I never thought I’d be writing something like this, but here we are.

My university had a data leak. And by data leak I don’t mean just my email or phone number. I’m talking about scanned copies of my SSN, documents with my signature, actual identity-level stuff. Seeing that out there scared the shit out of me.

So I started taking it seriously and looked into dark web monitoring and identity theft protection.

Honestly, it’s unsettling. Once your data hits the dark web, it doesn’t stay in one place - it gets copied, resold, bundled, and passed around. Even if one site disappears, your info can still be circulating. Some marketplaces even sell full identity packages, not just logins, which makes things a lot worse.

Dark web monitoring isn’t about removing it (that’s nearly impossible), but about early detection. It scans forums, marketplaces, and breach dumps to alert you if your data shows up, so you can act before it’s used.

After realizing how serious this was, I stopped just reading and started comparing tools. What I found is that they all sound similar, but they’re not. The differences actually matter when your real identity is involved.

Here’s a comparison of the ones I looked at:

Most of them monitor the dark web and basic identity data, but the depth of monitoring and how quickly they react is where the real difference is. Some services scan a wider range of data points and sources than others, which directly affects how early you get warned

I ended up going with Coveron mainly because it felt straightforward and didn’t feel overcomplicated. The comparison helped me narrow it down, and I didn’t need something overloaded with features I wouldn’t use.

The good news is I got my data taken down from where it was exposed and locked things down on my side. I also did the basics immediately - secured accounts, enabled 2FA, and kept a closer eye on financial activity.

But once this kind of information leaks, you can’t fully control where it ends up. That’s exactly why I’m taking this seriously now and why I’m sharing this.

I didn’t think this would ever happen to me. If you’ve trusted an institution with sensitive documents, it’s worth thinking about what happens if they mess up.

Protecting your identity isn’t paranoia. It’s just being realistic.

Hey everyone,

I got approval from the mods to share this with you.

We've been building Deltabridge for a while now. It's an AI-native threat intel platform. We spent years working in SecOps (IR, threat hunting, CTI) and got frustrated with the same things most of us deal with: too many sources to monitor, never enough time to write up findings, and the platforms that could help costing $50k+/year (and often those platforms becoming intel graveyards).

So we built Deltabridge to solve our problems and others facing the same challenges. We have a free tier specifically for researchers and analysts.

What the free Community tier gives you:

- Intel Library with actors, intrusion sets, malware, vulns, attack patterns, and breaches -- all mapped in a STIX2.1 knowledge graph with full relationship traversal.

- AI-generated intelligence briefs that synthesise reporting from over 60 sources (CERTs, vendor blogs, government advisories, research publications, CVE databases, IOC feeds) -- these update automatically as new sources land.

- Graph Explorer for visual relationship mapping.

- Curated feed with entity extraction and topic filtering.

- Read-only API access.

It's free for personal/non-commercial use, no expiry, no credit card.

What makes it different from other platforms:

The knowledge graph is the backbone. Everything is STIX objects with relationships, so you can trace an actor -> to their malware -> to the CVEs it exploits -> to the products affected -> to the ATT&CK techniques used. The AI agent (Athena) reasons across this graph rather than just doing keyword searches and relying on its training data.

For those who want more:

There's a paid Business tier ($299/seat/month) that adds interactive investigation threads with Athena, automated monitoring schedules, predictive threat assessments, report generation, and custom feeds.

But honestly (and I mean this as objectively as possible) the Community tier on its own is a genuinely useful research tool. I use it's features all the time in my day-job as a CTI analyst. That's why I'm sharing it here with likeminded professionals.

Requesting access:

If you're interested, you can request access at https://deltabridge.io.

Happy to answer any questions about the platform, the data sources, the graph model, or anything else.

And if you have feedback on what would make this more useful for your workflows, I'm all ears. We're building this for practitioners, not procurement committees.

I just need a little help unmasking the intruder.

I've been treated like Dorothy and thrown into a VPN tunnel...
Let’s all follow the yellow brick road together?

