Tag: threat intelligence

10 Attack Reports | 0 Vulnerabilities

Attack reports

EDR killers explained: Beyond the drivers

This analysis explores the ecosystem of EDR (Endpoint Detection and Response) killers, tools used by ransomware attackers to disrupt security solutions before deploying encryptors. The research, based on almost 90 EDR killers tracked in the wild, reveals that these tools are fundamental in modern r…

threat intelligence

defense evasion

cardspacekiller

tfsysmon-killer

vulnerable drivers

Published: March 19, 2026

Downloadable IOCs: 15

Iranian APT Infrastructure in Focus: Mapping State-Aligned Clusters During Geopolitical Escalation

The analysis examines Iranian state-aligned threat actors and their infrastructure patterns during heightened geopolitical tensions. It focuses on mapping network infrastructure, ASN patterns, TLS fingerprints, and hosting clusters associated with various Iranian APT groups. The report highlights t…

threat intelligence

infrastructure analysis

geopolitical tensions

proactive defense

tls fingerprinting

Published: March 4, 2026

Downloadable IOCs: 5

Using SSL Certificates and Graph Theory to Uncover Threat Actors

Researchers at Infoblox have developed an advanced technique leveraging graph theory and SSL certificates to uncover threat actor operational relationships. The approach analyzes Certificate Transparency logs, using the Subject Alternative Name field in certificates to identify domains under common…

threat intelligence

infrastructure discovery

ssl certificates

certificate transparency

domain clustering

Published: March 4, 2026

Downloadable IOCs: 0

Henry IV, Hotspur, Hal, and hallucinations

This article draws parallels between Shakespeare's Henry IV and modern cybersecurity challenges, particularly focusing on the adoption of AI. It emphasizes the importance of taking calculated risks, learning from failures, and surrounding oneself with knowledgeable peers. The piece also highlights …

threat intelligence

education sector

cybersecurity risks

dohdoor backdoor

healthcare sector

Published: February 27, 2026

Linked vulnerabilities : CVE-2026-20127 (CVSS 10.0)

Downloadable IOCs: 5

Remember, remember the fifth of November

The article discusses the historical significance of November 5th in the UK, known as Bonfire Night or Guy Fawkes Night. It recounts the failed Gunpowder Plot of 1605, where conspirators attempted to assassinate King James I by blowing up the House of Lords. The plot was foiled due to an anonymous …

threat intelligence

Published: November 7, 2025

Downloadable IOCs: 0

Tracking LummaC2 Infrastructure with Cats

The US Department of Justice and Microsoft disrupted LummaC2 infostealing-malware through domain seizures, taking down over 2,300 associated domains. The FBI and CISA released an advisory detailing LummaC2's tactics and indicators of compromise, including 114 domains. Analysis of these domains reve…

malware distribution

threat intelligence

domain seizures

infrastructure tracking

infostealing malware

cat-themed domains

Published: May 30, 2025

Downloadable IOCs: 0

Pulling the Threads on the Phish of Troy Hunt

A sophisticated phishing attack targeted Troy Hunt, compromising his Mailchimp account. The analysis reveals connections to the Scattered Spider group through domain pivoting. Using Validin's DNS, host response, and registration data, dozens of related domain names were uncovered. The investigation…

threat intelligence

infrastructure discovery

Published: March 29, 2025

Downloadable IOCs: 0

How to Improve Cyber Threat Investigations with TI Lookup

This article discusses the use of Threat Intelligence (TI) Lookup, a centralized service for threat data exploration and analysis. It highlights key features such as fast search results, extensive search parameters, and access to a large database of malware and phishing samples. The article explain…

malware analysis

threat intelligence

Published: November 13, 2024

Downloadable IOCs: 0

Enrichment Data: Keeping it Fresh

The article discusses the importance of keeping enrichment data up-to-date for analyzing honeypot attacks. Various sources like Internet Storm Center, URLhaus, SPUR, and VirusTotal are used to enrich data collected from honeypots. The author examines how frequently this data changes and its accurac…

threat intelligence

data enrichment

Published: September 9, 2024

Downloadable IOCs: 5

DNS Early Detection - Breaking the Black Basta Ransomware Kill Chain

This intelligence analysis examines the Black Basta ransomware campaign, which has significantly impacted businesses and critical infrastructure across North America, Europe, and Australia. The report highlights Infoblox's ability to identify and block over 78% of the malicious domains associated w…

threat intelligence

Published: August 2, 2024

Linked vulnerabilities : CVE-2024-1700

Downloadable IOCs: 1

Click here to see more Attack Reports