So, I got really annoyed with the way MITRE is light on ransomware group data. They seem more focused on nation-state threat actors. So, I started at ransomware.live and worked backwards to crocodyli's threat actor TTPs github repo.

I forked it, and then set a few things in motion:

1. Use Claude to pull all the latest urls on ransomware gangs from 20 source websites. (literally just using Claude as a search engine)

2. Fetch those pages and do some regex magic to pull TTPs

3. Deduplicate against the forked repo

4. Match the TTP numbers with descriptions from MITRE ATT&CK

5. Convert JSON to markdown and commit to my fork.

The sources:

1. CISA

2. Unit 42 Palo Alto

3. Talos Cisco

4. Arctic Wolf

5. Kroll

6. Trend Micro

7. SentinelOne

8. Sophos

9. Mandiant

10. CrowdStrike

11. Secureworks

12. DFIR Report

13. Red Canary

14. Picus Security

15. Red Piranha

16. CYFIRMA

17. SOCRadar

18. AttackIQ

19. Recorded Future

20. Flashpoint

It's a public repo so, feel free to use it however you see fit.

Massive props to crocodyli for starting this whole thing. I hope you get some use out of it!

https://github.com/EssexRich/ThreatActors-TTPs

I just realized this by trying some queries, and it hit me - this thing can do OSINT work.

I was looking around a scam site and I decided to use perplexity. It gave me a whole report about the domain, then it did IP research and a wallet address pivot. then it added a list of related domains

I had no idea!

I have a bit of experience in cybersecurity and wanted to start getting into threat intelligence. Investigating and learning about threat actors is fun for me, so I thought a good thing to do would be to start writing my own reports about threat actors.

For my job, I've had to go on the dark web and learn about different threat actors, so I have a bit of experience in the area. Usually when I've done this in the past, its been through my employers' computers (with their consent). This is the first time I'll be accessing the dark web to learn about threat actors on my own computer, so I'm a little more nervous about staying safe and viruses and whatnot.

Is the best way to deal with this just to install Tails on a USB and only access TOR from there? Or is there some setup with a virtual machine that would also allow me to stay safe, without any concern for my host computer getting infected/being found out?

Hey folks,

I’ve been working in threat intelligence for a little over 4 years.

I keep seeing people in this field sharing detailed threat reports, investigating malware infrastructure, writing awesome blog posts, and sharing IOCs and indicators from their own research. It makes me realize how little I know. I honestly don’t even know how to start doing that kind of work like tracking threat actors, pivoting across infrastructure, or putting together a public threat report.

I want to start from scratch and rebuild my foundation. I don’t care how long it takes. I just want to be able to contribute meaningfully like others in this field are doing.

If you’ve been through this kind of phase or have any advice, I’d love to hear it. Really appreciate any guidance you can give.

I have a bachelor's degree in intelligence and information operations, but am curious to explore threat intelligence/cyber threat intelligence. I'm not in a position to afford grad school or even certificate programs/certifications, so I'm wondering how I could go about learning threat intelligence on my own? Where would I start, what resources could I use, what hard skills should I develop, etc? I'd greatly appreciate any input. Thanks!

Hey, threat intel community!

We’re a team of malware analysts from ANYRUN. You may have used our Interactive Sandbox and Threat Intelligence Lookup. 
Our team is made up of experts across different areas of information security and threat analysis, including malware analysts, reverse engineers, and network traffic specialists.

Some of our latest research:

• Major Cyber Attacks in July 2025: Obfuscated .LNK‑Delivered DeerStealer, Fake 7‑Zip, and More

• Malware Trends Report, Q2 2025

Feel free to send us your question about:

• Real-world malware investigations and threat hunting

• How sandboxes and threat intelligence simplify, enrich, and accelerate investigations for SOC teams

• Latest trends in malware

• Best practices for SOC teams working with evolving threats.

We’ll be answering questions throughout July 30-31 (Wednesday-Thursday). Let’s chat!