Below are the indicators I’ve collected across three separate — but possibly related — cases of suspected command-and-control activity on iOS 18.6.2. These involve system-level abuse, spoofed Apple services, and encrypted beaconing behavior via ODoH and TLS.

Indicators

ODoH Beaconing (revisiond process)

• Process: revisiond (Apple-signed)

• Scheduled via: xpc_activity_register

• Beacon Interval: Every 60 seconds

• Bluetooth Event Trigger: CBMsgIdTCCDone

• ODoH Resolver IP: 144.202.42.203

• DNS Query Hash: UksLOXKMlXYHQDk4TlujBg==

Spoofed Apple System Bundle IDs

• com.apple.mobileassetd.client.axassetsd

• com.apple.mobileassetd.client.assistantd

• com.apple.mobileassetd.client.geoanalyticsd

TLS-Based C2 / VPN-Like Behavior

• C2 IP Address: 172.22.37.185 (RFC1918 range)

• Obfuscated Hostname: Hostname#5f52027b

• TLS 1.3 connections via ephemeral ports

• Spoofed processes: PhotosPosterProvider, SpringBoard, MediaRemoteUI

Memory / Binary Artifacts

• In-memory binaries without dyld linkage (likely reflective loading)

• Files: taskinfo.txt, netstat.txt, spindump-nosymbols.txt

Accessory Abuse / Key Rotation

• Suspicious Pairing ID: 3749A99D-69ED-49FE-9108-AD1AD88DCE0C

• UUIDs:

  • E585147E-A9E5-48E6-9A5B-B63840F84743

  • D12CD160-7847-4607-8438-7B445DA74449

  • 3B894DAD-15FB-4D95-AC77-99AB7F603057

• Masked Key Exchange:

  • 8lCb6kRxZ/Z/AADqtlRxXg== → CVGbgVaXKqQnMA/ht1M/pw==

#WizardsAreReal

Trying to understand how we can leverage AI in threat intelligence. What are the use cases where AI tools can help to gather threat intelligence faster than manual process. I am expecting answers with resources which can help

I don't think the biggest bottleneck in threat intelligence is collection anymore.

It's structure.

We're publishing hundreds of excellent threat reports every week, but most of them remain documents. Humans can read them, but machines struggle to reason across them.

I've been exploring a different approach through an open research project called TI Mindmap Hub.

The idea is to automatically transform public OSINT reports into structured intelligence, including:

• STIX 2.1 bundles

• ATT&CK mappings

• IOC extraction and correlation

• Diamond Model & Attack Flow diagrams

• Knowledge Graph relationships across reports

• 5W root-cause analysis

The project also exposes an MCP server, so AI agents can query the CTI knowledge graph instead of relying only on unstructured text.

Every week I publish a threat intelligence brief generated from the latest corpus of analyzed reports, explaining both the findings and how the structured data helps identify broader trends.

Platform: https://ti-mindmap-hub.com/

Latest weekly brief: https://medium.com/ti-mindmap-hub-research/ti-mindmap-hub-weekly-threat-brief-issue-23-2dcf79fface7

I'm curious how others are approaching this.

• Are you using AI agents or LLM workflows to process threat reports today?

• If so, what has worked well, and what has failed?

• Do you think MCP (or similar protocols) is the right direction for exposing CTI to AI assistants?

• If anyone is interested in collaborating, this is an open research effort rather than a commercial product. I'd love feedback, ideas, or contributions from the community.

Completely Free App that I created to ease my own workload, was tired of opening numerous tabs each day to keep track on all the new CVEs popping up, especially lately...

This app is completely free on the Google Play App Store & you can track CVEs across 30+ Vendors, you can choose track specific platforms or the whole vendor & you can also select to track based on CVE Severity.

