoft: GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/ #Microsoft #infosec #threatintel #threatintelligence #malware

New.

Group-IB: RedHook Returns with a Dangerous Upgrade https://www.group-ib.com/blog/redhook-android-rat-upgraded/ #infosec #threatintel #threatintelligence #Android #malware

New.

Group-IB: RedHook Returns with a Dangerous Upgrade https://www.group-ib.com/blog/redhook-android-rat-upgraded/ #infosec #threatintel #threatintelligence #Android #malware

AI is widening the cybersecurity skills gap by enabling attacks that require less expertise to execute.
https://www.schneier.com/blog/archives/2026/07/cybersecurity-and-the-gap-between-skill-and-ability.html
#cybersecurity #AI #threatintelligence

AI is widening the cybersecurity skills gap by enabling attacks that require less expertise to execute.
https://www.schneier.com/blog/archives/2026/07/cybersecurity-and-the-gap-between-skill-and-ability.html
#cybersecurity #AI #threatintelligence

🚨New ransom group blog post!🚨

Group name: qilin
Post title: S.J. Louis
Info: https://cti.fyi/groups/qilin.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: qilin
Post title: S.J. Louis
Info: https://cti.fyi/groups/qilin.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

Threat actors are currently deploying highly-obfuscated npm and PyPI packages that impersonate PaySafe and Skrill SDKs to intercept environment variables. https://www.developer-tech.com/news/socket-pypi-and-npm-payment-sdk-malware-compromises-ci-cd/ #devsecops #threatintelligence #infosec #developers #cybersecurity #technology

Threat actors are currently deploying highly-obfuscated npm and PyPI packages that impersonate PaySafe and Skrill SDKs to intercept environment variables. https://www.developer-tech.com/news/socket-pypi-and-npm-payment-sdk-malware-compromises-ci-cd/ #devsecops #threatintelligence #infosec #developers #cybersecurity #technology

🚨New ransom group blog post!🚨

Group name: akira
Post title: Wade's Dairy
Info: https://cti.fyi/groups/akira.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: akira
Post title: Wade's Dairy
Info: https://cti.fyi/groups/akira.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: pear
Post title: Tostrud & Temp, S.C.
Info: https://cti.fyi/groups/pear.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: pear
Post title: Tostrud & Temp, S.C.
Info: https://cti.fyi/groups/pear.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: chaos
Post title: corepharma.com
Info: https://cti.fyi/groups/chaos.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: chaos
Post title: corepharma.com
Info: https://cti.fyi/groups/chaos.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: chaos
Post title: opportune.com
Info: https://cti.fyi/groups/chaos.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: chaos
Post title: opportune.com
Info: https://cti.fyi/groups/chaos.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: medusalocker
Post title: BAKAQAH
Info: https://cti.fyi/groups/medusalocker.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: medusalocker
Post title: BAKAQAH
Info: https://cti.fyi/groups/medusalocker.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: medusalocker
Post title: BAEAEAI
Info: https://cti.fyi/groups/medusalocker.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: medusalocker
Post title: BAEAEAI
Info: https://cti.fyi/groups/medusalocker.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: incransom
Post title: Aesthetic Surgical Images
Info: https://cti.fyi/groups/incransom.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: incransom
Post title: Aesthetic Surgical Images
Info: https://cti.fyi/groups/incransom.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog posts!🚨

Group name: AiLock
Post title: Richmont Graduate University
Info: https://cti.fyi/groups/AiLock.html

Group name: AiLock
Post title: Studio Sardano
Info: https://cti.fyi/groups/AiLock.html

Group name: qilin
Post title: COP® Vertriebs-GmbH Zentrale
Info: https://cti.fyi/groups/qilin.html

Group name: qilin
Post title: Lechner Massivhaus GmbH
Info: https://cti.fyi/groups/qilin.html

Group name: qilin
Post title: Next Clinics
Info: https://cti.fyi/groups/qilin.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog posts!🚨

Group name: AiLock
Post title: Richmont Graduate University
Info: https://cti.fyi/groups/AiLock.html

Group name: AiLock
Post title: Studio Sardano
Info: https://cti.fyi/groups/AiLock.html

Group name: qilin
Post title: COP® Vertriebs-GmbH Zentrale
Info: https://cti.fyi/groups/qilin.html

Group name: qilin
Post title: Lechner Massivhaus GmbH
Info: https://cti.fyi/groups/qilin.html

Group name: qilin
Post title: Next Clinics
Info: https://cti.fyi/groups/qilin.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

My new template for cyber threat intelligence reports covers tactical, operational, and strategic aspects of threat activity. A companion brief captures the key takeaways for decision-makers. You can also use it with your AI agent.

https://zeltser.com/cyber-threat-intel-report-template

#threatintelligence #incidentresponse

My new template for cyber threat intelligence reports covers tactical, operational, and strategic aspects of threat activity. A companion brief captures the key takeaways for decision-makers. You can also use it with your AI agent.

https://zeltser.com/cyber-threat-intel-report-template

#threatintelligence #incidentresponse

🚨New ransom group blog post!🚨

Group name: interlock
Post title: YMCA of Western North Carolina
Info: https://cti.fyi/groups/interlock.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: interlock
Post title: YMCA of Western North Carolina
Info: https://cti.fyi/groups/interlock.html

#ransomware #cti #threatintelligence #cybersecurity #infosec