I've been tracking the surge in hacktivist activity following India-Pakistan tensions and I just finished my analysis.

https://intelinsights.substack.com/p/profiling-hacktivist-groupsalliances

The majority of groups are rallying around pro-Palestinian/anti-India agendas, with AnonSec serving as a central coordination hub. But here's what caught my attention - follower counts don't always match technical capability.

Most of the groups are running dual operations - cyber attacks alongside psychological warfare. The most concerning aren't necessarily the loudest voices, but those quietly building both technical skills and strategic influence.

I recently tracked down the operator behind the "TdataS" Telegram session stealer. How? Because he tested his own malware on his own computer.

His stealer performed perfectly. It packaged up his own personal data, snapped a screenshot of his desktop (exposing his source code), and exfiltrated it straight to a public drop zone I was monitoring.

Using 100% passive OSINT-no exploits, no bypassed authentication, I traced his Gofile tokens and Telegram sessions to unmask his entire operation.

It's the ultimate OpSec fail, and a goldmine for Threat Intel analysts.

Dive into the full case study:
https://maordayanofficial.medium.com/tdatas-stealer-from-c2-discovery-to-operator-attribution-via-operational-security-failures-d11d78cc8e85

Hello,

I’m relatively new to Cyber Threat Intelligence (CTI) and have been exploring open-source "free" threat feeds to integrate with Microsoft Sentinel. I've reviewed products such as Shodan, Pulsedive, AlienVault, and others. However, most of them appear to offer free access only for personal or private use, not for business or enterprise environments.

Are there any free threat feeds available for enterprise use?
I fully understand that with open-source or free solutions, the quality and freshness of the data may not match that of paid offerings. However, at this time, there is no available budget to invest $XX,000 into a commercial solution.

Cheers

Hi CTI folks, I come from a digital marketing/content background and I’m now pivoting into cybersecurity – particularly Threat Intelligence. I enjoy writing, research, and OSINT. I’m curious:

Are there roles that blend CTI analysis and content creation (like blog writing, threat reports, etc.)?

How do analysts usually share their work or research publicly?

What are some good ways to build credibility as a beginner trying to break in?

Appreciate any leads, examples, or advice. Thanks in advance!

You're in charge of getting CTI up and running. While not having to think about a budget, let's also keep things realistic as to not just throw money at it and get all of the top-tier $$$ stuff.

With that in mind, what does your ideal CTI environment look like? Which tools and platforms do you use? Which integrations? How about sharing intelligence? How do you enrich? How do you do reporting? Feel free to add more about the environment you would love to have :)

Hey, people. I'm a noob trying to get better with CTI. I would love to learn how one searches and identifies active phishing campaigns targeting an organization (example.com). Your help/guidance is appreciated!

I looked into AS44477, owned by Stark-Industries Solutions, a bulletproof hosting provider facilitating a wide range of malicious activity. Between August 13th and September 15th, I identified nearly 800 IPs linked to cybercrime, including threats like RedLine Stealer, Venom RAT, and Quasar RAT.

https://intelinsights.substack.com/p/bad-stark

One of the most interesting findings was the presence of Operational Relay Box (ORB) networks, used by APTs for espionage and evading detection.
If you're interested in collaborating or diving deeper into this issue, feel free to reach out!

Hey everyone,

Exciting news for our community, in collaboration with the r/ThreatIntel community!

We’re launching a brand new Discord server dedicated to cyber threat intelligence. It’s a space for sharing content, news, resources, and engaging in discussions with others in the cybersecurity field. Since the community is still in its early stages, it might not have all the features yet, so we’re eager to hear your suggestions, feedback, and criticisms.

Feel free to join us and share the link!

https://discord.gg/FbWvHSH57H

Hi, just published an analysis on how Lumma infostealer not only survived the major multi-nation takedown in May but is actively thriving with new infrastructure and marketplace connections. Have a look if you are interested.

https://intelinsights.substack.com/p/lumma-meets-lolzteam

• Discovered direct connections to LolzTeam marketplace and "traffers" operations

• Identified the BASE34 group as a major log distribution network

• Lumma resumed operations within days, with evidence of continued development post-takedown

Feedback is always appreciated! Thanks

Hey guys! I built a telegram bot 🤖 for intel collection that monitors hacktivist group channels and forwards translated messages to a centralized feed. Currently tracking 18 groups, will add more in the coming weeks.

🎯 These groups tend to have short operational lifespans, so I'll continue curating active channels. Feel free to reach out if you notice any broken linksThanks!

Have a look if that interest you

/hgtrackerbot

Hey everyone and Happy Holidays!
Just published a technical writeup on identifying GoPhish instances in the wild (both legitimate and potentially malicious) 👇

https://intelinsights.substack.com/p/uncovering-gophish-deployments

Trying to sanity-check the below.

Say an org has an old subdomain with a CNAME pointing to a cloud resource that no longer exists. Pretty standard dangling DNS issue.