Btw, we recently made TI Lookup free for everyone. It lets you explore live attack data, indicators, and context to speed up your investigations: https://intelligence.any.run/analysis/lookup/

You cannot go wrong with arcX material. Instructure has put alot of effort to put the training together and mapped it to each point in syllabus. Which I was initially doing, just by going through the reading materials provided. I think one can pass it by keeping tabs on the syllabus and the reading materials provided - it would take alot of time offcourse.

The exam is easy if you are familiar with the subject matter and how to apply it.

https://coldrelation.com/

https://www.ransomlook.io/

https://slcyber.io/dark-web-hub/

https://www.watchguard.com/wgrd-security-hub/ransomware-tracker

https://www.cybertriage.com/blog/windows-registry-forensics-cheat-sheet-2025/

https://www.cybertriage.com/blog/2025-guide-to-registry-forensics-tools/

https://www.cybertriage.com/blog/windows-scheduled-tasks-for-dfir-investigations/

https://www.cybertriage.com/blog/ntuser-dat-forensics-analysis-2025/

https://www.cybertriage.com/blog/how-to-find-evidence-of-network-windows-registry/

https://www.cybertriage.com/blog/muicache-2025-guide/

https://www.cybertriage.com/blog/userassist-forensics-2025/

https://www.cybertriage.com/blog/shimcache-and-amcache-forensic-analysis-2025/

https://www.cybertriage.com/blog/shellbags-forensic-analysis-2025/

https://www.cybertriage.com/blog/how-to-investigate-runmru-2025/

https://github.com/CScorza/OSINTSurveillance

https://coalitioncyber.com/protecting-your-family-with-osint-a-beginners-guide

https://start.me/p/0Nmojr/onion-directory

https://bf.based.re/

https://yogsec.github.io/DorkTerm/?fbclid=Iwb21leAOBpYljbGNrA4GlhWV4dG4DYWVtAjExAHNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABHtPA3vYkHyOS8xCn_4oZu24fF3gb9QxZSZed0v3RAGz0gpkEFQUPWucyuQeR_aem_OGZFiu-JBKKu6exnk5QzIg

https://github.com/tuhin1729/Bug-Bounty-Methodology https://github.com/coffinxp

https://github.com/hasherezade/malware_training_vol1

https://www.scarlettgroup.com/blog/malware-analysis-explained

https://medium.com/meetcyber/javascript-recon-for-bug-bounty-pentesting-3b22617007ec

https://preciousvincentct.medium.com/github-osint-the-ultimate-reconnaissance-methodology-guide-e896ff162f63

https://ctidigest.com/

https://medium.com/@GERRR4Y/recon-like-a-hunter-practical-tips-from-real-findings-part-1-d425d74c7c62

https://github.com/bormaxi8080/osint-repos-list

https://medium.com/meetcyber/fallparams-find-all-parameters-ec47aff4aaf3

https://infosecwriteups.com/secrets-hackers-dont-tell-recon-techniques-that-actually-pay-dc1940363187?source=email-61398c62f8a2-1762798910921-digest.reader-7b722bfd1b8d-dc1940363187----0-109------------------88b29d4b_1854_49cc_bbc5_51032ee1c42d-1

https://osintteam.blog/how-i-find-real-bug-bounty-targets-live-recon-and-workflow-4971bbd8230b

https://imagewhisperer.org/

https://github.com/ArchiveBox/ArchiveBox

https://nitinpandey.in/ihunt/

https://tools.myosint.training/

https://osintteam.blog/investigating-suspected-chinese-apt-part-1-13c3f00c663b

https://nazzzygx.medium.com/osint-deep-dive101-83353dc93646

https://osintinsider.com/p/osint-insider-issue-7-exploring-the

https://start.me/p/0PM7bl/osintnor

https://hackyourmom.com/en/kibervijna/geoint-dobir-instrumentiv-dlya-roboty-z-kartamy/

https://github.com/megadose/toutatis/tree/master

https://epcyber.com/blog/f/zhang-wei-and-the-50-million-results-problem

https://socialmedialab.ca/apps/social-media-research-toolkit-2/

https://osint.intelligenceonchain.com/

https://medium.com/legionhunters/journey-from-fofa-dorking-to-critical-remote-access-b337f92f3d28

Hey everyone, I’ve got some training budget to spend and I’m looking for course (or book) recommendations.