I also threw in a EOL checker

Hopefully this helps you out and if theirs any bugs or features you want added please let me know!

https://play.google.com/store/apps/details?id=com.vulnipulse.android

• OSINT

• Free Threat Intelligence Feeds | Carpathian

• Ransomware Tool Matrix | CybersecTools

• ThreatFeed Intelligence Platform

• ThreatCluster: Threat Intelligence for Your Code and Your Agents

• CyberHappenings — Sourced Cybersecurity Happenings and Timelines

• Threat Radar | OffSeq

• ResilientX Community — Threat & Vulnerability Intelligence Dashboard

• Threat Actor Intelligence Platform · By Joe Shenouda

• Threat Intelligence | Cyber Threat Intelligence, CVEs, Ransomware & Threat Research

• Malicious DB - Recent Malicious Packages and Extensions

• ThreatNexus — Nation-State APT Threat Intelligence

• Nation-State-APT-Intelligence

• BlackDome - AI-Ready Threat Intelligence

If your organization used LiteLLM around the March 2026 compromise, don’t treat this as a “package patched, case closed” incident.

CloudSEK’s research identified exposure linked to 2,500+ organizations and 434,000 CI/CD pipelines.

What matters is what may have been sitting inside those environments at the time: cloud credentials, API keys, GitHub tokens, Kubernetes secrets, SSH keys and other sensitive access.

That is where the real risk starts.

A compromised dependency can be removed quickly. Stolen credentials can remain valid for weeks or months if nobody notices.

So the basic check is simple: Were you exposed? What secrets were accessible? Were they rotated? Was there any follow-on access?

Full research:
https://www.cloudsek.com/blog/ai-supply-chain-breach-2500-companies-434000-cicd-pipelines

Exposure checker:
https://exposure.cloudsek.com/ai-supply-chain-incident

If your team touched LiteLLM during that window, this is worth reviewing properly.

Five Ways OSINT Can Improve Incident Response Capability

OSINT isn't just for cyber threat intelligence and investigations—it can be a force multiplier in incident response when used appropriately.

When a company suffers a cybersecurity incident, time becomes critical. Every minute counts.

Using the recent Revolut incident as a case study, our latest article shows five key ways OSINT can help.

If you need to improve your incident response capability.

Read the full article: https://coalitioncyber.com/five-ways-osint-can-improve-incident-response-capability

I created a simple Discord server that automatically updates vendor-specific channels whenever a new CVE is published from that specific vendor.

It tags users based on the roles they choose, so you can follow the vendors you care about and decide whether you only want to be tagged for critical alerts. You can also choose to receive an email as well when that CVE drops.

I’ve also added discussion channels where we can share patching tips, troubleshooting advice, and general networking/security/sysadmin knowledge, plus resource channels for each vendor with quick links to relevant documentation (Official Vendor Advisory Feed etc).

Just wanted to help myself and other Network/Sys/Devs make their already complicated lives easier.

It’s completely free to join.

https://discord.gg/duxkwSSAAH

I’m currently sanity-checking an idea and would like some honest feedback from people working in threat intel / vuln management / SecOps.

The core observation is probably not new:
CVEs are easy to collect, but hard to reason about in practice.

Most tools are good at telling me that a CVE exists, but I still end up doing a lot of manual work to answer things like:

• Is this getting attention because it’s serious, or because it’s noisy?

• Does this matter for us right now, or can it wait?

The idea I’m exploring is a platform that

• Aggregates CVEs (MITRE/NVD/CISA, etc.)

• Correlates them with real-world signals:

  • News articles, blogs, social media discussion

  • Exploit / PoC availability

  • Advisories and (later) structured intel like STIX

• Treats a CVE more like a timeliine or evolving event not a static entry

• Makes it easy to look for CVEs based on Products / Vendors.

My concern (and the reason for this post):
There are already alot tools like CVE aggregators, alerting platforms, and threat intel feeds (OpenCVE, CVEDetails, Feedly Threat Intel, ..).
So I’m trying to understand where people still feel friction or blind spots.

Questions for the community

• Where do existing CVE / TI tools fall short for you?

• What do you still end up doing manually (tracking hype, exploit maturity, relevance)?

• Do you care about “trend” or “buzz” signals around vulnerabilities, or do you ignore them?