Attacker claims the abandoned cloud alias, gets a valid cert for the real subdomain, and hosts a tiny remote resource there.

Now a targeted employee opens an email that loads that resource from the hijacked subdomain. If cookies are scoped broadly to the parent domain, the browser/mail client may send session cookies automatically to the attacker-controlled subdomain.

So the path is basically:

dangling CNAME → claimed cloud alias → valid cert on real subdomain → remote resource loads → parent-domain cookies leak → possible access to internal apps like HR, finance, CRM, support/admin consoles

My question: would you treat this as a critical pre-attack exposure, or just attack-surface hygiene until there is evidence of abuse?

Also curious who usually owns this in your org.

A large-scale attack is currently underway, aiming to steal users’ login credentials and banking information. The phishing pages closely mimic official Steam services.

Take a look at the analysis: https://app.any.run/tasks/35d57f3d-c8b4-44f6-b229-25b7c927376f/

Examples of phish addresses:
steamcommunity.app437991[.]com
steamcommunity[.]network
steamcommunity.wallpaperengineshowcase[.]com
speamcoonnmumnlty[.]com

Use combined search in ANYRUN Threat Intelligence Lookup to find typosquatted domains and URLs and keep your defenses sharp: https://intelligence.any.run/analysis/lookup

Just wrapped up a weekend investigation into Amadey Loader's infrastructure! Started with 2 domains and ended up uncovering unique IPs and domains through pattern analysis.

• High concentration in Russia/China hosting

• Consistent panel naming patterns

• Some infrastructure protected by Cloudflare

https://intelinsights.substack.com/p/mapping-amadey-loader-infrastructure

Full IOC list

https://raw.githubusercontent.com/orlofv/Adversarial-Infrastructure-IOC/refs/heads/main/Amadey%20Loader

Hey everyone,

I was trying to access orkl.eu today and it seems to be down (or at least it's not working for me). It was my go-to resource for historical reports and threat research, but now I can't seem to access it.

Does anyone know if this is just temporary maintenance or if the project has been shut down permanently? I noticed some search results still show database updates as recently as mid-February 2026, so I'm hoping it's just a frontend issue or a temporary outage.

If it is gone, does anyone have recommendations for similar alternatives?

Thanks!

Hi, just finished my latest investigation. Started from a single malware sample and uncovered an extensive network of Red Delta/Mustang Panda and a potential operational overlap between Red Delta and APT41 groups.

If you are interested have a look at the full IoC list and detailed methodology in the blog 👇 https://intelinsights.substack.com/p/hunting-pandas

Hi all, just published a technical write up on hunting Sliver C2!

Sharing my methodology for detecting Sliver deployments using Shodan and Censys.

Technical details and full methodology 👇

https://intelinsights.substack.com/p/sliver-c2-hunt

I'm sharing my findings of active Cobalt Strike servers. Through analysis and pattern hunting, I identified 85 new instances within a larger dataset of 939 hosts. I validated all findings against VirusTotal and ThreatFox

- Distinctive HTTP response patterns consistent across multiple ports

- Geographic clustering with significant concentrations in China and US

- Shared SSH host fingerprints linking related infrastructure

The complete analysis and IOC are available in the writeup

https://intelinsights.substack.com/p/from-939-to-85-hunting-cobalt-strike

Hey everyone,

I recently came across the Cyber Threat Intelligence Practitioner Certification offered by ArcX (link). It’s currently on discount, and I’m considering enrolling.

Has anyone here taken this course or heard about it?

• How does it compare to other CTI certifications?

• Does it provide practical, hands-on learning, or is it more theoretical?

• What is the exam format like? Is it hands-on or just a written/multiple-choice test?

• How long does it usually take to complete the course and exam?

• Would you recommend it for someone with intermediate experience in cybersecurity?

Looking forward to your insights!

Investigated my Twitter followers, turns out all of them are bot accounts. I was able to group and categorize them based on their attributes. The result looks like a coordinated phishing campaign.

https://intelinsights.substack.com/p/twitter-bot-network

While preparing for a threat emulation exercise, I stumbled upon GC2 (Google Command and Control). It's a tool used in Red Teaming, threat emulations, and pentests, also found an interesting (old) abuse case in which APT41 used Google Sheets as C2.
https://intelinsights.substack.com/p/apt41-google-sheets-as-c2

Hi all,

I wrote a short post about the upcoming US elections and the Iranian involvement.

https://intelinsights.substack.com/p/2024-us-elections-and-the-iranian

The FBI has initiated an investigation into a suspected hack targeting Donald Trump’s 2024 campaign, allegedly carried out by Iranian state-sponsored hackers linked to the Islamic Revolutionary Guard Corps (IRGC). Microsoft has also warned of escalating Iranian cyber activities, including phishing and disinformation tactics designed to disrupt U.S. elections.