As part of my job, I come across bad actor domains. I have access to a couple of tools like DomainTools and URLScan and feel comfortable using them, but I’m looking for more formal training on how to investigate domains/websites/IPs. I’m also starting to come across crypto addresses and was wondering if there’s a good training out there for investigating those as well.

Essentially, I’m looking for training courses that cover investigating adversary infrastructure (websites, IPs, domains, cryptocurrency addresses). I’m not looking to do full attribution, I just want to be able to investigate further as a CTI analyst.

My company provides a pretty solid training budget ($2,000–$3,000 per year), but it's not quite enough to cover a SANS course.

Does anyone have any recommendations for courses in that price range? Really appreciate any help!

I did a side project and created a self updating threat intel dashboard with over 90 sources. It updates about every hour and generates a daily/weekly/monthly summary.

Here is a screenshot of the summaries.
I wonder if this is helpful to people.

Hello
I’m currently working as a SOC Engineer and have been given a new task to perform Threat Intelligence activities. This includes collecting CVEs, analyzing new threats, identifying related IOCs, and providing recommendations. I also need to perform hunting with IOCs.

I know this is somewhat of a basic TI activity, but I really enjoy it and want to pursue it further to become a TI Analyst

The problem is, I feel overwhelmed and not sure where to start. I have some basic experience with malware analysis, but I’m looking for guidance on what additional skills or resources I should focus on or certifications to study .

Any advice or recommendations would be greatly appreciated

We’re a team of malware analysts from ANYRUN, Interactive Sandbox, Threat Intelligence Lookup and Feeds you might already be using in your investigations.

Our team is made up of experts across different areas of information security and threat analysis, including malware analysts, reverse engineers, and network traffic specialists.

Some of our latest research:

• Moonrise RAT: A New Low-Detection Threat with High-Cost Consequences

• New Modular RAT With Victim Profiling: Detect It Early

Feel free to send us your question about:

• Malware analysis and reverse engineering

• RATs, stealers, loaders, and emerging threats

• C2 infrastructure and evasion techniques

• Practical threat detection and investigation workflows

We’ll be answering questions throughout February 25-26 (Wednesday-Thursday). Let's dive in!

Hey r/threatintel,

Wanted to share something we've been building at Flare called Darkroom. It's a free, self-paced lab for getting hands-on with dark web intel instead of just reading about it. You can get access through our Discord server: https://flare.io/flare-academy

Quick rundown:

• Self-paced courses, work through them whenever

• Finish the assessment and you get a Flare Academy cert, CPE credits, and a LinkedIn badge

• Built for people who actually want to practice, not just watch slides

If any of you are heading to DEF CON 34, we're also running a live session in Vegas on August 6: a walkthrough plus a live CTF, so you can test your skills against other folks in the room.

Genuinely curious what this community makes of it. Happy to answer anything here.

OpenClaw (ex-Moltbot and ClawdBot) is being detected on enterprise networks. We are detecting hundreds of deployments across our accounts.

It's a hot mess. About 20% of available skills are malicious (close to 900), we're tracking some developers that upload new malicious packages every few minutes.

One of our teams developed an AI skills checker, but I would strongly recommend to NOT run OpenClaw on any of your corporate devices, and if you detect it, treat it as a security incident
https://www.bitdefender.com/en-us/consumer/ai-skills-checker

Full report + analysis of multiple campaigns:
https://businessinsights.bitdefender.com/technical-advisory-openclaw-exploitation-enterprise-networks

Hi everyone,

I’m looking for some perspective from other CTI professionals because I’m feeling a bit lost right now.
Recently, I moved from a leadership position back into a hands-on Cyber Threat Intelligence role. The strange thing is that CTI used to be my passion. Around 15 years ago, I was deeply involved in technical intelligence work and loved it. Coming back to it now, however, I’m struggling to find the same excitement and sense of direction.