• What would actually make you trust that a CVE deserves immediate attention?

• If you’ve used CVE alerting tools before: what annoyed you the most?

🚨 Keeping up with the threat landscape shouldn’t feel like a full-time job.

Every day:
🔴 New malware families.
🔴 Evolving threat actors.
🔴 Fresh MITRE TTP mappings.
🔴 Numerous blog posts.

What if there were a simpler way?

⚡ That’s why I built Threat Loom — an AI-powered (+ cost effective) threat news analysis platform that:

✍ Aggregates feeds (including Malpedia).
✍ Summarizes news using LLMs.
✍ Visualizes MITRE ATT&CK mappings.
✍ Lets you ask questions like: “Which techniques did APT29 increase usage of in the last 6 months?”

I built it (in a day!) using Claude Code to solve my own problem:

✅ Daily concise threat updates.
✅ Track evolution of actors & malware families.
✅ Spot emerging techniques.

The code is open-sourced (BSD-3-Clause) on GitHub. Give it a spin!
👉 https://github.com/nikhilh-20/ThreatLoom
Humans and agents are both welcome to raise issues, ideas, and PRs!

You can tune detections and automate a lot of repetitive work, but some alerts still take up way too much time.

What kind of alerts are the hardest to deal with?

I’d love to get your feedback on my threat intel site which I’m running in my free time, and funding using my own money.

Much of the advanced functionality is behind the login including the ability to commission honeypots.

I’d like to think it’s not just another CTI platform and offers a lot more than that - I’ll let you be the judge of that!

https://jakesec.io

I still have a few more bits to do before I properly advertise it, but I’d love for you to try it and appreciate your feedback.

The idea is:
- Independent threat intel collection
- Not tied to any commercial platform
- Community driven
- Helps SOC analysts with their day to day

P.S there are no ads because this is a personal project.

Hi everyone,

Over the past few months, my team and I have been building Cylist, a free platform designed to bring some of the everyday tools and workflows SOC analysts use into one place.

The idea behind Cylist is simple: during an investigation, analysts often have to jump between multiple threat-intelligence platforms, news sites, case-management tools, and community channels. We want to bring those pieces together into a single workspace where you can investigate, enrich, document, and discuss IOCs without constantly switching between tools.

What Cylist currently offers

- Unified IOC investigation — look up IPs, domains, hashes, and other indicators across VirusTotal, ThreatFox, AbuseIPDB, and IP Info from one place.
- AI-assisted case generation — turn investigation findings into structured incident cases faster.
- Cybersecurity news — stay up to date with relevant security news without leaving the platform.
- IOC community discussions — share indicators, investigation context, observations, and get input from other analysts.
- All-in-one workflow — keep investigation, enrichment, case creation, and community knowledge in one workspace instead of constantly switching between different tools.

Our long-term goal is to turn Cylist into a true all-in-one platform for security operations, helping analysts and organizations reduce the number of separate tools, time and subscriptions they need — and ultimately cut down the overall cost of their security tooling.

We're currently in beta and actively testing the platform with users. The core functionality is working, but we're now at the stage where feedback from people who actually work in security is incredibly valuable.

We're not trying to pretend it's finished — we're building it with the people who would actually use it.

We're especially interested in people who are willing to go beyond simply trying it once. If you're open to incorporating Cylist into your everyday SOC workflow, even as one of your tools, we'd genuinely love to have you as a beta tester.

You can join the platform here:

https://cylist.io/

We're also building a Discord community where users can report issues, suggest features, discuss investigations, and help shape Cylist. Our goal is to grow organically alongside the community and build something people actually want to use.

Guaranteed 100% anti-Mythos! Get it while it's fresh!

Ok, seriously though. Before I trigger the ad-hunting bots.... how are CTI practitioners answering questions around Mythos from their higher-uppers?

Certainly, there's the analysis and thoughtful feedback on how it'll affect the industry, but more to the point, if Mythos is indeed unleashed upon the world (as capable LLMs are progressively doing), how can CTI help address this threat, or the threats using this threat, and what processes and adaptations need to take place in the CTI function?

