Ransomware tracking and threat research

Threat Intelligence Oct 07, 2026 12 min read

Breaking Into CTI in 2026: A Practitioner's Roadmap from Zero to First Role

This is the wall most people hit trying to get into CTI. The "junior analyst" listing asks for prior intelligence experience, three named tools, a framework or two, and often a certification that costs more than a used car. You read it, you don't tick the boxes, you close the tab. The gap between "interested in threat intelligence" and "employable in threat intelligence" feels like it has no bridge.

Threat Intelligence Sep 27, 2026 12 min read

filen.io as a C2 Channel: How APT28 Turned Zero-Knowledge Cloud Storage Into a Command Path DPI Can't Read

APT28 is routing command-and-control through filen.io, an end-to-end encrypted cloud store. Here's why traditional C2 detection fails and where to look instead.

Threat Intelligence Aug 02, 2026 13 min read

Mass-BCC Breach Emails: How Extortion Crews Weaponize Journalists as a Pressure Channel

Extortion actors are BCC-ing journalists on breach claims to pressure victims into paying. Here's how the tactic works and how to verify a claim before amplifying it.

Malware Analysis Jul 14, 2026 14 min read

Tracking the C2 Infrastructure Behind a Lumma Stealer Spread Through itch.io

A follow-up to G DATA's December 2025 report: from the delivery chain to the C2 infrastructure A note on framing. Thi...

Threat Intelligence Jun 21, 2026 8 min read

Incident Response Tabletop Exercise Example

A practical incident response tabletop exercise example for security teams, with scenario design, injects, roles, metrics, and common failure points.

Threat Intelligence Jun 19, 2026 8 min read

Vulnerability Intelligence Workflow Guide

A vulnerability intelligence workflow guide for SOC and CTI teams to prioritize exploitable risk, reduce noise, and drive faster remediation decisions.

Threat Intelligence Jun 18, 2026 12 min read

The First npm Malware With Valid SLSA Provenance: How Mini Shai-Hulud Hijacked TanStack Without Stealing a Credential

A signed, attested npm package shipped malware. Inside the Mini Shai-Hulud worm, the Pwn Request chain that hijacked TanStack's CI, and why provenance isn't tr

Threat Intelligence Jun 17, 2026 8 min read

How to Analyze Phishing Headers

Learn how to analyze phishing headers to trace sender paths, spot spoofing, validate auth results, and improve email triage in SOC workflows.

Threat Intelligence Jun 15, 2026 9 min read

12 Phishing Email Indicators to Watch

Learn 12 phishing email indicators that matter to SOC teams, analysts, and defenders, from header anomalies to payload behavior and sender spoofing.

SOC & SIEM Jun 15, 2026 13 min read

How to Detect ClickFix Attacks in 2026: RunMRU, Process Lineage, and the Variants Breaking Your Rules

ClickFix is the top initial access method of 2025. Here's how to detect it through RunMRU, process lineage, and PowerShell telemetry, including the 2026 variants.