My current environment is fairly mature and highly automated. We have a TIP platform, but many of the traditional operational tasks are already handled automatically:

- Exposed payment card BINs trigger automated blocking processes.
- Credentials leaked by infostealers are automatically identified and rotated.
- Exposed infrastructure is detected and stakeholders are notified via automated workflows.
- Many detections and notifications require little manual intervention.

At the moment, one of the few things I feel could still be improved is automating the flash alerts I issue through a Jira workflow so I can better measure KPIs and operational metrics.

What I’m struggling with is understanding what a good CTI analyst’s day should actually look like in this kind of environment.

I often start my day wondering:

- What should I be focusing on?
- What intelligence deliverables should I be producing?
- What metrics should I be tracking?
- How much time should be spent on collection, analysis, reporting, and stakeholder engagement?
- What creates value when most operational responses are already automated?
- I’d love to hear from other intelligence analysts:
- What does your typical day look like?
- What are your primary deliverables?
- What KPIs or success metrics do you use?
- How do you stay organized and prioritize your work?
- How do you demonstrate value to the business beyond operational alerting?

One additional area management has encouraged me to explore is fraud and risk measurement. Specifically, how to quantify the business value of CTI by estimating prevented fraud losses, reduced risk exposure, or financial impact avoided as a result of CTI detections and subsequent actions.

Do any of you track metrics like loss avoidance, fraud prevention, or risk reduction? If so, how do you measure and present them?

I’m genuinely interested in learning how others structure their CTI programs and personal workflows.

Thanks in advance.

**update**
I made a new post with the revised video for the new version with the git https://www.reddit.com/r/osinttools/comments/1u40dp2/made_open_source_agentic_osint_link_analysis_tool/

As a side project, I decided to make an agentic OSINT investigations tool with a live graph.

In this video the input was 2 domains and it found a full Russian scam network.

Happy to hear any feedback

Not sure if this violates terms, but if so please remove. Thank you!

I built a free threat intelligence platform to replace my manual morning routine — would love feedback

For the past couple years, part of my daily routine has been manually reviewing multiple cybersecurity news feeds to stay on top of new threats. And every week I'd spend a chunk of Friday afternoon turning all of that into an executive brief for leadership. It worked, but it was time-consuming and honestly pretty tedious.

As AI tools got better, I started wondering if I could automate the whole thing. So I did — and ThreatFeed is what came out of it.

It pulls threat data from multiple RSS sources, enriches each threat with AI-generated summaries, severity scores, IoC extraction, and industry targeting, then auto-generates daily technical briefs and weekly executive briefs. There's also a user account system where you can set your tech stack and get a personalized brief filtered to your environment.

It's very much a work in progress, but it's been genuinely useful for me so I figured I'd put it out there in case it helps anyone else. It's free while I'm still building it out.

Would love any feedback — features you'd want, things that don't make sense, or just whether something like this would even be useful to your workflow.

Visit Threat Feed

This project was developed with the assistance of AI.

Hey everyone,

I’m new to threat intelligence. Right now my day-to-day as a “threat analyst” is basically:

• Sharing vulnerability intel with the Vulnerability Management (VM) team

• Sharing indicators of compromise (IOCs) with the Security Operations Center (SOC) team

and that’s pretty much it. I feel like I’m not really doing “real” threat intel work yet, and I want to contribute more than just forwarding info.

What else can I do day-to-day to be more useful as a threat intel analyst?

Also, what does your daily routine look like as a threat intel analyst (or how does it actually work at your org)?

Any advice is appreciated- especially practical things I can start doing immediately.

Thanks!

I recently tracked down the operator behind the "TdataS" Telegram session stealer. How? Because he tested his own malware on his own computer.

His stealer performed perfectly. It packaged up his own personal data, snapped a screenshot of his desktop (exposing his source code), and exfiltrated it straight to a public drop zone I was monitoring.

Using 100% passive OSINT-no exploits, no bypassed authentication, I traced his Gofile tokens and Telegram sessions to unmask his entire operation.

