13 stories tagged threat-intelligence, newest first.
227 points by cubefox | 98 comments
AWS Security Blog post reporting that Amazon's MadPot honeypots saw PHP2Shell exploitation attempts four days before public disclosure, with IOCs and recommended actions.
100 points by coding-maniac | 11 comments
GitHub repository for VoidAccess, an open-source tool that automates dark web OSINT investigations, filtering noise and NSFW content and presenting results as a graph.
193 points by mindracer | 92 comments
Blog post analyzing in-the-wild exploitation of Plex Media Server vulnerabilities used to deploy a cryptocurrency miner.
26 points by ragu4u | 8 comments
A Norforge blog post analyzing more than 20 exposed Cairn panels that reveal how threat actors use autonomous AI agents to select targets, exploit vulnerabilities, and persist.
6 points by jkalbfeld | 0 comments
Product page for Shield, a paid BGP-based blackhole service that distributes threat-feed routes to peers over GRE to block brute-force attacks.
39 points by soltanov | 9 comments
X post announcing REDCELL-26B-A4B, a locally runnable MoE model fine-tuned on OSINT and cyber threat intelligence instructions, published as GGUF on Hugging Face.
474 points by pjf | 346 comments
GreyNoise Labs post analyzing a sudden 59% drop in global telnet traffic on January 14, 2026, days before CVE-2026-24061 was disclosed.
321 points by natebc | 145 comments
Kaspersky Securelist research article analyzing the Notepad++ supply chain attack, its unnoticed execution chains, and new indicators of compromise.
1070 points by vxvxvx | 300 comments
Blog post criticizing Anthropic's report on disrupting an AI-orchestrated cyber espionage campaign; the captured page shows a Cloudflare block screen.
341 points by koakuma-chan | 261 comments
Anthropic news post describing how it detected and disrupted a cyber espionage campaign largely orchestrated using its Claude AI model, with a linked full report.
384 points by notmine1337 | 146 comments
DomainTools threat intelligence article analyzing the leaked "Kim" data dump from the North Korean Kimsuky (APT43) group and its credential theft techniques.
773 points by karel-3d | 271 comments
Google Threat Intelligence Group blog post describing Russia-aligned threat actors targeting Signal Messenger accounts.
544 points by todsacerdoti | 267 comments
Google Threat Analysis Group blog post from September 2023 describing an active North Korean campaign targeting security researchers.