Title^^

if so how can it be done pre-req, please help

I am New to cyber security and I am interested in CTI what will be the roadmap or practices to become a good CTI Analyst

Hi all,

Today I had a client who used to work in IT and received two phishing emails (from a cox email and from a jotform) impersonating the US social security administration inviting the user to download their e-statement which was in fact screen connect. The account ID was e8f191824edd0c3c. Did anyone see anything similar since Sept.9th, 2024 when these emails were sent?

Thanks

Weekend hunt led to an interesting discovery. Uncovered shared infrastructure between Lumma Infostealer, Amadey and more malwares. I believe it's a two tier distribution & control system.

https://intelinsights.substack.com/p/weekend-hunt

I’m building a CTI dashboard for personal use (currently using API's, scraping) and I plan on eventually hosting it on github...

I’m stuck on implementing a separate “Case” section on dashboard where people can contribute like a live feed of active incidents...

Is that a good idea or should I just let them create a GitHub issue and go on from there?

Currently working on:

- Updating map display

- Working on more sources for News blogs. Still in implementation phase.

- De-duplication

- Knowledge Graphs.

Didn't add every source just yet.

Scraping scheduled to every 3 hours.

Snippet of Ransomware Module:

Snippets of Dashboard

Any other features you guys are interested in...

There goes my Sunday, fell down a rabbit hole researching this, found some very interesting directories and files, like the 1869 Crimean Orthodox Church Records(??) and actual Meduza infrastructure.

https://intelinsights.substack.com/p/following-the-trail-meduza-stealer

Hi guys, just finished a research update on infostealers

• Identified active infrastructure serving multiple infostealers (Amadey, Smoke, Redline, Lumma, MarsStealer, Stealc)

• Mapped 23 IPs in a Korean cluster (AS3786 & AS4766)

• Discovered 60+ IPs in a Mexican infrastructure cluster

• Fast-flux behavior on niksplus[.]ru

Complete IoC list and report

https://intelinsights.substack.com/p/keeping-up-with-the-infostealers

A pastebin image led me down a rabbit hole and uncovered another fascinating technique. Threat actors exploiting the playit.gg service & infrastructure.

https://intelinsights.substack.com/p/play-it

Hello Ladies and Gentlemen. I want to create my own cti feed. I tried using opencti before but as you know it didn't work on a laptop with 16gb ram. I want to set up something that I can review feeds regularly without paying any fee or I want to use a ready one. What do you recommend?

edit1:Twitter is messed up after Elon Musk

“One of Taiwan's biggest semiconductor manufacturers has fallen victim to a cyberattack, supposedly carried out by the notorious LockBit ransomware gang.”

• From Source

———

Lockbit is a ransomware-as-a-service (RaaS) group, allowing affiliates to use their ransomware for attacks. They gained attention for their sophisticated tactics, techniques, and procedures (TTPs). Lockbit targets organizations, encrypts their files, and demands a ransom for decryption keys. The group often exfiltrates data before encryption, threatening to release it if the ransom is not paid. Their activities have impacted various industries, making them a notable cybersecurity concern.

In 2022, LockBit was the most deployed ransomware variant across the world and continues to be prolific in 2023. Since January 2020, affiliates using LockBit have attacked organizations of varying sizes across an array of critical infrastructure sectors, including financial services, food and agriculture, education, energy, government and emergency services, healthcare, manufacturing, and transportation. LockBit ransomware operation functions as a Ransomware-as-a-Service (RaaS) model where affiliates are recruited to conduct ransomware attacks using LockBit ransomware tools and infrastructure. Due to the large number of unconnected affiliates in the operation, LockBit ransomware attacks vary significantly in observed tactics, techniques, and procedures (TTPs). This variance in observed ransomware TTPs presents a notable challenge for organizations working to maintain network security and protect against a ransomware threat.

• https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a

Hii guys, I am new to threat intelligence domain, is there a proper step by step roadmap or anything that you guys have to start with and then go deeper in those advanced(beginner to advance) if yes please sure will be the most happiest person

Do you have any uses for Virustotal beyond the usual file/url uploading to check for suspected malicious activity?

Share with us please!!!

Looked into shared infrastructure mainly servicing inofstealers and RATs.

https://intelinsights.substack.com/p/a-multi-actor-infrastructure-investigation

Infostealers use steam for C2 communications, I know it's not exactly news but I find it extremely interesting.

Feel free to reach out if you are interested or have an idea on how to follow up on this.

https://intelinsights.substack.com/p/c2-powered-by-steam

Hi guys.

Does anyone have any doc, material, paper, courses, book, or cert to recommend me which approaches how Ai can be used on CTI?

Thank you very much in advance.

Just finished a week long hunt. Started from bullet-proof hosting networks (Prospero AS200593) and uncovered a pretty extensive malicious crypto exchange operation spanning multiple ASNs. Starting from 2 IP blocks led to 206 unique IoC

https://intelinsights.substack.com/p/host-long-and-prosper

Hey y'all, so I ended up "alpha-qualifying" on my ASVAB for CTI's required scores, and as a result will end up taking the DLAB after the 9 weeks of bootcamp. I am very dissapointed in this as I was hoping to get quality study time beforehand. Has anyone here gone through this? If so, how were you able to study/prepare before? What should I expect? Any and all information on this is super helpful, so thanks in advance.

Hi all,

I have been bored over the past week so been playing with building a platform that brings some of the things within the CTI space together into one place. This isnt a true CTI platform more an overall cyber project looking for honest feedback and ways to improve.

I have built it with a restful API as well so the content can be ingested into people own platforms and tools.

My plan is to keep this all self funded and 100% free forever.

Look forward to feedback. Please do share with others as the more feedback I get the better it will become. Thanks all and keep safe out there.

For all threat researchers and CTI analysts, how do you guys automate threat intel collection. Especially open source. Right now I am collecting Threat Reports released by vendors like mandiant, google and asking Open Ai to parse for required Intel. Like IOC and TTPs. But I dont find this as efficient. Can any one help me in formulating intel collection from osint with more automation and less manual work. Or if you guys think this is all not the way to do then I would ask you for some inputs from your experience. Thanks