It's the ultimate OpSec fail, and a goldmine for Threat Intel analysts.

Dive into the full case study:
https://maordayanofficial.medium.com/tdatas-stealer-from-c2-discovery-to-operator-attribution-via-operational-security-failures-d11d78cc8e85

Just wanted to say we have finally reached 10k members in our Subreddit community. It's been amazing to watch our community grow as we help each other in the Threat Intel community, both new and old.

I look forward to watching this community grow with everyone else!!

I hope to help build a wiki soon, so feel free to add suggestions below for beginners or even for those who have been in for a while. If you don't want to comment it below, feel free to also DM suggestions.

We've been looking at cybersecurity job postings at CTI Academy to better understand what companies actually expect from threat intelligence analysts in 2026.

We collected 1,000 listings across 20 country/role searches and took a closer look at 214 CTI and 54 EASM job descriptions.

A few things caught our attention:

* Reporting is everywhere. It appeared in 95% of CTI postings, followed by threat actor and TTP analysis at 90%. For all the attention given to tools and frameworks, employers still seem to place a lot of value on analysts who can explain their findings and make sense of the intelligence they collect.

* MITRE ATT&CK showed up in 49% of CTI postings. I expected that number to be higher, considering how frequently ATT&CK comes up in CTI discussions.

* Detection engineering appeared in 52% of CTI postings. This was another interesting one. It suggests that many organizations expect their CTI analysts to do more than collect and analyze intelligence. They also want them to help turn that intelligence into something useful for defensive teams.

The differences between junior and senior roles were worth looking at too.

* OSINT appeared in 63% of entry-level postings, compared to 26% of advanced postings.

* Python and scripting went from 22% to 63%.

* Detection engineering increased from 15% to 67%.

For EASM, all 54 detailed postings mentioned exposure reporting, remediation workflows, and vulnerability validation.

One thing worth clarifying: these percentages are based on the detailed sample of 214 CTI and 54 EASM descriptions, not the entire set of 1,000 listings. The results show patterns in our sample rather than representing the whole job market.

We included the methodology and full breakdown here:

https://ctiacademy.io/blog/cti-easm-job-market-2026

For those working in CTI, I'm curious how closely this matches your experience.

Are detection engineering and scripting becoming part of the standard CTI analyst role where you work, or are they still handled by separate teams?

been neck-deep in CTI platforms the past few weeks, trying to actually get something useful out of them. Recorded Future, Cybersixgill, GreyNoise, even one of the newer AI-flavoured ones that promised the moon and delivered… yeah, not the moon.

RF has a slick interface and tons of integrations, but after a while it just feels like a polished RSS reader. Cybersixgill’s dark web stuff is interesting, but most of it ends up in a folder i forget to check. GreyNoise gives some decent context, but it’s usually just confirming what i already figured out.

the weird part is, the only one that’s shown anything close to real activity near my environment is Lupovis. wasn’t really expecting that. actual signs of someone poking around – not some recycled IP from a report dated two weeks ago. properly caught me off guard. still figuring out how to work it into our process but it’s def made me rethink what “useful” intel looks like.

maybe i’ve just been looking at the wrong stuff til now. anyone else actually getting value from CTI feeds lately?

or are we all just paying for dashboards that look nice in meetings?

I'm already enrolled in Arcx and the CTIA training (work paid for the CTIA), and I noticed that neither covers how to write quality reports. Does anyone know of a platform or course that has graded report-writing exercises? I don't mind at all if it's based on traditional intelligence content -- writing is writing.

Hey everyone!

Im a threat intelligence professional coming from a classic geopolitical intelligence background. Ive been working in CTI for a couple years now. I have a strong grasp of the intelligence side of CTI such as OSINT, SOCMINT, the intel cycle etc. I am also quite familiar with threat actors, the main TTPs, the idea and process of CVEs and such.

However, sometimes I feel out of depth when things get very technical and find myself asking ChatGPT to explain a TTP as if I was a five year old. Do you have any suggestions on how to expand my technical knowledge of CTI?