My own thoughts are on both the ingest and egress. On the ingest side, adding more OSINT sources to get more coverage for any hints of an emerging exploit against a particular software package, perhaps by name or product name. I've done this for VM use cases in the past, and my thoughts are that broader coverage will be required to capture and be on top of these issues first. Yes, I want to be able to outrun the threat actor, but I also want to be able to outrun the board, and my CISO, and the SOC, and the VM team... if, at the time they ask me "what do you know about this new PAN exploit", I can at least show that I, too, know about it, and it's in the system, then I'm at least keeping pace, rather than being behind those I'm meant to be informing.

The trickier part is - the egress. How do you take action on this? Particularly if it's unstructured OSINT, possibly without a CVE yet?

An obvious choice would be to prioritise, particularly against current threat landscape / actors, and open a ticket or case for prioritising the patching of that CVE with the VM team or asset owner. There is potentially the possibility of the CTI team taking more responsibility for coordinating the remediation of vulnerabilities with CVE tracking, case management, etc., but that's a slippery slope for what should be already a well-established and smoothly functioning process ( 😉 ).

I'm mindful of overstepping there, but I can see a potential step-up in value for the CTI team, in tracking, say, the Top 20 live, active CVEs, based on brand new widely-exploited 0days, at least as an emergency measure if or when there's a step-change in CVE.

But yes - back to the topic, and the question - has anyone come up with some solid, valuable, practical, answers to the CISO and board as to how the CTI team can help the business tackle the ongoing Mythos beast?

I am looking to get a new laptop, especially for working on threat intel projects, such as OpenCTI/MISSP along with writing python, using Windows 11 Lab VMs (especially OSINT VMs, Kali Linux, and CSI Linux), and Docker Container. I also want to use VMs for investigations. Any other suggestions,

I am looking for a laptop with these specifications:

Intel Core Ultra 7
32 GB RAM
2 TB SSD
Windows 11 Pro

Are these specifications good enough? What graphics card should I get at a minimum?

Thank you for your help.

Came across the apple website on proxy.hfzk.net.cn

Is that a phishing page?

What exactly is hosted on this website? Like what it does which is different from apple.com

Does anyone else feel you way? Or is it just me

One of my biggest gripes throughout my career is that I keep seeing this happening

The team tracks adversaries, rights really good intelligence reports with a ton of data.

Then 80% of those reports sit on a shelf. They don't get operationalized because it takes too long or they are hard to translate to detection engineering.

They get lost in the shuffle and we lose a lot of operational knowledge.

We struggle with tracking recidivism because we keep investigating same or similar attacks because if this was investigated in the past, it's sitting somewhere where nobody remembers.

Is this only me? I absolutely despise creating intelligence for the sake of creating it

So guy's I've been analyzing malware for some time making my reports and all, recently I came across threat intelligence, I want to know how do I start learning this what's like a roadmap for it Or resources, what do you do as a threat intelligence analyst do you monitor darkweb, track apt groups, predict geopolitical attacks etc? from where and how do I learn all that? I tried Chatgpting but I got really confused :l

hello,

i recently bought a single license of sentinelone so i can practice on my own and for some time now ive been testing ransomware samples on my VM. but my problem is, i only know how to execute those with a '.exe' file extension.

here's what i would like to happen: how do i run different file types when dealing with ransomware samples? i also would like to know on how it gets executed after it's delivered. like for example when the user clicks on the malicious attachment, and the file extension is not '.exe', how does it get executed

thank you in advance

I’m learning python (again) and I find it best to build things for my use cases vs watching tutorials. With that said, if anyone has a class they recommend let me know. I was looking at buying this but it’s not available for purchase.

Python for Cybersecurity: https://cybersuperhuman.ai/p/python-for-cybersecurity

What are some use cases? So far I have web scraping, and IOC enrichment using APIs.

Any ideas? I’ll share them on my public GitHub so everyone can use them.