Cyber Threat Intelligence

Threat Intelligence May 19, 2026

UAT-8302 and the Shared Toolbox Problem: When Six APT Groups Use the Same Malware, Who Did You Just Catch?

Cisco Talos' UAT-8302 disclosure reveals tool overlap with six China-nexus APT clusters. Here's what that means for attribution and detection in practice.

11 min read 35 0

Threat Intelligence May 18, 2026

AI Phishing Trends Security Teams Should Track

AI phishing trends are reshaping email, voice, and identity attacks. Learn what security teams should track, detect, and disrupt now.

8 min read 32 0

Threat Intelligence May 17, 2026

UNC6692 and the SNOW Ecosystem: Detecting the Full Kill Chain from Teams Impersonation to NTDS.dit Theft

UNC6692 chains email bombing with Teams helpdesk impersonation to deploy the SNOW malware suite and steal Active Directory databases. Detection guidance inside.

11 min read 31 0

Threat Intelligence May 17, 2026

OpenCTI vs MISP Platforms: Which Fits?

OpenCTI vs MISP platforms: compare data models, workflows, automation, sharing, and deployment trade-offs for mature threat intelligence teams.

8 min read 29 0

Threat Intelligence May 17, 2026

Detecting PamDOORa and PAM-Layer Backdoors on Linux: What Your EDR Isn't Telling You

PamDOORa hijacks Linux PAM authentication to harvest SSH credentials and erase forensic traces. Here's how to detect what most EDR tools miss.

10 min read 133 0

Threat Intelligence May 16, 2026

What Are Living Off the Land Attacks?

What are living off the land attacks? Learn how adversaries abuse native tools, evade detections, and what defenders should monitor to respond fast.

8 min read 36 0

SOC & SIEM May 15, 2026

YARA vs Sigma Rules: Which Fits Your SOC?

YARA vs Sigma rules for SOC teams: compare detection logic, telemetry fit, workflows, and where each rule type delivers the most value.

8 min read 28 0

Threat Intelligence May 14, 2026

Threat Actor Profiling Framework Explained

A threat actor profiling framework helps CTI teams map capability, intent, and behavior to improve detection, prioritization, and response.

7 min read 30 0

SOC & SIEM May 13, 2026

Threat Hunting Playbook Guide for SOC Teams

A threat hunting playbook guide for SOC teams covering hunt hypotheses, data sources, detection gaps, metrics, and playbook design trade-offs.

8 min read 27 0

Malware Analysis May 12, 2026

What Is Ransomware Double Extortion?

What is ransomware double extortion? Learn how attackers encrypt data, steal it first, and pressure victims with leak threats and disruption.

8 min read 27 0

All Posts - Page 3

UAT-8302 and the Shared Toolbox Problem: When Six APT Groups Use the Same Malware, Who Did You Just Catch?

AI Phishing Trends Security Teams Should Track

UNC6692 and the SNOW Ecosystem: Detecting the Full Kill Chain from Teams Impersonation to NTDS.dit Theft

OpenCTI vs MISP Platforms: Which Fits?

Detecting PamDOORa and PAM-Layer Backdoors on Linux: What Your EDR Isn't Telling You

What Are Living Off the Land Attacks?

YARA vs Sigma Rules: Which Fits Your SOC?

Threat Actor Profiling Framework Explained

Threat Hunting Playbook Guide for SOC Teams

What Is Ransomware Double Extortion?

Stay Updated